joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421a70
Capabilities:
Create thread

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x1c]
mov eax, dword [0x464010]
xor eax, esp
mov dword [esp + 4], eax
push 0
push 0x102c
push 1
call fcn.0040e430
add esp, 0xc
mov esi, eax
mov dword [eax], 0
lea edi, [eax + 4]
mov dword [eax + 4], ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x10], eax
mov dword [esi + 0x1028], ebx
mov byte [esi + 0x16], 0
mov word [esi + 0x14], 0
mov eax, dword [esp + 0x24]
mov dword [esi + 0x18], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0x1c], eax
cmp dword [0x464018], 0xffffffff
jne 0x421b23
mov dword [0x4654ac], 0x4654ac
mov dword [0x4654b0], 0x4654ac
push 0x4654b4
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x464018], eax
push 0
push 0x422210
push eax
call fcn.004040e0
add esp, 0xc
mov eax, esp
push eax
push 0
push edi
push 0x421b60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x421b43
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esi + 0x17], 1
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0043208f
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x421d50
Capabilities:
Create thread

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x1c]
mov eax, dword [0x464010]
xor eax, esp
mov dword [esp + 4], eax
push 0
push 0x102c
push 1
call fcn.0040e430
add esp, 0xc
mov esi, eax
mov dword [eax], 1
lea edi, [eax + 4]
mov dword [eax + 4], ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], ebx
lea eax, [esi + 0x30]
push eax
call fcn.00422480
add esp, 4
mov dword [esi + 0x44], 0
mov eax, dword [esp + 0x20]
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], esi
mov eax, dword [esp + 0x28]
mov dword [esi + 0x1c], eax
cmp dword [0x464018], 0xffffffff
jne 0x421e13
mov dword [0x4654ac], 0x4654ac
mov dword [0x4654b0], 0x4654ac
push 0x4654b4
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x464018], eax
push 0
push 0x422210
push eax
call fcn.004040e0
add esp, 0xc
mov eax, esp
push eax
push 0
push edi
push 0x421e50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x421e33
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0043208f
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x422d10
Capabilities:
Get session user name

Disassembly:
push edi
push esi
sub esp, 8
mov eax, dword [0x464010]
xor eax, esp
mov dword [esp + 4], eax
cmp byte [0x4654d8], 0
je 0x422d38
mov ecx, dword [0x4654d4]
test ecx, ecx
jne 0x422d7b
jmp 0x422dc8
push str.secur32.dll
call fcn.0040f1e0
add esp, 4
mov esi, eax
push str.sspicli.dll
call fcn.0040f1e0
add esp, 4
test esi, esi
je 0x422d68
push str.GetUserNameExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
jmp 0x422d6a
xor ecx, ecx
mov dword [0x4654d4], ecx
mov byte [0x4654d8], 1
test ecx, ecx
je 0x422dc8
mov dword [esp], 0
mov edi, esp
push edi
push 0
push 8
call ecx
push 0
push 1
push dword [esp + 8]
call fcn.00442ed8
add esp, 0xc
mov esi, eax
push edi
push eax
push 8
call dword [0x4654d4]
test al, al
je 0x422dbf
push 0x40
push esi
call fcn.00434e10
add esp, 8
test eax, eax
je 0x422e15
mov byte [eax], 0
jmp 0x422e15
push esi
call fcn.0040e4c0
add esp, 4
mov dword [esp], 0
mov edi, esp
push edi
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x422de3
mov eax, dword [esp]
jmp 0x422def
mov dword [esp], 0x100
mov eax, 0x100
push 0
push 1
push eax
call fcn.0040e430
add esp, 0xc
mov esi, eax
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x422e15
push esi
call fcn.0040e4c0
add esp, 4
xor esi, esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0043208f
mov eax, esi
add esp, 8
pop esi
pop edi
ret

Function at 0x422f90
Capabilities:
Get common file path

Disassembly:
push esi
cmp dword [0x4654f8], 0
jne 0x422ff0
push dword [0x4654fc]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, dword [0x4654fc]
jb 0x422ff0
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0
push 1
push eax
push 1
push 0x4654fc
push dword [0x4654f8]
call fcn.0040e4d0
add esp, 0x18
mov dword [0x4654f8], eax
push dword [0x4654fc]
push eax
call esi
cmp eax, dword [0x4654fc]
jae 0x422fc0
mov eax, dword [0x4654f8]
pop esi
ret
Function at 0x424a80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edi, dword [ecx + eax*4]
mov esi, edx
rol esi, 4
xor esi, dword [ecx + eax*4 + 0x40]
mov dword [esp + 0x1c], edx
xor edi, edx
mov eax, esi
and eax, 0xfc00fc
or eax, 0xff00ff00
mov dword [esp], eax
shr esi, 8
and esi, 0xfc00fc
or esi, 0xff00ff00
mov dword [esp + 8], esi
mov eax, edi
and eax, 0xfc00fc
or eax, 0xff00ff00
mov dword [esp + 4], eax
shr edi, 8
and edi, 0xfc00fc
or edi, 0xff00ff00
mov dword [esp + 0xc], edi
xor edi, edi
mov edx, 0x452a88
xor esi, esi
mov dword [esp + 0x10], 0
xor ecx, ecx
nop
nop
nop
mov dword [esp + 0x14], edi
mov edi, dword [edx]
mov eax, dword [esp]
and edi, eax
xor ecx, edi
mov edi, dword [edx + 4]
mov ebx, dword [esp + 8]
and edi, ebx
xor dword [esp + 0x10], edi
mov edi, dword [edx + 8]
mov ebp, dword [esp + 4]
and edi, ebp
xor esi, edi
mov dword [esp + 0x20], esi
mov edi, dword [edx + 0xc]
mov esi, dword [esp + 0xc]
and edi, esi
xor dword [esp + 0x14], edi
mov edi, dword [esp + 0x14]
add eax, 0x80008
mov dword [esp], eax
add ebx, 0x80008
mov dword [esp + 8], ebx
add ebp, 0x80008
mov dword [esp + 4], ebp
add esi, 0x80008
mov dword [esp + 0xc], esi
mov esi, dword [esp + 0x20]
add edx, 0x10
cmp edx, 0x452c88
jb 0x424b00
mov edx, ecx
shl edx, 4
mov eax, dword [esp]
and eax, 0x40004
imul ebp, eax, 0x3c00
and ebp, edx
xor ebp, ecx
mov ecx, dword [esp + 0x10]
mov eax, ecx
shl eax, 4
mov edx, dword [esp + 8]
and edx, 0x40004
imul edx, edx, 0x3c00
and edx, eax
xor edx, ecx
mov ecx, esi
shl ecx, 4
mov eax, dword [esp + 4]
and eax, 0x40004
imul eax, eax, 0x3c00
and eax, ecx
xor eax, esi
mov esi, edi
shl esi, 4
mov ecx, dword [esp + 0xc]
and ecx, 0x40004
imul ecx, ecx, 0x3c00
and ecx, esi
xor ecx, edi
shr edx, 4
and edx, 0xf000f00
shr eax, 8
and eax, 0xf000f0
or eax, edx
and ecx, 0xf000f000
shr ebp, 0xc
and ebp, 0xf000f
or eax, ecx
or ebp, eax
shr eax, 4
xor eax, ebp
and eax, 0x7030702
xor ebp, eax
shl eax, 4
xor eax, ebp
mov ecx, eax
shr ecx, 8
xor ecx, ebp
and ecx, 0x4e009e
xor eax, ecx
shl ecx, 8
xor ecx, eax
mov edx, ecx
shr edx, 0x10
xor edx, ecx
and edx, 0xd9d3
xor ecx, edx
shl edx, 0x10
xor edx, ecx
mov eax, edx
shr eax, 4
xor eax, edx
and eax, 0x5040004
mov ecx, eax
shl eax, 4
xor eax, dword [esp + 0x18]
xor ecx, edx
shr edx, 1
xor edx, ecx
xor eax, ecx
and edx, 0x4045015
xor eax, edx
add edx, edx
xor edx, eax
mov eax, dword [esp + 0x1c]
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x424c70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edi, dword [esp + 0x20]
test edi, edi
je 0x424c9a
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
lea esi, [edi - 1]
mov ebx, edi
and ebx, 3
cmp esi, 3
jae 0x424ca1
xor esi, esi
test ebx, ebx
jne 0x424cee
jmp 0x424d03
mov eax, 1
jmp 0x424d0d
mov dword [esp], ebx
and edi, 0xfffffffc
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax]
xor bl, byte [ecx]
mov bh, byte [eax + 1]
movzx ebp, bl
xor bh, byte [ecx + 1]
or ebp, esi
mov bl, byte [eax + 2]
xor bl, byte [ecx + 2]
movzx esi, bh
movzx ebx, bl
or ebx, esi
or ebx, ebp
movzx edx, byte [eax + 3]
add eax, 4
xor dl, byte [ecx + 3]
add ecx, 4
movzx esi, dl
or esi, ebx
add edi, 0xfffffffc
jne 0x424cb0
mov ebx, dword [esp]
test ebx, ebx
je 0x424d03
xor edi, edi
movzx edx, byte [eax + edi]
xor dl, byte [ecx + edi]
movzx edx, dl
or esi, edx
add edi, 1
cmp ebx, edi
jne 0x424cf0
mov eax, 0x100
sub eax, esi
shr eax, 8
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x428d20
Capabilities:
Hash data using sha512

Disassembly:
push ebx
push edi
push esi
mov ebx, dword [esp + 0x10]
cmp ebx, 0x41
jb 0x428d40
push pe_nt_image_headers32
push 0x45e198
push 0x45c7e2
call fcn.0043bf69
add esp, 0xc
push 0
push 0xf0
push 1
call fcn.0040e430
add esp, 0xc
lea edx, [eax + 0xe4]
mov dword [eax + 0xe4], 0x453218
mov dword [eax + 0x40], ebx
lea ecx, [eax + 0xd8]
mov dword [eax + 0xd8], 0x429060
mov dword [eax + 0xdc], 0
mov dword [eax + 0xe0], ecx
mov dword [eax + 0xe8], ecx
mov ecx, 0x10
mov edi, eax
mov esi, 0x453248
rep movsd dword es:[edi], dword [esi]
xor ebx, 0xf2bdc908
mov dword [eax], ebx
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 0xc4], 0
mov dword [eax + 0xc8], 0
mov dword [eax + 0xcc], 0
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0
mov eax, edx
pop esi
pop edi
pop ebx
ret
Function at 0x4327d8
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x432817
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x432817
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x432817
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x432817
cmp dword [ecx + 0x74], 0xe
jbe 0x432817
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x43e440
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43e46d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43e46d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x43e7ed
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4548c8
push 0x4548c0
push str.FlsAlloc
push 0x1e
call fcn.0043ed4c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x43e821
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x43e827
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x43e86b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4548d8
push 0x4548d0
push str.FlsGetValue
push 0x20
call fcn.0043ed4c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x43e8a2
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x442ed8
Capabilities:
Terminate process

Disassembly:
sub esp, 0x2c
mov eax, dword [str.kernel32.dll]
mov dword [esp + 0x1c], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, dword [str.InitOnceExecuteOnce]
sub esp, 4
mov dword [esp], eax
mov dword [esp + 4], edx

Function at 0x442f01
Capabilities:
Link function at runtime on windows
Terminate process

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [fcn.0044d5b5]
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edx
lea edx, [esp + 0x1c]
mov dword [esp], edx
call eax
sub esp, 0x10
test eax, eax

Function at 0x442f32
Capabilities:
Terminate process

Disassembly:
je 0x442f38
add esp, 0x2c
ret
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x443f11
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x443fae
push ebx
push esi
call fcn.00443fff
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00443e5a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x443f5b
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x443fad
push edi
push eax
call fcn.00440c28
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x443f7b
call fcn.0043ff74
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x443fac
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00443e5a
add esp, 0x20
test eax, eax
jne 0x443f9a
push edi
call fcn.0043ff74
jmp 0x443fa2
push ebx
call fcn.0043ff74
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x443fb1
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x443fc2
pop esi
ret
push ebx
push edi
push esi
call fcn.00443fff
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00440c28
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x443fea
push ebx
push esi
push edi
call fcn.00434730
add esp, 0xc
push 0
call fcn.0043ff74
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x444036
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00444041

Function at 0x44442f
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044443a

Function at 0x44516e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00445179
Function at 0x44618a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x465ca8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4461ca
cmp byte [ebx], 0xa
jne 0x4461ca
or byte [eax + edi + 0x28], 4
jmp 0x4461cf
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x4462cd
mov al, byte [edx]
cmp al, 0x1a
je 0x4462af
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x4461fe
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x446223
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x44622d
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x4461e0
jmp 0x4462cd
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4462aa
cmp dword [ebp - 0xc], 0
je 0x4462aa
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x465ca8]
test byte [eax + edi + 0x28], 0x48
je 0x446284
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x44626f
mov byte [esi], dl
jmp 0x446280
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x465ca8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x4462cd
cmp byte [ebp - 1], 0xa
jne 0x446293
cmp esi, ebx
jne 0x446293
mov byte [esi], 0xa
jmp 0x4462cc
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0044ccc5
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4462cd
mov byte [esi], 0xd
jmp 0x4462cc
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x465ca8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4462c9
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4462cd
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4462d6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x465ca8]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x446319
cmp word [esi], dx
jne 0x446319
or byte [edi + eax + 0x28], 4
jmp 0x44631e
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x446471
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x446451
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x446360
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x446396
cmp eax, edx
jae 0x4463a2
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x446338
jmp 0x446471
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x44644d
cmp dword [ebp - 0x14], 0
je 0x44644d
mov eax, dword [ebx*4 + 0x465ca8]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x446425
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x4463ee
mov word [esi], cx
jmp 0x446421
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x465ca8]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x465ca8]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x465ca8]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x446471
pop ebx
cmp word [ebp - 4], bx
jne 0x446436
cmp esi, dword [ebp + 0xc]
jne 0x446436
mov word [esi], bx
jmp 0x44646e
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0044ccc5
add esp, 0x10
cmp word [ebp - 4], bx
je 0x446471
push 0xd
jmp 0x44646a
mov ecx, dword [ebx*4 + 0x465ca8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x446468
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x446471
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x44d5b5
Capabilities:
Terminate process

Disassembly:
sub esp, 0x14
mov eax, dword [str.kernel32.dll]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, eax
mov eax, dword [0x464840]
add byte [eax + 0x6a], dl
add byte [edx - 1], dl
adc eax, sym.imp.KERNEL32.dll_HeapAlloc
mov ebp, eax
push 0x104
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
xor eax, eax
movzx ecx, word [ebp + edx*2]
cmp ecx, 0x5c
je 0x44d7fb
test ecx, ecx
je 0x44d606
inc edx
jmp 0x44d5f1
mov ecx, dword [0x464860]
lea ebp, [ebp + eax*2]
cmp dword [ecx], 0
je 0x44d664
movzx edx, word [ebp + 2]
xor eax, eax
test edx, edx
mov eax, edx
jmp 0x44d603
Function at 0x44e3b8
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0044e55b
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x44e530
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x44e530
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x44e4df
jg 0x44e411
test eax, eax
je 0x44e4d5
push 1
push 0x1000
call fcn.00442775
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x44e437
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x44e4cc
push 0x8000
push ebx
call fcn.0043bd47
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x44e463
jg 0x44e45e
cmp ecx, 0x1000
jb 0x44e463
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.004464b5
add esp, 0x10
cmp eax, 0xffffffff
je 0x44e4a8
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x44e45e
jl 0x44e48f
test ecx, ecx
jne 0x44e450
push dword [ebp - 0xc]
push ebx
call fcn.0043bd47
push esi
call fcn.0043ff74
add esp, 0xc
xor edi, edi
jmp 0x44e541
cmp byte [edi + 0x24], 0
je 0x44e4bf
cmp dword [edi + 0x20], 5
jne 0x44e4bf
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x44e4ca
mov edi, dword [edi + 0x18]
jmp 0x44e4cc
xor edi, edi
push esi
call fcn.0043ff74
pop ecx
jmp 0x44e541
test ecx, ecx
jg 0x44e4a1
jl 0x44e4df
test eax, eax
jae 0x44e4a1
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0044ccc5
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x44e502
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x44e4a1
jmp 0x44e539
push ebx
call fcn.004444b8
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x44e4a1
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x44e541
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x44e53e
mov edi, dword [edi + 0x18]
jmp 0x44e541
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0044ccc5
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x421d80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0xc
mov eax, dword [0x5bdd90]
xor eax, ebp
je 0x421ded
jne 0x421ded
mov eax, dword [0xe91580]
adc dword [ecx - 0x3deecaae], edi
mov eax, 0x106de560
lea ecx, [esi + 0x37c]
cmp byte [ebx + 0xac], 1
push 0xadae0c
push 0xa29f90
mov eax, dword [0x112ae170]
push 0xacc620
push 0x114849e0
mov dword [0x100ce454], eax
lea esi, [eax*4]
push 0x7b3480
dec ecx
cld
push eax
aaa
dec esp
cli
lds edi, [edi]
cmc
push esp
loope 0x421d9c
jmp 0x52fb2ea1
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov esi, dword [edi]
mov ecx, dword [edi + 4]
jmp 0x4227a3
shr eax, 8
push 0x421e83
ret
mov byte [ebp - 8], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 7], al
jmp 0x4224c7
push edx
pop eax
jmp 0x421e39
mov eax, 0x473530
xchg edx, eax
ja 0x4225b9
pushal
mov al, byte [0x28c496de]
popal
cli
shr eax, 8
je 0x422b79
jne 0x422b79
mov eax, 0x4a0944
push 0x4bfa90
push 0x47e334
call dword [0x9a8358]
mov dword [0x445268], 0x445238
xor eax, 0x46e53b96
xchg esi, eax
cmp esp, ebp
inc esi
jno 0x42257a
outsb dx, byte [esi]
into
mov al, 0xb3
mov eax, dword [0xf681827]
mov dh, 0x47
invalid
mov eax, ecx
shr eax, 0x18
mov byte [ebp - 0xc], al
push ecx
pop eax
shr eax, 0x10
mov byte [ebp - 0xb], al
lea edx, [esi*8]
mov eax, ecx
je 0x42258a
jne 0x42258a
mov edi, 0x4752e0
push 0xa00ddc
cmp dword [ebp - 0x264], edi
fld qword [ebx + 0x10]
push 0xd2c
add byte [0xcc00623c], ch
mov dword [edi + esi + 0x5d], eax
cmp dword [ebp - 0x114c], 0x449
add byte [ebp - 0x15], al
jmp dword [ecx*4 + 0x4b0f00]
mov eax, esi
shr eax, 0x1d
shl ecx, 3
or ecx, eax
je 0x422608
jne 0x422608
push 0x902
mov ecx, 0x103e3618
or dword [0xe482a8], 1
push 0xb50ad0
push 0x11470d40
mov edx, dword [ebp - 0x9cf8]
push 0xa8b5f0
jmp dword [ecx*4 + 0x4286f0]
mov byte [ebp - 0xa], al
mov eax, edx
shr eax, 0x18
je 0x421f93
jne 0x421f93
add ax, 0x30
call dword [0x45e178]
push 0xb14744
mov dword [ebx], 0x1010a530
adc dword [edx - 0x6deec0e8], edx
add eax, 0xe453a0
push 0x100e0cd0
push 0xb129e0
push 0xaeb480
mov edi, 0x45160a
fld dword [esp + 0x1c]
jmp dword [0x106e0370]