joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401870
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xcc
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, dword [0x404040]
test eax, eax
jne 0x4018c9
mov edi, dword fs:[0x18]
mov ebx, dword [edi + 0x34]
push 0x40212c
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
push str.__wine_dbg_get_channel_flags
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
cmovne ecx, eax
mov eax, 0x404040
lock xchg dword [eax], ecx
mov dword [edi + 0x34], ebx
mov edi, dword [ebp + 8]
mov eax, dword [0x404040]
push esi
call eax
add esp, 4
movzx eax, al
bt eax, edi
jae 0x401a7f
mov ecx, dword [0x4040cc]
mov ebx, dword fs:[0x18]
xor eax, eax
cmp ecx, dword [ebx + 0x24]
je 0x401a84
lea edi, [ebp - 0xd8]
test byte [0x404015], 8
je 0x401990
mov eax, dword [0x404040]
test eax, eax
jne 0x401949
mov eax, dword [ebx + 0x34]
mov dword [ebp - 0x10], eax
push 0x40212c
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
push str.__wine_dbg_get_channel_flags
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
cmovne ecx, eax
mov eax, 0x404040
lock xchg dword [eax], ecx
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x34], eax
mov eax, dword [0x404040]
push 0x404015
call eax
add esp, 4
test al, 8
je 0x401990
call dword [sym.imp.kernel32.dll_GetTickCount]
mov ecx, eax
mov edx, 0x10624dd3
mul edx
shr edx, 6
imul eax, edx, 0x3e8
sub ecx, eax
lea eax, [ebp - 0xd8]
push ecx
push edx
push str._3u._03u:
push eax
call dbg.sprintf
add esp, 0x10
lea edi, [eax + ebp]
add edi, 0xffffff28
test byte [0x404025], 8
je 0x4019fd
mov eax, dword [0x404040]
test eax, eax
jne 0x4019dc
mov eax, dword [ebx + 0x34]
mov dword [ebp - 0x10], eax
push 0x40212c
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
push str.__wine_dbg_get_channel_flags
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
cmovne ecx, eax
mov eax, 0x404040
lock xchg dword [eax], ecx
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x34], eax
mov eax, dword [0x404040]
push 0x404025
call eax
add esp, 4
test al, 8
je 0x4019fd
push dword [ebx + 0x20]
push str._04x:
push edi
call dbg.sprintf
add esp, 0xc
add edi, eax
push dword [ebx + 0x24]
push str._04x:
push edi
call dbg.sprintf
add esp, 0xc
mov edx, dword [ebp + 8]
cmp edx, 3
ja 0x401a52
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x401a52
add edi, eax
lea eax, [ebp - 0xd8]
sub eax, edi
add eax, 0xc8
mov edx, dword [edx*4 + 0x402150]
inc esi
sub esp, 0x18
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edx
mov dword [esp], edi
mov dword [esp + 4], eax
call dbg.snprintf
add esp, 0x18
lea edi, [ebp - 0xd8]
push edi
call dword [sym.imp.ucrtbase.dll_strlen]
add esp, 4
mov esi, eax
push 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
add esp, 4
push eax
push esi
push 1
push edi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
jmp 0x401a84
mov eax, 0xffffffff
add esp, 0xcc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x401b00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push 1
call sym.__configure_narrow_argv
add esp, 4
call sym.__initialize_narrow_environment
call sym.___p___argc
mov edi, dword [eax]
call sym.___p___argv
mov ebx, dword [eax]
call sym.__get_initial_narrow_environment
mov esi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov ecx, dword [eax + 0x3c]
xor edx, edx
cmp word [eax + ecx + 0x5c], 2
sete dl
inc edx
push edx
call sym.__set_app_type
add esp, 4
push esi
push ebx
push edi
call dbg.main
add esp, 0xc
push eax
call sym._exit
jmp dword [sym.imp.ucrtbase.dll___stdio_common_vsprintf]
Function at 0x401369
Capabilities:
Create thread
Terminate thread

Disassembly:
push 0x1c
mov eax, 0x4661bf
call fcn.00460210
xor esi, esi
mov dword [ebp - 4], esi
mov eax, dword [0x48220c]
mov ecx, 0x48220c
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x24], eax
lea eax, [ebp + 8]
lea edi, [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.00401444
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x18], esi
jne 0x4013d8
lea eax, [ebp - 0x14]
push eax
push esi
mov eax, edi
push eax
push 0x40119f
push esi
push esi
mov dword [ebp - 0x10], esi
call fcn.00444182
add esp, 0x18
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
je 0x401406
push 0xa
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x401422
call fcn.004012ee
push dword [ebp + 0x14]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4013d3
push esi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
call fcn.0040178c
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.0040178c
call fcn.004602af
ret
cmp eax, esi
jne 0x40143c
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
jmp 0x401406

Function at 0x401a3e
Capabilities:
Create directory

Disassembly:
push 8
mov eax, 0x46399f
call fcn.00460210
and dword [ebp - 4], 0
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x401a71
xor esi, esi
inc esi
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.0040178c
mov eax, esi
call fcn.004602af
ret
mov eax, dword [0x48220c]
mov ecx, 0x48220c
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x10], edi
mov ebx, 0x46aab4
push ebx
xor ecx, ecx
lea esi, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.00403fc0
inc eax
mov ecx, eax
jmp 0x401ad4
mov ecx, esi
lea edx, [ebp - 0x14]
lea eax, [ebp + 8]
call fcn.00404114
lea edi, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00401444
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.0040178c
mov edi, dword [ebp - 0x10]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [esi + 1]
push ebx
lea esi, [ebp + 8]
call fcn.00403fc0
mov esi, eax
cmp esi, 0xffffffff
jne 0x401a9d
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
mov esi, eax
neg esi
sbb esi, esi
lea eax, [edi - 0x10]
neg esi
call fcn.0040178c
jmp 0x401a5e
Function at 0x401fe6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push str.C:Program_Files
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40204b
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push 0
push str.ProgramFilesDir
push dword [ebp - 4]
mov dword [ebp - 8], 0x400
mov dword [ebp - 0xc], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret

Function at 0x402733
Capabilities:
Create shortcut via ishelllink

Disassembly:
push 0xc
mov eax, 0x463d1e
call fcn.00460210
lea eax, [ebp - 0x10]
push eax
push 0x46859c
push 1
xor ebx, ebx
push ebx
push 0x4685ac
mov dword [ebp - 4], 3
call dword [sym.imp.ole32.dll_CoCreateInstance]
lea esi, [ebp + 8]
lea edi, [ebp - 0x14]
mov dword [ebp - 0x18], eax
call fcn.004026cd
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.0040178c
lea esi, [ebp + 0xc]
lea edi, [ebp - 0x14]
call fcn.004026cd
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.0040178c
cmp dword [ebp - 0x18], ebx
jl 0x402854
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
push 0x4685bc
push eax
call dword [ecx]
mov esi, eax
cmp esi, ebx
jl 0x402847
mov eax, dword [ebp - 0x10]
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
mov esi, eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00418fe9
pop ecx
pop ecx
mov byte [ebp - 4], 4
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x24]
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.0040178c
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push 5
push eax
call dword [ecx + 0x3c]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ebx
push dword [ebp + 0xc]
push eax
call dword [ecx + 0x44]
mov eax, dword [ebp + 0x14]
cmp dword [eax - 0xc], ebx
je 0x402818
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x1c]
mov ecx, dword [ebp + 0x10]
cmp dword [ecx - 0xc], ebx
je 0x40282a
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x2c]
cmp esi, ebx
jl 0x40283e
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push 1
push dword [ebp + 8]
push eax
call dword [ecx + 0x18]
mov esi, eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp esi, ebx
jge 0x402888
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.0040178c
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
call fcn.0040178c
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
call fcn.0040178c
mov eax, dword [ebp + 0x14]
add eax, 0xfffffff0
call fcn.0040178c
mov eax, ebx
call fcn.004602af
ret
xor ebx, ebx
inc ebx
jmp 0x402854
Function at 0x420db5
Capabilities:
Hide graphical window

Disassembly:
push esi
lea esi, [eax + 0x2dc]
cmp dword [esi], 0
je 0x420dd7
push 1
push dword [eax + 0x294]
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [esi]
pop esi
jmp fcn.0041a6e3
pop esi
ret

Function at 0x4221c0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4656c3
mov eax, dword fs:[0]
push eax
sub esp, 0x168
push ebx
push esi
push edi
mov eax, dword [0x47f070]
xor eax, esp
push eax
lea eax, [esp + 0x178]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x3fc]
cmp dword [eax], 0
je 0x42221e
push dword [ebp + 0x14]
mov eax, dword [eax]
push dword [ebp + 0x10]
mov edx, dword [eax]
push dword [ebp + 0xc]
mov ecx, eax
call dword [edx + 0x10]
test eax, eax
je 0x42221e
xor eax, eax
inc eax
jmp 0x422900
push dword [ebp + 0xc]
lea eax, [esp + 0x24]
push eax
call fcn.00404846
and dword [esp + 0x180], 0
xor eax, eax
inc eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], eax
cmp dword [ebx + 0x1b0], 0
push 0xfffffffffffffffe
pop eax
je 0x42226d
and dword [esp + 0x24], 0
or dword [esp + 0x14], 0xffffffff
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x24]
invalid
invalid
mov ah, 1
invalid

Function at 0x422fb3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xchg ebp, eax
enter 0xfffffffffffffffa, 0xffffffffffffffff
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x422fe5
cmp dword [ebp - 0x398], 0
je 0x4231af
cmp dword [ebp + 0xc], 1
je 0x4231af
cmp dword [ebp + 0xc], 8
jne 0x423177
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
call dword [eax]
invalid
invalid
push eax
Function at 0x423fd8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax], al
cmp dword [ebp - 0x6fc], 3
jne 0x42407b
and byte [ebp - 0x7ac], 0
and byte [ebp - 0x7ab], 0
mov byte [ebp - 0x7aa], 0xed
and byte [ebp - 0x7a9], 0
mov byte [ebp - 0x7a8], 0x4e
mov byte [ebp - 0x7a7], 0x55
mov byte [ebp - 0x7a6], 0x56
mov byte [ebp - 0x7a5], 0x7e
mov byte [ebp - 0x7a4], 0x21
mov byte [ebp - 0x7a3], 0x20
mov byte [ebp - 0x7a2], 0x3c
mov byte [ebp - 0x7a1], 0x76
mov byte [ebp - 0x7a0], 0x7e
mov byte [ebp - 0x79f], 0x7e
mov byte [ebp - 0x79e], 0x12
push 0xb
lea eax, [ebp - 0x7ac]
push eax
call fcn.00422301
pop ecx
push eax
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.00422262
add esp, 0xc
jmp 0x424269
cmp dword [ebp - 0x6fc], 4
jne 0x424125
and byte [ebp - 0x7bc], 0
and byte [ebp - 0x7bb], 0
mov byte [ebp - 0x7ba], 2
and byte [ebp - 0x7b9], 0
mov byte [ebp - 0x7b8], 0xa1
mov byte [ebp - 0x7b7], 0xb2
mov byte [ebp - 0x7b6], 0xb1
mov byte [ebp - 0x7b5], 0xb8
mov byte [ebp - 0x7b4], 0xcf
mov byte [ebp - 0x7b3], 0xce
mov byte [ebp - 0x7b2], 0xd3
mov byte [ebp - 0x7b1], 0x99
mov byte [ebp - 0x7b0], 0x91
mov byte [ebp - 0x7af], 0x91
mov byte [ebp - 0x7ae], 0xfd
call fcn.004222f1
mov al, 0xcc
push cs
lea ebp, [edx + 0xb]
lea eax, [ebp - 0x7bc]
push eax
call fcn.00422301
pop ecx
push eax
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.00422262
add esp, 0xc
jmp 0x424269
cmp dword [ebp - 0x6fc], 5
jne 0x4241c6
and byte [ebp - 0x7cc], 0
and byte [ebp - 0x7cb], 0
mov byte [ebp - 0x7ca], 0x3f
and byte [ebp - 0x7c9], 0
mov byte [ebp - 0x7c8], 0x9c
mov byte [ebp - 0x7c7], 0x90
mov byte [ebp - 0x7c6], 0x93
mov byte [ebp - 0x7c5], 0x81
mov byte [ebp - 0x7c4], 0x90
mov byte [ebp - 0x7c3], 0xac
mov byte [ebp - 0x7c2], 0xee
mov byte [ebp - 0x7c1], 0xa4
mov byte [ebp - 0x7c0], 0xac
mov byte [ebp - 0x7bf], 0xac
mov byte [ebp - 0x7be], 0xc0
push 0xb
lea eax, [ebp - 0x7cc]
push eax
call fcn.00422301
pop ecx
push eax
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.00422262
add esp, 0xc
jmp 0x424269
cmp dword [ebp - 0x6fc], 6
jne 0x424264
and byte [ebp - 0x7dc], 0
and byte [ebp - 0x7db], 0
mov byte [ebp - 0x7da], 0x11
and byte [ebp - 0x7d9], 0
mov byte [ebp - 0x7d8], 0xb2
mov byte [ebp - 0x7d7], 0x8b
mov byte [ebp - 0x7d6], 0x9c
mov byte [ebp - 0x7d5], 0x9c
mov byte [ebp - 0x7d4], 0x81
mov byte [ebp - 0x7d3], 0x9c
mov byte [ebp - 0x7d2], 0xc0
mov byte [ebp - 0x7d1], 0x82
mov byte [ebp - 0x7d0], 0x81
mov byte [ebp - 0x7cf], 0x89
mov byte [ebp - 0x7ce], 0xee
push 0xb
lea eax, [ebp - 0x7dc]
push eax
call fcn.00422301
pop ecx
push eax
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.00422262
add esp, 0xc
jmp 0x424269
jmp 0x424397
mov eax, dword [ebp - 0x6fc]
cmp dword [ebp - 0x37c], 0
jne 0x424441
mov eax, dword [ebp - 0x748]
Function at 0x4244c4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
invalid
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.004222f1
xchg dh, ch
jnp 0x424464
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x4244de
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x4244de
call fcn.004222f1
xchg ecx, eax
jae 0x42456d
push ecx
mov ebx, dword [edx + 0x24]
add ebx, edi
mov cx, word [ebx + ecx*2]
mov ebx, dword [edx + 0x1c]
invalid
Function at 0x1001725
Capabilities:
Terminate process

Disassembly:
cmp al, 0x22
jne 0x10013d9
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
jne 0x100187b
inc esi
jmp 0x10014be
push 0x58
push 0x1001508
call fcn.0100137d
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x1003360
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x1001817
xor esi, esi
inc esi
mov eax, dword [0x100335c]
cmp eax, esi
je 0x1001835
mov eax, dword [0x100335c]
test eax, eax
jne 0x100154d
mov dword [0x100335c], esi
push 0x1001504
push 0x10014f8
call fcn.0100158a
pop ecx
pop ecx
test eax, eax
jne 0x10018d7
mov eax, dword [0x100335c]
cmp eax, esi
jne 0x100149e
push 0x10014f4
push 0x10014ec
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x100335c], 2
test ebx, ebx
jne 0x10014aa
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1003364], 0
jne 0x1001842
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x10013ca
test al, al
je 0x10014d9
cmp dword [ebp - 0x1c], 0
jne 0x10013ca
mov al, byte [esi]
test al, al
je 0x1001530
cmp al, 0x20
ja 0x1001530
inc esi
mov dword [ebp - 0x20], esi
jmp 0x10014d9
test byte [ebp - 0x3c], 1
je 0x1001558
movzx eax, word [ebp - 0x38]
push eax
push esi
push 0
push 0x1000000
call main
jmp 0x1001866
mov dword [0x100336c], esi
jmp 0x100147a
push 0xa
pop eax
jmp 0x100153a
call fcn.01001734
jmp 0x10013f2
cmp eax, esi
jne 0x1001825
xor esi, esi
inc esi
mov ebx, esi
jmp 0x1001441
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100142c
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x100147a
push 0x1003364
call fcn.01001b28
pop ecx
test eax, eax
je 0x10014b7
push 0
push 2
push 0
call dword [0x1003364]
jmp 0x10014b7
mov dword [0x1003368], eax
cmp dword [0x1003338], 0
jne 0x10018b3
push eax
call dword [sym.imp.msvcrt.dll_exit]
inc esi
mov dword [ebp - 0x20], esi
jmp 0x10013ec
cmp dword [0x100336c], 0
jne 0x10018c2
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1003368]
jmp 0x10018e3
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.0100170c
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0xf006813
Capabilities:
Create thread
Resume thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 8
call fcn.0f007089
mov esi, eax
test esi, esi
pop ecx
je 0xf00687b
mov eax, dword [ebp + 0x10]
push edi
push dword [ebp + 0x1c]
mov dword [esi], eax
mov eax, dword [ebp + 0x14]
push 4
push esi
push 0xf0067c2
push dword [ebp + 0xc]
mov dword [esi + 4], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
je 0xf006871
mov eax, dword fs:[0x18]
push dword [eax + 0xf18]
push edi
call sym.ntvdm.exe_cpu_createthread
test byte [ebp + 0x18], 4
jne 0xf006878
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0xf006878
push esi
call fcn.0f0058a2
pop ecx
mov eax, edi
pop edi
pop esi
pop ebp
ret 0x18

Function at 0xf00765c
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x444
mov eax, dword [0xf061038]
push ebx
push esi
mov esi, dword [ebp + 8]
and dword [esi + 4], 0
and dword [esi], 0
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x210]
mov dword [ebp - 0x440], eax
push edi
lea eax, [ebp - 0x444]
push eax
mov word [ebp - 0x442], 0x20c
call fcn.0f0072c4
push edi
call sym.ntvdm.exe_IsCdRomFile
mov ebx, dword [ebp + 0x10]
test bl, 8
mov dword [ebp - 0x43c], eax
je 0xf007705
push ebx
push esi
push edi
call fcn.0f04632b
test eax, eax
je 0xf0076f7
cmp bx, 8
je 0xf007776
push 0
push 0
push ebx
lea eax, [ebp - 0x210]
push eax
call fcn.0f007325
test eax, eax
je 0xf007776
mov ecx, dword [ebp - 0x43c]
mov dword [eax + 0x264], ecx
mov dword [esi], eax
mov eax, dword [eax + 8]
jmp 0xf007773
cmp bx, 8
jne 0xf007705
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0xf007778
lea eax, [ebp - 0x438]
push eax
push 0
push ebx
lea eax, [ebp - 0x210]
push eax
call fcn.0f007325
cmp byte [ebp - 0x21f], 0
mov edi, eax
jne 0xf007750
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0xf007735
push 0x12
jmp 0xf007745
cmp eax, 0xa1
je 0xf007743
cmp eax, 0x10b
jne 0xf00774b
push 3
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
jmp 0xf007778
mov ebx, dword [ebp - 0x43c]
push ebx
push esi
lea eax, [ebp - 0x438]
push eax
call fcn.0f045e9c
test edi, edi
je 0xf007776
mov dword [edi + 0x264], ebx
mov dword [esi], edi
mov eax, dword [edi + 8]
mov dword [esi + 4], eax
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0f01b780
leave
ret 0xc
Function at 0xf007e25
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 0xc]
cmp dword [esi + 0x18], 0xffffffff
jne 0xf007e3d
mov eax, 0x80000006
jmp 0xf007e9b
push ebx
xor ebx, ebx
push edi
mov edi, dword [esi + 0x20]
cmp edi, ebx
jne 0xf007e6d
mov eax, dword [esi + 0x18]
cmp eax, ebx
je 0xf007ea0
mov edi, dword [esi + 0x1c]
push ebx
push ebx
push ebx
push 3
push dword [esi + 0x24]
lea ecx, [ebp - 8]
push edi
push ecx
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
cmp eax, ebx
jl 0xf007e99
mov eax, dword [edi]
cmp eax, ebx
je 0xf007e7a
add eax, edi
mov dword [esi + 0x20], eax
jmp 0xf007e7d
mov dword [esi + 0x20], ebx
xor eax, eax
mov ax, word [esi + 0x250]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 0x18]
call fcn.0f045b63
test eax, eax
je 0xf007e41
xor eax, eax
pop edi
pop ebx
pop esi
leave
ret 8
mov eax, 0xc0000008
jmp 0xf007e99

Function at 0xf007fd7
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov eax, dword fs:[0x18]
push dword [ebp + 8]
lea esi, [eax + 0xbf8]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntdll.dll_RtlInitAnsiString]
push 0
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.ntdll.dll_RtlOemStringToUnicodeString]
test eax, eax
jge 0xf00802a
cmp eax, 0x80000005
jne 0xf008017
push 0xce
jmp 0xf00801f
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
jmp 0xf008033
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop esi
leave
ret 4