joyce8/EMBER2024-capa huggingface dataset:
Function at 0x63b19e
Capabilities:
Packed with generic packer

Disassembly:
nop
jmp 0x74924e
nop
jmp 0xbda343
push ebp
test esi, 0x2d061725
mov ebp, esp
sub esp, 4
jmp 0xa9cb1e
nop
jmp 0xbb2887
nop
jmp 0x933d7c
nop
jmp 0x77f53a
nop
nop
jmp 0xb16a01
jmp 0xab5310
nop
jmp 0x62cbee
nop
jmp 0x990a70
nop
nop
nop
jmp 0xb4d9e7
nop
test ebp, edx
cmp ax, 0x1ed1
pushal
or cx, 0x4558
mov eax, 1
rcl esi, 0xd
cmp ebp, 0x7ffb66cf
xchg edx, eax
mov eax, 2
mov eax, 4
mov eax, 2
clc
and ax, dx
mov eax, 5
or si, bx
mov eax, 4
xadd dl, dl
bt bp, 0x6c
mov eax, 2
shld bx, bp, 0x2e
mov eax, 5
stc
mov eax, 6
popal
test esp, 0x221a7a15
bt ax, dx
stc
push edx
mov edx, 1
mov edx, 2
bt edx, 0x96
bts ax, cx
mov edx, 4
mov edx, 2
test al, dh
mov edx, 5
mov edx, 4
cmove edx, eax
not dl
mov edx, 2
sar eax, 0x37
sbb ah, 0x90
mov edx, 5
xor eax, edi
cmc
mov edx, 5
shl eax, 0x13
pop edx
mov dword [ebp - 4], 0x2b7e9735
adc eax, edi
sal eax, 0xc1
push edx
bswap dx
bsf eax, edi
push ecx
stc
shr dh, cl
mov edx, 0x65ae4be3
push esi
rdtsc
cwde
xor esi, esi
cwd
mov eax, dword [ebp + 8]
btc cx, ax
lea ecx, ds:[esi*4]
sbb edx, ebp
xchg dl, dl
sar edx, cl
mov ecx, dword [eax + ecx]
xor ecx, dword [ebp - 4]
rcl dl, cl
mov dx, bp
lea edx, ds:[esi*4]
mov dword [eax + edx], ecx
add esi, 1
cmp di, bx
jmp 0x9b939d
nop
nop
jmp 0x99aee5
nop
nop
jmp 0x961a7b
nop
jmp 0xacdd80
cmp esi, dword [ebp + 0xc]
jne 0x97a6bc
pop esi
xchg dx, cx
bswap cx
mov cx, si
pop ecx
cwd
pop edx
nop
jmp 0xb2683b
nop
jmp 0x6f39fa
mov dword [ebp - 4], 0
jmp 0x8ddf4f
nop
test dh, 0xbc
nop
stc
nop
nop
clc
nop
nop
cmp esp, 0x50a4241c
nop
cmp esp, 0xc7921e0
clc
nop
nop
test ax, bp
clc
nop
jmp 0xae3152
nop
jmp 0xbd6648
nop
jmp 0x97a5e2
nop
jmp 0x7f6768
nop
jmp 0xbe15ac
nop
jmp 0x8d7d96
nop
jmp 0x5e26fb
nop
jmp 0x967a37
nop
nop
jmp 0xa8d0f8
nop
jmp 0x997ddc

Function at 0x66608f
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
cmc
sub esp, 8
jmp 0x9c4475
mov dword [ebp - 4], 0
jmp 0x425bac
Function at 0x8373ce
Capabilities:
Packed with generic packer

Disassembly:
call fcn.004c6bfa
add esp, 4
jmp 0xb2e089
mov dword [ebp - 8], 0
jmp 0xa772c2
push 0
setbe bl
jmp 0x78c6bb
nop
cmp di, di
cmp di, 0x36d8
nop
test edx, esp
nop
stc
nop
nop
nop
clc
nop
jmp 0x782a34
nop
clc
cmp di, di
cmc
nop
nop
cmc
stc
nop
cmp si, dx
nop
cmp dx, sp
test esp, 0x3e796951
cmp sp, 0x7dc9
pushal
neg di
cwd
mov eax, 1
ror ebx, cl
sbb ecx, 0x2d212289
mov eax, 2
rcr esi, 0xda
movzx ebp, di
mov eax, 4
mov eax, 2
bt di, sp
mov eax, 5
shld cx, bp, 6
bt cx, di
mov eax, 4
cmovl bp, cx
add al, 0x1d
sbb cl, 0x22
mov eax, 2
bts ebp, ebx
mov eax, 5
and ebp, 0x5b86cd5
bts ecx, eax
movsx ax, al
mov eax, 6
shr bx, 0x32
btc ebx, ebx
popal
cbw
rol ax, cl
clc
push edx
mov edx, 1
ror al, cl
mov edx, 2
mov edx, 4
sbb dl, 0x71
cmc
mov edx, 2
and dx, 0x64a5
ror dx, 0xf4
mov edx, 5
mov edx, 4
adc ax, 0x2a88
ror al, cl
cmovp eax, esp
mov edx, 2
cmovns ax, bp
lahf
mov edx, 5
add eax, ecx
shr dx, 0xf
xadd ax, dx
mov edx, 5
inc eax
bswap eax
pop edx
btc ax, 0xaf
ror ah, cl
mov dword [ebp - 4], 0
xadd al, ah
bsf eax, esp
bswap ax
mov dword [ebp - 8], 0
push ebx
push ecx
push edx
bsr dx, cx
mov eax, VariantCopy
or dh, cl
dec ebx
rcr cl, 0xa3
cpuid
sar al, cl
movzx eax, dx
shr ecx, 0x10
test dh, 0x7e
mov dword [ebp - 4], ecx
cmc
shrd ax, dx, 0x5b
pop edx
pop ecx
cmc
mov ebx, edi
sal bh, cl
pop ebx
nop
nop
sub eax, 0x2fc07edb
push ebx
push ecx
clc
push edx
add ebx, 0x5dc07a50
shl bx, 0xec
mov edx, ebp
mov eax, reloc.WS2_32.dll_getpeername
cwd
rol dl, cl
xor cx, 0x6cd3
cpuid
bsr ebx, ebx
rol bx, 0x19
or bl, 0x3d
shr edx, 0x18
shr ecx, 0x18
movsx bx, ch
sal bl, cl
add edx, ecx
movsx ebx, bp
mov dword [ebp - 8], edx
pop edx
movzx ebx, dx
pop ecx
bswap bx
jmp 0xb9963d
push dword [ebp - 8]
push 1
mov bx, di
setne bh
xchg bh, bl
mov ebx, 0x4c8aa0
jmp 0x865db2
push dword [ebp - 0xc]
mov ecx, 2
call fcn.004041f7
add esp, 8
cmp ebx, esi
sets bh
mov dword [ebp - 0x14], eax
cmc
shl bh, 0x11
shrd ebx, ebx, 0xde
mov ebx, dword [ebp - 0xc]
cmp edx, edi
test ebx, ebx
jmp 0x94b8e3
call fcn.004c6bfa
lea esp, [esp + 4]
setae bh
mov ebx, dword [ebp - 0x10]
jmp 0xa620a2
push ebp
bt bp, ax
sub ebp, 0x13785063
adc ebp, 0x5bec5b61
mov ebp, esp
test bh, 0x76
sub esp, 0x14
jmp 0xa2956c
call fcn.004c6c12
add esp, 0x10
mov dword [ebp - 0x10], eax
not cx
push dword [ebp - 0x10]
jmp 0x7d7eaa
je 0xb2e089
push ebx
jmp 0x68c535
je 0x81c629
push ebx
jmp 0x81c61d
jmp 0x420089
mov dword [ebp - 4], 0
jmp 0x6aace5
test ebx, ebx
jmp 0x86ec32
jmp 0x74d207
mov eax, dword [ebp - 0x14]
jmp 0x9769e8
pop ebx
cmovge ebx, ecx
xchg bh, bl
push 0x80000301
push 0
bswap bx
push dword [ebp - 4]
jmp 0xc1ccb1
push 1
cmovbe ebx, edx
xchg bl, bh
bswap ebx
mov ebx, 0x4c8aa0
call fcn.004c6c12
add esp, 0x10
cmovs ebx, esi
mov dword [ebp - 0xc], eax
cmovno bx, bp
mov ebx, ecx
push 0x80000301
jmp 0x6d10c8
Function at 0xa33bcc
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
mov eax, 5
movzx ebx, ax
cwde
mov eax, 4
mov ebp, esi
mov dh, 0x26
mov eax, 2
mov eax, 5
mov eax, 6
mov eax, ebp
cwde
popal
not ch
jmp 0x85b980
nop
jmp 0x73e87f
nop
nop
nop
jmp 0x674511
nop
nop
jmp 0xae4e77
nop
nop
nop
jmp 0x92e9a6
mov eax, 1
cwde
movzx edi, bp
mov eax, 2
mov edi, ecx
rdtsc
mov eax, 4
rdtsc
movzx dx, al
cwde
mov eax, 2
jmp 0x671647
push edx
mov cx, di
movzx eax, bp
mov edx, 1
movzx ax, ah
mov edx, 2
cmovg eax, edx
cbw
mov edx, 4
cwd
mov eax, 0x6cdd0c9b
mov edx, 2
mov ecx, esp
movsx cx, ch
cmovs dx, di
mov edx, 5
mov edx, 4
movsx ax, dl
mov ch, ch
mov edx, 2
not cl
cmovge eax, ebx
cwde
mov edx, 5
mov ax, di
movzx ecx, bp
movsx dx, bh
mov edx, 5
cbw
pop edx
lahf
cbw
mov eax, dword fs:[0x30]
bswap ecx
cmovns cx, cx
mov eax, dword [eax + 0x10]
bswap ecx
mov ecx, dword [eax]
mov dword [ebp - 4], eax
cmovns eax, esp
mov ah, 0x6f
mov eax, dword [ebp - 4]
jmp 0xc0faee
nop
jmp 0x6edd24
push ebp
bt ebp, ecx
shrd ebp, ebp, 0x7d
mov ebp, esp
sub esp, 4
jmp 0xb06bf8
nop
nop
pushal
cdq
jmp 0x859b50
mov dword [ebp - 4], 0
jmp 0x789062
jmp loc.00420393

Function at 0xa432e7
Capabilities:
Get number of processors
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
cmp al, 0xe4
sub esp, 4
jmp 0xaf0e89
mov dword [ebp - 4], 0
jmp 0x4600d8
Function at 0xbad0b7
Capabilities:
Packed with generic packer

Disassembly:
nop
jmp 0x433db0
jmp 0x9a79e3
nop
jmp 0xa82de9
nop
nop
jmp 0x979dad
nop
jmp 0xaa2da8
nop
jmp 0x874ab6
push ebp
mov ebp, esp
jmp 0x96b2ee
Function at 0x43a945
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0042f88a
and dword [ebp - 4], 0
cmp dword [0x454778], 0
mov ebx, eax
jne 0x43a9f6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x43aaa7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x447118
push edi
call esi
test eax, eax
je 0x43aaa7
push eax
call fcn.0042f818
mov dword [esp], 0x447108
push edi
mov dword [0x454778], eax
call esi
push eax
call fcn.0042f818
mov dword [esp], 0x4470f4
push edi
mov dword [0x45477c], eax
call esi
push eax
call fcn.0042f818
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x454780], eax
call esi
push eax
call fcn.0042f818
pop ecx
mov dword [0x454788], eax
test eax, eax
je 0x43a9f6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0042f818
pop ecx
mov dword [0x454784], eax
mov eax, dword [0x454784]
cmp eax, ebx
je 0x43aa4e
cmp dword [0x454788], ebx
je 0x43aa4e
push eax
call fcn.0042f893
push dword [0x454788]
mov esi, eax
call fcn.0042f893
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x43aa4e
test edi, edi
je 0x43aa4e
call esi
test eax, eax
je 0x43aa45
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x43aa45
test byte [ebp - 0xc], 1
jne 0x43aa4e
or dword [ebp + 0x10], 0x200000
jmp 0x43aa87
mov eax, dword [0x45477c]
cmp eax, ebx
je 0x43aa87
push eax
call fcn.0042f893
pop ecx
test eax, eax
je 0x43aa87
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x43aa87
mov eax, dword [0x454780]
cmp eax, ebx
je 0x43aa87
push eax
call fcn.0042f893
pop ecx
test eax, eax
je 0x43aa87
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x454778]
call fcn.0042f893
pop ecx
test eax, eax
je 0x43aaa7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x43aaa9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401bdd
Capabilities:
Get common file path

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push 0x400
call fcn.00403dc0
mov dword [esp], eax
mov eax, dword [0x40b3b0]
push eax
push eax
call fcn.00405eb2
lea ecx, [esp + 8]
pop edx
call fcn.004030f0
push dword [esp]
push 0
push 0x40a00d
push dword [esp + 0x10]
call sub.hreiben__GetTempFileNameA
mov eax, dword [0x40b3b0]
push eax
push eax
push dword [esp + 8]
call fcn.00403e50
lea ecx, [0x40b12c]
pop edx
call fcn.004030f0
push dword [esp]
call fcn.00403e30
push dword [0x40b12c]
call fcn.00405ea0
push dword [0x40b12c]
call fcn.00405f13
mov eax, dword [0x40b3b0]
push eax
push eax
call fcn.00405dd5
lea ecx, [0x40b124]
pop edx
call fcn.004030f0
mov eax, dword [esp + 0x14]
call fcn.00403ea0
push eax
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x401cea
mov ebx, dword [esp + 0x18]
inc ebx
mov eax, ebx
call fcn.00403ea0
mov ebx, eax
cmp ebx, 1
jne 0x401cc3
push dword [0x40b3b0]
mov edx, 0x40a00e
call fcn.004074f0
mov edx, dword [0x40b124]
call fcn.004074f0
mov edx, 0x40a011
call fcn.004074f0
lea ecx, [0x40b128]
pop edx
call fcn.004030f0
mov edx, dword [0x40b12c]
push dword [0x40b3b0]
call fcn.004074f0
lea ecx, [0x40b124]
pop edx
call fcn.004030f0
mov dword [esp + 0xc], 2
jmp 0x401cfc
mov ebx, 1
cmp ebx, dword [esp]
jne 0x401cfc
mov dword [esp + 0xc], 1
pop eax
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 8]
mov eax, ebx
call fcn.00403ea0
mov dword [0x40b11c], eax
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 8]
inc ebx
mov eax, ebx
call fcn.00403ea0
mov dword [0x40b120], eax
mov eax, 1
jmp 0x401d2f
push dword [esp + 4]
call fcn.00407550
add esp, 0xc
pop ebx
ret 4
Function at 0x4020b1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
xor eax, eax
push eax
push eax
mov edx, dword [esp + 0x10]
lea ecx, [esp]
call fcn.00403100
push 0xa
push dword [esp + 4]
push dword [esp + 0x14]
call sub.hreiben__FindResourceA
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x402102
push dword [esp + 4]
push dword [esp + 0x10]
call sub.hreiben__LoadResource
mov dword [0x40b130], eax
push dword [esp + 4]
push dword [esp + 0x10]
call sub.hreiben__SizeofResource
mov dword [0x40b16c], eax
mov eax, dword [esp + 4]
jmp 0x40210a
push dword [esp]
call fcn.00407550
add esp, 8
ret 8

Function at 0x402761
Capabilities:
Create process on windows

Disassembly:
push ebp
push ebx
mov edx, 0x14
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x402768
mov edx, dword [esp + 0x5c]
lea ecx, [esp]
call fcn.00403100
mov edx, dword [esp + 0x60]
lea ecx, [esp + 4]
call fcn.00403100
mov edx, dword [esp + 0x64]
lea ecx, [esp + 8]
call fcn.00403100
lea eax, [esp + 0xc]
lea ebp, [esp + 0xc]
mov dword [ebp], 0x3c
mov dword [ebp + 4], 0x140
mov dword [ebp + 0x1c], 0
mov eax, str.open
mov dword [ebp + 0xc], eax
mov eax, dword [esp]
mov dword [ebp + 0x10], eax
mov eax, dword [esp + 8]
mov dword [ebp + 0x14], eax
mov eax, dword [esp + 4]
mov dword [ebp + 0x18], eax
lea eax, [esp + 0xc]
push eax
call sub.cht_untersttzt._ShellExecuteExA
mov dword [esp + 0x48], eax
push 0x19
call sub.hreiben__Sleep
lea eax, [esp + 0x4c]
push eax
lea ebp, [esp + 0x10]
push dword [ebp + 0x38]
call sub.hreiben__GetExitCodeProcess
and eax, eax
je 0x40280f
mov ebx, dword [esp + 0x4c]
cmp ebx, 0x103
je 0x40280f
jmp 0x402811
jmp 0x4027e2
mov eax, 1
jmp 0x40281a
push dword [esp]
call fcn.00407550
push dword [esp + 4]
call fcn.00407550
push dword [esp + 8]
call fcn.00407550
add esp, 0x50
pop ebx
pop ebp
ret 0xc

Function at 0x4038b5
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
je 0x4038cd
push dword [esp + 4]
push 0x40384e
call dword [sym.imp.tzt._EnumWindows]
jmp 0x40390a
push esi
mov esi, dword [0x40b1c0]
test esi, esi
je 0x403909
push ebx
push edi
mov ebx, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.hreiben__GetCurrentThreadId]
cmp dword [edi], eax
jne 0x403901
push 1
push dword [esi + 0xc]
call dword [sym.imp.tzt._EnableWindow]
push edi
push 0x40b1c0
call fcn.0040681d
pop ecx
pop ecx
test ebx, ebx
mov esi, ebx
jne 0x4038da
pop edi
pop ebx
pop esi
ret 4
Function at 0x403cd7
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x130
push esi
mov esi, dword [sym.imp.hreiben__GetVersionExA]
push edi
push 0x64
pop edi
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x94
call esi
test eax, eax
je 0x403d7b
mov eax, dword [ebp - 0xc]
dec eax
je 0x403d5e
dec eax
jne 0x403d7b
mov eax, dword [ebp - 0x18]
sub eax, 3
je 0x403d5a
dec eax
je 0x403d56
dec eax
je 0x403d3c
dec eax
jne 0x403d7b
push 0x46
pop edi
lea eax, [ebp - 0xb8]
push eax
mov dword [ebp - 0xb8], 0x9c
call esi
test eax, eax
je 0x403d7b
cmp byte [ebp - 0x1e], 1
je 0x403d7b
push 0x4b
jmp 0x403d7a
mov eax, dword [ebp - 0x14]
sub eax, 0
je 0x403d52
dec eax
je 0x403d4e
dec eax
jne 0x403d7b
push 0x41
jmp 0x403d7a
push 0x3c
jmp 0x403d7a
push 0x32
jmp 0x403d7a
push 0x14
jmp 0x403d7a
push 5
jmp 0x403d7a
cmp dword [ebp - 0x14], 0
je 0x403d78
cmp dword [ebp - 0x14], 0xa
je 0x403d74
cmp dword [ebp - 0x14], 0x5a
jne 0x403d7b
push 0x28
jmp 0x403d7a
push 0x1e
jmp 0x403d7a
push 0xa
pop edi
mov eax, edi
pop edi
pop esi
add ebp, 0x78
leave
ret

Function at 0x4045fc
Capabilities:
Get graphical window text

Disassembly:
push edi
push dword [esp + 8]
push dword [0x40b424]
call fcn.00406690
mov edi, eax
test edi, edi
je 0x40465e
mov eax, dword [edi + 4]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x404625
push dword [esp + 0xc]
push edi
call eax
jmp 0x40465e
push ebx
push esi
push dword [edi]
call dword [sym.imp.tzt._GetWindowTextLengthA]
push dword [esp + 0x14]
mov esi, eax
push esi
call fcn.00407750
mov ebx, eax
lea eax, [esi + 1]
push eax
push ebx
mov byte [ebx], 0
push dword [edi]
call dword [sym.imp.tzt._GetWindowTextA]
push ebx
call sub.esem_Betriebssytem_nicht_untersttzt._strlen
pop ecx
sub esi, eax
push esi
call fcn.004077f0
pop esi
pop ebx
pop edi
ret 8
Function at 0x405d3c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [sym.imp.tzt._GetKeyState]
push 9
call esi
test al, al
jns 0x405daa
push 0x11
call esi
test al, al
js 0x405daa
push 0x10
call esi
test al, al
js 0x405daa
push 0x12
call esi
test al, al
js 0x405daa
mov esi, dword [sym.imp.tzt._GetFocus]
push 5
lea eax, [ebp - 8]
push eax
call esi
push eax
call dword [sym.imp.tzt._GetClassNameA]
push 4
lea eax, [ebp - 8]
push str.Rich
push eax
call sub.esem_Betriebssytem_nicht_untersttzt._strncmp
add esp, 0xc
test eax, eax
jne 0x405daa
push eax
push eax
push 0x44e
call esi
push eax
call dword [sym.imp.tzt._SendMessageA]
test ax, 0x800
je 0x405dce
push str.PB_WindowID
push dword [ebp + 8]
call dword [sym.imp.tzt._GetPropA]
test eax, eax
je 0x405dce
dec eax
push eax
push dword [0x40b42c]
call fcn.00406690
mov eax, dword [eax + 8]
jmp 0x405dd0
xor eax, eax
pop esi
leave
ret 4

Function at 0x405f13
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
cmp dword [ebp + 8], 0
je 0x405f86
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call sub.esem_Betriebssytem_nicht_untersttzt._strncpy
lea eax, [ebp - 0x108]
push eax
mov byte [ebp - 4], 0
call sub.esem_Betriebssytem_nicht_untersttzt._strlen
add esp, 0x10
lea eax, [ebp + eax - 0x108]
jmp 0x405f68
lea ecx, [eax - 1]
mov dl, byte [ecx]
cmp dl, 0x20
je 0x405f66
cmp dl, 0x5c
je 0x405f66
cmp dl, 0x2f
jne 0x405f72
mov eax, ecx
lea ecx, [ebp - 0x108]
cmp eax, ecx
ja 0x405f52
mov byte [eax], 0
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.hreiben__CreateDirectoryA]
jmp 0x405f88
xor eax, eax
leave
ret 4

Function at 0x405f90
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
cmp dword [esi + 0x14], eax
mov dword [esp + 4], eax
jne 0x405fc5
mov ecx, dword [esi + 8]
sub ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.hreiben__WriteFile]
mov ecx, dword [esi + 8]
mov eax, dword [esp + 4]
mov dword [esi + 0xc], ecx
pop esi
pop ecx
ret 4

Function at 0x406250
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
xor eax, eax
test esi, esi
mov dword [esp + 4], eax
je 0x406299
cmp byte [esi], al
je 0x406299
mov eax, dword [esp + 0xc]
mov ecx, dword [0x40b43c]
push eax
push ecx
call fcn.00406690
test eax, eax
je 0x4062c7
cmp dword [eax + 4], 0
mov ecx, esi
push edi
lea edi, [ecx + 1]
je 0x4062a0
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x406285
sub ecx, edi
push ecx
push esi
push eax
call fcn.00406330
pop edi
pop esi
pop ecx
ret 8
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x4062a0
mov eax, dword [eax]
push 0
lea edx, [esp + 0xc]
push edx
sub ecx, edi
push ecx
push esi
push eax
call dword [sym.imp.hreiben__WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 8
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 8
Function at 0x4062d0
Capabilities:
Write file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
test edi, edi
mov dword [esp + 4], eax
je 0x406329
push esi
mov esi, dword [esp + 0x18]
test esi, esi
je 0x406328
mov eax, dword [esp + 0x10]
mov ecx, dword [0x40b43c]
push eax
push ecx
call fcn.00406690
test eax, eax
je 0x406324
cmp dword [eax + 4], 0
je 0x406312
push esi
push edi
push eax
call fcn.00406330
pop esi
pop edi
pop ecx
ret 0xc
mov eax, dword [eax]
push 0
lea edx, [esp + 0xc]
push edx
push esi
push edi
push eax
call dword [sym.imp.hreiben__WriteFile]
mov eax, dword [esp + 8]
pop esi
pop edi
pop ecx
ret 0xc

Function at 0x406330
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 0x14], 1
push edi
mov dword [esp + 8], 0
jne 0x406365
mov eax, dword [esi + 0xc]
mov ecx, dword [esi]
push 1
push 0
neg eax
push eax
push ecx
call dword [sym.imp.hreiben__SetFilePointer]
mov edx, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], edx
mov ecx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
cmp ecx, edi
jle 0x4063de
mov eax, dword [esi + 8]
add eax, dword [esi + 4]
sub eax, ecx
mov ecx, edi
sub ecx, 1
je 0x4063cb
sub ecx, 1
je 0x4063b6
sub ecx, 2
je 0x4063a3
mov ecx, dword [esp + 0x14]
push edi
push ecx
push eax
call sub.esem_Betriebssytem_nicht_untersttzt._memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov ecx, dword [edx]
mov dword [eax], ecx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cx, word [edx]
mov word [eax], cx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cl, byte [edx]
mov byte [eax], cl
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
push esi
call fcn.00405f90
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x40640b
mov eax, dword [esp + 0x14]
mov ecx, dword [esi]
push 0
lea edx, [esp + 0xc]
push edx
push edi
push eax
push ecx
call dword [sym.imp.hreiben__WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
mov edx, dword [esp + 0x14]
push edi
push edx
add ecx, eax
push ecx
call sub.esem_Betriebssytem_nicht_untersttzt._memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
Function at 0x406960
Capabilities:
Encode data using xor
Hash data with crc32
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push esi
or esi, 0xffffffff
test eax, eax
je 0x406b15
push ebx
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.hreiben__CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 8], ebx
je 0x406b14
mov eax, dword [0x40b0f8]
push ebp
push 0x1000
push 0
push eax
call dword [sym.imp.hreiben__HeapAlloc]
mov ebp, eax
test ebp, ebp
mov dword [esp + 0x10], ebp
je 0x406b0c
push edi
nop
push 0
lea ecx, [esp + 0x20]
push ecx
push 0x1000
push ebp
push ebx
call dword [sym.imp.hreiben__ReadFile]
mov edx, dword [esp + 0x1c]
cmp edx, 8
mov eax, ebp
mov edi, edx
jb 0x406ace
mov ebp, edx
shr ebp, 3
lea ebx, [ebx]
movzx ebx, byte [eax]
xor ebx, esi
and ebx, 0xff
add eax, 1
mov ecx, esi
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090e8]
movzx ebx, byte [eax]
xor ebx, ecx
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090e8]
movzx ebx, byte [eax + 1]
xor ebx, ecx
and ebx, 0xff
add eax, 1
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090e8]
movzx ebx, byte [eax + 1]
xor ebx, ecx
add eax, 1
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090e8]
movzx ebx, byte [eax + 1]
xor ebx, ecx
add eax, 1
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090e8]
movzx ebx, byte [eax + 1]
xor ebx, ecx
add eax, 1
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090e8]
movzx ebx, byte [eax + 1]
add eax, 1
xor ebx, ecx
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090e8]
movzx ebx, byte [eax + 1]
add eax, 1
xor ebx, ecx
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090e8]
add eax, 1
sub edi, 8
sub ebp, 1
mov esi, ecx
jne 0x4069f0
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
test edi, edi
je 0x406aef
movzx ecx, byte [eax]
xor ecx, esi
and ecx, 0xff
shr esi, 8
xor esi, dword [ecx*4 + 0x4090e8]
add eax, 1
sub edi, 1
jne 0x406ad2
cmp edx, 0x1000
je 0x4069c0
mov edx, dword [0x40b0f8]
push ebp
push 0
push edx
call dword [sym.imp.hreiben__HeapFree]
pop edi
push ebx
call dword [sym.imp.hreiben__CloseHandle]
pop ebp
pop ebx
mov eax, esi
not eax
pop esi
add esp, 8
ret 4

Function at 0x406b20
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Check os version
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x33c
push esi
lea eax, [ebp - 0x114]
push eax
mov dword [ebp - 0x114], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x104], 2
jne 0x401045
cmp dword [ebp - 0x110], 6
ja 0x40103e
jne 0x401045
cmp dword [ebp - 0x10c], 2
jb 0x401045
mov esi, 0x1100
jmp 0x401048
push 8
pop esi
push 0x104
lea eax, [ebp - 0x33c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x33c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp + eax*2 - 0x33c]
jmp 0x40107d
lea ecx, [eax - 2]
cmp word [ecx], 0x5c
je 0x401087
mov eax, ecx
lea ecx, [ebp - 0x33c]
cmp eax, ecx
ja 0x401072
push str.Tsu.dll
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
push 0
lea eax, [ebp - 0x33c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
jne 0x4010b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str._TsuMainW_8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4010a7
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call esi
jmp 0x4010ad