joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cbd78
Capabilities:
Query environment variable

Disassembly:
push ebx
mov eax, dword [0x50f89c]
cmp eax, 0xffffffff
jne 0x4cbeff
call fcn.004cce10
mov dword [0x50f89c], eax
push str.JSIMD_FORCEMMX
call sub.msvcrt.dll_getenv
pop ecx
mov ebx, eax
test ebx, ebx
je 0x4cbdce
mov eax, ebx
mov edx, 0x50f8b3
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4cbdce
test cl, cl
je 0x4cbdc5
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4cbdce
add eax, 2
add edx, 2
test cl, cl
jne 0x4cbda9
jne 0x4cbdce
and dword [0x50f89c], 1
push str.JSIMD_FORCE3DNOW
call sub.msvcrt.dll_getenv
pop ecx
mov ebx, eax
test ebx, ebx
je 0x4cbe0b
mov eax, ebx
mov edx, 0x50f8b3
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4cbe0b
test cl, cl
je 0x4cbe02
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4cbe0b
add eax, 2
add edx, 2
test cl, cl
jne 0x4cbde6
jne 0x4cbe0b
and dword [0x50f89c], 3
push str.JSIMD_FORCESSE
call sub.msvcrt.dll_getenv
pop ecx
mov ebx, eax
test ebx, ebx
je 0x4cbe48
mov eax, ebx
mov edx, 0x50f8b3
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4cbe48
test cl, cl
je 0x4cbe3f
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4cbe48
add eax, 2
add edx, 2
test cl, cl
jne 0x4cbe23
jne 0x4cbe48
and dword [0x50f89c], 5
push str.JSIMD_FORCESSE2
call sub.msvcrt.dll_getenv
pop ecx
mov ebx, eax
test ebx, ebx
je 0x4cbe85
mov eax, ebx
mov edx, 0x50f8b3
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4cbe85
test cl, cl
je 0x4cbe7c
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4cbe85
add eax, 2
add edx, 2
test cl, cl
jne 0x4cbe60
jne 0x4cbe85
and dword [0x50f89c], 8
push str.JSIMD_FORCENONE
call sub.msvcrt.dll_getenv
pop ecx
mov ebx, eax
test ebx, ebx
je 0x4cbec2
mov eax, ebx
mov edx, 0x50f8b3
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4cbec2
test cl, cl
je 0x4cbeb9
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4cbec2
add eax, 2
add edx, 2
test cl, cl
jne 0x4cbe9d
jne 0x4cbec2
xor eax, eax
mov dword [0x50f89c], eax
push str.JSIMD_NOHUFFENC
call sub.msvcrt.dll_getenv
pop ecx
mov ebx, eax
test ebx, ebx
je 0x4cbeff
mov eax, ebx
mov edx, 0x50f8b3
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4cbeff
test cl, cl
je 0x4cbef6
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4cbeff
add eax, 2
add edx, 2
test cl, cl
jne 0x4cbeda
jne 0x4cbeff
xor eax, eax
mov dword [0x50f8a0], eax
pop ebx
ret
Function at 0x4dcfe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, 2
movdqa xmm4, xmmword [esi]
movdqa xmm5, xmmword [esi + 0x10]
movdqa xmm6, xmmword [esi + 0x20]
movdqa xmm7, xmmword [esi + 0x30]
movdqa xmm0, xmm4
movdqa xmm1, xmm5
movdqa xmm2, xmm6
movdqa xmm3, xmm7
psraw xmm4, 0xf
psraw xmm5, 0xf
psraw xmm6, 0xf
psraw xmm7, 0xf
pxor xmm0, xmm4
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
psubw xmm0, xmm4
psubw xmm1, xmm5
psubw xmm2, xmm6
psubw xmm3, xmm7
paddw xmm0, xmmword [edx + 0x80]
paddw xmm1, xmmword [edx + 0x90]
paddw xmm2, xmmword [edx + 0xa0]
paddw xmm3, xmmword [edx + 0xb0]
pmulhuw xmm0, xmmword [edx]
pmulhuw xmm1, xmmword [edx + 0x10]
pmulhuw xmm2, xmmword [edx + 0x20]
pmulhuw xmm3, xmmword [edx + 0x30]
pmulhuw xmm0, xmmword [edx + 0x100]
pmulhuw xmm1, xmmword [edx + 0x110]
pmulhuw xmm2, xmmword [edx + 0x120]
pmulhuw xmm3, xmmword [edx + 0x130]
pxor xmm0, xmm4
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
psubw xmm0, xmm4
psubw xmm1, xmm5
psubw xmm2, xmm6
psubw xmm3, xmm7
movdqa xmmword [edi], xmm0
movdqa xmmword [edi + 0x10], xmm1
movdqa xmmword [edi + 0x20], xmm2
movdqa xmmword [edi + 0x30], xmm3
add esi, 0x40
add edx, 0x40
add edi, 0x40
dec eax
jne 0x4dcff3
pop edi
pop esi
pop ebp
ret

Function at 0x4dd1a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ah, 2
mov al, 4
movq mm2, qword [esi]
movq mm3, qword [esi + 8]
movq mm0, mm2
movq mm1, mm3
psraw mm2, 0xf
psraw mm3, 0xf
pxor mm0, mm2
pxor mm1, mm3
psubw mm0, mm2
psubw mm1, mm3
paddw mm0, qword [edx + 0x80]
paddw mm1, qword [edx + 0x88]
movq mm4, mm0
movq mm5, mm1
pmulhw mm0, qword [edx]
pmulhw mm1, qword [edx + 8]
paddw mm0, mm4
paddw mm1, mm5
movq mm6, qword [edx + 0x100]
movq mm7, qword [edx + 0x108]
movq mm4, mm0
movq mm5, mm1
pmulhw mm0, mm6
pmulhw mm1, mm7
psraw mm6, 0xf
psraw mm7, 0xf
pand mm6, mm4
pand mm7, mm5
paddw mm0, mm6
paddw mm1, mm7
psraw mm4, 0xf
psraw mm5, 0xf
pand mm4, qword [edx + 0x100]
pand mm5, qword [edx + 0x108]
paddw mm0, mm4
paddw mm1, mm5
pxor mm0, mm2
pxor mm1, mm3
psubw mm0, mm2
psubw mm1, mm3
movq qword [edi], mm0
movq qword [edi + 8], mm1
add esi, 0x10
add edx, 0x10
add edi, 0x10
dec al
jne 0x4dd1b2
dec ah
jne 0x4dd1b0
emms
pop edi
pop esi
pop ebp
ret
Function at 0x4dfc78
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x14]
cmp eax, 0xca
jne 0x4dfcad
push ebx
call fcn.004e1330
pop ecx
mov edx, dword [ebx + 0x40]
test edx, edx
je 0x4dfca6
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
pop ebp
ret
mov dword [ebx + 0x14], 0xcb
mov edx, dword [ebx + 0x14]
cmp edx, 0xcb
jne 0x4dfd26
mov ecx, dword [ebx + 0x1c8]
mov eax, dword [ecx + 0x10]
test eax, eax
je 0x4dfd18
mov edx, dword [ebx + 8]
test edx, edx
je 0x4dfcd3
push ebx
mov ecx, dword [ebx + 8]
call dword [ecx]
pop ecx
push ebx
mov eax, dword [ebx + 0x1c8]
call dword [eax]
pop ecx
test eax, eax
jne 0x4dfce6
xor eax, eax
pop ebx
pop ebp
ret
cmp eax, 2
je 0x4dfd18
mov edx, dword [ebx + 8]
test edx, edx
je 0x4dfcc5
cmp eax, 3
je 0x4dfcfa
dec eax
jne 0x4dfcc5
mov ecx, dword [ebx + 8]
inc dword [ecx + 4]
mov edx, dword [ecx + 4]
mov eax, dword [ebx + 8]
mov ecx, dword [eax + 8]
cmp edx, ecx
jl 0x4dfcc5
mov edx, dword [ebx + 0x148]
add dword [eax + 8], edx
jmp 0x4dfcc5
mov eax, dword [ebx + 0x90]
mov dword [ebx + 0x98], eax
jmp 0x4dfd46
mov ecx, dword [ebx + 0x14]
cmp ecx, 0xcc
je 0x4dfd46
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x15
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
push ebx
mov ecx, dword [ebx]
call dword [ecx]
pop ecx
push ebx
call fcn.004dfd50
pop ecx
pop ebx
pop ebp
ret

Function at 0x4dfd50
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x14]
cmp eax, 0xcc
je 0x4dfdf0
push ebx
mov edx, dword [ebx + 0x1b8]
call dword [edx]
pop ecx
xor ecx, ecx
mov dword [ebx + 0x8c], ecx
mov dword [ebx + 0x14], 0xcc
jmp 0x4dfdf0
mov eax, dword [ebx + 8]
test eax, eax
je 0x4dfd9a
mov dword [eax + 4], edx
mov edx, dword [ebx + 0x74]
mov dword [eax + 8], edx
push ebx
mov ecx, dword [ebx + 8]
call dword [ecx]
pop ecx
mov esi, dword [ebx + 0x8c]
lea eax, [ebx + 0x8c]
push 0
push eax
push 0
push ebx
mov edx, dword [ebx + 0x1bc]
call dword [edx + 4]
add esp, 0x10
mov ecx, dword [ebx + 0x8c]
cmp esi, ecx
jne 0x4dfdc6
xor eax, eax
jmp 0x4dfe18
mov edx, dword [ebx + 0x8c]
mov ecx, dword [ebx + 0x74]
cmp edx, ecx
jb 0x4dfd83
push ebx
mov eax, dword [ebx + 0x1b8]
call dword [eax + 4]
pop ecx
push ebx
mov edx, dword [ebx + 0x1b8]
call dword [edx]
pop ecx
xor ecx, ecx
mov dword [ebx + 0x8c], ecx
mov eax, dword [ebx + 0x1b8]
mov edx, dword [eax + 8]
test edx, edx
jne 0x4dfdc6
mov ecx, dword [ebx + 0x44]
test ecx, ecx
je 0x4dfe0b
mov eax, 0xce
jmp 0x4dfe10
mov eax, 0xcd
mov dword [ebx + 0x14], eax
mov eax, 1
pop esi
pop ebx
pop ebp
ret
Function at 0x4017d0
Capabilities:
Read file on windows

Disassembly:
push esi
push ebx
sub esp, 0x24
mov dword [esp + 4], 0x470040
mov dword [esp], eax
call sub.msvcrt.dll_fopen
test eax, eax
mov esi, eax
je 0x4018a2
lea ebx, [esp + 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 4
mov dword [esp], ebx
call sub.msvcrt.dll_fread
cmp eax, 1
je 0x401819
mov byte [esp + 0x1c], 0
mov dword [esp], esi
mov esi, 1
call sub.msvcrt.dll_fclose
mov dword [esp + 8], 4
mov dword [esp + 4], 0x46b018
mov dword [esp], ebx
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x4018a4
mov dword [esp + 8], 2
mov dword [esp + 4], 0x46b016
mov dword [esp], ebx
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x4018a4
mov dword [esp + 8], 2
mov dword [esp + 4], 0x46b014
mov dword [esp], ebx
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x4018a4
mov esi, 0x46b004
mov dword [esp + 8], 4
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x4018b0
add esi, 4
cmp esi, 0x46b014
jne 0x40187f
xor esi, esi
add esp, 0x24
mov eax, esi
pop ebx
pop esi
ret
mov esi, 1
jmp 0x4018a4
Function at 0x403750
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x20
mov eax, dword [eax]
mov dword [esp + 4], 0x470ec0
mov dword [esp], eax
call sub.msvcrt.dll_fopen
cmp dword [0x48319c], 1
mov ebx, eax
jle 0x403793
mov eax, dword [esi]
mov dword [esp + 4], str.collect:_reading__s_n
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.00464320
lea edi, [esp + 0x1f]
mov dword [esp + 8], edi
mov dword [esp + 4], 0x470ed7
mov dword [esp], ebx
call fcn.004642d0
cmp eax, 1
jne 0x403870
movzx eax, byte [esp + 0x1f]
sub eax, 0x41
cmp al, 0xf
ja case.0x4037c3.1
movzx eax, al
jmp dword [eax*4 + 0x470ef4]
mov ecx, 2
mov edx, esi
mov eax, ebx
call fcn.00403600
nop
mov ecx, dword [0x483024]
cmp ecx, dword [0x483044]
jbe 0x403820
cmp ecx, dword [0x483050]
jae 0x403820
mov dword [0x483048], ecx
mov dword [0x48304c], ecx
jmp 0x403797
mov ecx, 1
mov edx, esi
mov eax, ebx
call fcn.00403600
mov ecx, dword [0x483024]
cmp ecx, dword [0x483044]
ja 0x4037ee
mov dword [esp + 4], ecx
mov dword [esp], 0x483040
call fcn.0043e1c0
jmp 0x403797
mov eax, ebx
call fcn.00403730
mov dword [esi + 4], eax
nop
jmp case.0x4037c3.1
mov eax, ebx
call fcn.00403730
mov dword [esi + 0xc], eax
jmp case.0x4037c3.1
mov eax, ebx
call fcn.00403730
mov dword [esi + 8], eax
jmp case.0x4037c3.1
xor ecx, ecx
mov edx, esi
mov eax, ebx
call fcn.00403600
jmp case.0x4037c3.1
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
mov edx, dword [esi + 4]
test edx, edx
je 0x40389e
mov eax, dword [esi + 8]
test eax, eax
je 0x403890
add esp, 0x20
pop ebx
pop esi
pop edi
ret
mov dword [esi + 8], 0x470eef
add esp, 0x20
pop ebx
pop esi
pop edi
ret
mov dword [esp], str.COLLECT_GCC_OPTIONS
call sub.msvcrt.dll_getenv
mov dword [esi + 4], eax
jmp 0x40387f
Function at 0x406140
Capabilities:
Query environment variable

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov dword [esp], eax
call sub.msvcrt.dll_getenv
test eax, eax
je 0x406170
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], eax
add esp, 0x18
pop ebx
jmp fcn.00406010
add esp, 0x18
pop ebx
ret

Function at 0x406520
Capabilities:
Read file on windows

Disassembly:
push esi
push ebx
mov ebx, eax
sub esp, 0x14
mov eax, dword [eax + 0x14]
test eax, eax
je 0x406543
cmp eax, dword [ebx + 0x10]
je 0x406543
sub eax, 1
cmp dword [ebx + 0x18], eax
jae 0x406543
xor eax, eax
add esp, 0x14
pop ebx
pop esi
ret
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sub.msvcrt.dll_feof
test eax, eax
jne 0x40653b
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x40653b
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebx + 0x14]
cmp ecx, edx
je 0x406572
mov eax, dword [ebx + 0xc]
mov esi, ecx
jmp 0x406597
lea eax, [ecx + ecx]
test ecx, ecx
mov esi, 0x1000
cmovne esi, eax
mov eax, dword [ebx + 0xc]
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.0043e330
mov edx, dword [ebx + 0x14]
mov dword [ebx + 0x10], esi
mov dword [ebx + 0xc], eax
mov ecx, dword [ebx + 8]
sub esi, edx
add edx, eax
mov dword [esp], edx
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov dword [esp + 0xc], ecx
call sub.msvcrt.dll_fread
mov esi, eax
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sub.msvcrt.dll_ferror
mov edx, eax
xor eax, eax
test edx, edx
jne 0x40653d
add dword [ebx + 0x14], esi
test esi, esi
setne al
jmp 0x40653d

Function at 0x408e30
Capabilities:
Query environment variable

Disassembly:
push ebx
mov ebx, 0x7fffffff
sub esp, 0x18
mov dword [esp], str.COLUMNS
call sub.msvcrt.dll_getenv
test eax, eax
je 0x408e56
mov dword [esp], eax
call sub.msvcrt.dll_atoi
test eax, eax
cmovg ebx, eax
add esp, 0x18
mov eax, ebx
pop ebx
ret
Function at 0x433960
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
mov dword [esp + 8], 0
mov ebx, dword [esp + 0x3c]
mov esi, dword [esp + 0x48]
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll__lseek
test eax, eax
js 0x433a20
mov eax, dword [esp + 0x44]
xor ebp, ebp
mov dword [esp + 4], ebx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call fcn.004325a0
test eax, eax
mov dword [esi + 4], eax
je 0x4339de
mov dword [esi], eax
mov dword [esi + 8], ebx
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.msvcrt.dll__read_1
test eax, eax
js 0x433a50
cmp ebx, eax
mov ebp, 1
ja 0x4339e8
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x44]
xor bp, bp
mov dword [esp + 8], 0
mov dword [esp + 4], str.file_too_short
mov dword [esp], eax
call dword [esp + 0x40]
mov eax, dword [esi + 4]
mov dword [esp], eax
call sub.msvcrt.dll_free
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.msvcrt.dll__errno]
xor ebp, ebp
mov eax, dword [eax]
mov dword [esp + 4], str.lseek
mov dword [esp + 8], eax
mov eax, dword [esp + 0x44]
mov dword [esp], eax
call dword [esp + 0x40]
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.msvcrt.dll__errno]
mov eax, dword [eax]
mov dword [esp + 4], str.read
mov dword [esp + 8], eax
mov eax, dword [esp + 0x44]
mov dword [esp], eax
call dword [esp + 0x40]
mov eax, dword [esi + 4]
mov dword [esp], eax
call sub.msvcrt.dll_free
jmp 0x4339de
Function at 0x4401d0
Capabilities:
Delete file

Disassembly:
push esi
push ebx
sub esp, 0x24
mov ebx, dword [esp + 0x30]
mov eax, dword [ebx + 0xc]
test eax, eax
jle 0x4401ef
mov edx, dword [ebx + 0x44]
mov edx, dword [edx + 0xc]
mov dword [esp + 4], eax
mov dword [esp], ebx
call edx
mov eax, dword [ebx + 0x18]
test eax, eax
jle 0x440205
mov edx, dword [ebx + 0x44]
mov edx, dword [edx + 0xc]
mov dword [esp + 4], eax
mov dword [esp], ebx
call edx
mov eax, dword [ebx + 0x34]
test eax, eax
je 0x440214
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov eax, dword [ebx + 0x38]
test eax, eax
je 0x440223
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov ecx, dword [ebx + 0x24]
test ecx, ecx
je 0x4402c0
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x4402b0
mov eax, dword [ebx + 0x20]
xor esi, esi
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x28]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x3c]
test eax, eax
jle 0x44028f
nop
mov eax, dword [ebx + 0x40]
mov eax, dword [eax + esi*4]
mov dword [esp], eax
call sub.msvcrt.dll_remove
mov eax, dword [ebx + 0x40]
mov eax, dword [eax + esi*4]
add esi, 1
mov dword [esp], eax
call sub.msvcrt.dll_free
cmp dword [ebx + 0x3c], esi
jg 0x440260
mov eax, dword [ebx + 0x40]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x44]
mov eax, dword [eax + 0x20]
test eax, eax
je 0x44029e
mov dword [esp], ebx
call eax
mov dword [esp + 0x30], ebx
add esp, 0x24
pop ebx
pop esi
jmp sub.msvcrt.dll_free
mov eax, dword [ebx + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_free
jmp 0x440235
and dword [ebx], 0xfffffffe
mov edx, 1
lea eax, [esp + 0x1c]
mov dword [esp], eax
lea ecx, [esp + 0x18]
mov eax, ebx
call fcn.0043f570
jmp 0x44022e
Function at 0x456d70
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.00456dd0
Function at 0x457760
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x457798
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x45778e
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x45779a
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x457780
xor eax, eax
pop ebx
pop esi
ret

Function at 0x45b3b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x12c
mov ebx, dword [ebp + 8]
call sub.msvcrt.dll__errno
test ebx, ebx
mov dword [eax], 0
je 0x45b55e
cmp byte [ebx], 0
je 0x45b528
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
cmp eax, 0xffffffff
je 0x45b540
test al, 0x10
je 0x45b528
lea edi, [ebp - 0x11c]
mov dword [esp + 4], ebx
mov ebx, edi
mov dword [esp + 8], 0x104
mov dword [esp], edi
call sub.msvcrt.dll__fullpath
mov edx, dword [ebx]
add ebx, 4
lea eax, [edx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x45b414
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea edx, [ebx + 2]
cmove ebx, edx
add al, al
sbb ebx, 3
sub ebx, edi
lea eax, [ebx + 0x233]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
test eax, eax
mov esi, eax
je 0x45b54f
lea edx, [eax + 0x22c]
lea eax, [ebx + 1]
mov dword [esp], edx
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [ebp - 0x12c], edx
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x12c]
cmp byte [esi + 0x22c], 0
je 0x45b4a3
movzx eax, byte [esi + ebx + 0x22b]
cmp al, 0x2f
je 0x45b4a3
cmp al, 0x5c
je 0x45b4a3
mov edi, 0x5c
mov word [edx + ebx], di
mov eax, edx
mov ecx, dword [eax]
add eax, 4
lea edx, [ecx - 0x1010101]
not ecx
and edx, ecx
and edx, 0x80808080
je 0x45b4a5
mov ecx, edx
shr ecx, 0x10
test edx, 0x8080
cmove edx, ecx
lea ecx, [eax + 2]
cmove eax, ecx
add dl, dl
sbb eax, 3
mov edx, 0x2a
mov word [eax], dx
xor ecx, ecx
xor eax, eax
lea edx, [esi + 0x120]
xor ebx, ebx
mov word [esi + 0x11c], cx
mov edi, edx
mov ecx, 0x41
mov dword [esi + 0x224], 0xffffffff
mov dword [esi + 0x228], 0
mov dword [esi + 0x118], 0
mov word [esi + 0x11e], bx
rep stosd dword es:[edi], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
mov dword [eax], 0x14
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
mov dword [eax], 2
xor eax, eax
jmp 0x45b520
call sub.msvcrt.dll__errno
mov dword [eax], 0xc
xor eax, eax
jmp 0x45b520
call sub.msvcrt.dll__errno
mov dword [eax], 0xe
xor eax, eax
jmp 0x45b520
Function at 0xca9058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00ca91a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xca907e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xca906a
add dl, dl
jne 0xca9089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xca90dc
xor eax, eax
add dl, dl
jne 0xca9096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xca917d
add dl, dl
jne 0xca90a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xca90b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xca90bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xca90c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xca90d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xca9075
mov eax, 1
add dl, dl
jne 0xca90ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xca90f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xca90e1
sub eax, ebx
mov ebx, 1
jne 0xca9128
mov ecx, 1
add dl, dl
jne 0xca910e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xca9119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xca9105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xca9075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xca913f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xca914a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xca9136
cmp eax, 0x7d00
jae 0xca916d
cmp eax, 0x500
jb 0xca9168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xca9075
cmp eax, 0x7f
ja 0xca9170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xca9075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xca919e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xca9075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401305
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push str.SOFTWAREExe2Aut
push 0x80000002
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
test eax, eax
jne 0x401359
lea eax, [ebp - 4]
lea edx, [ebp - 8]
mov dword [eax], 4
push eax
push edx
push 0
push 0
push str.DontShowAgain
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
cmp dword [ebp - 8], 1
je 0x401373
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push 0
push 0x401fe8
push 0
push 0x68
push eax
call dword [sym.imp.USER32.DLL_DialogBoxParamA]
leave
ret
Function at 0x40231e
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 8]
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
test eax, eax
je 0x4023f9
mov edi, eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
lea esi, [eax + 1]
push 0x40
push 0x3000
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_VirtualAllocEx]
test eax, eax
je 0x4023f2
mov ebx, eax
push 0
push esi
push dword [ebp + 0xc]
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
call 0x402381
imul esp, dword [ebp + 0x72], 0x6e
insb byte es:[edi], dx
xor esi, dword [edx]
add bh, bh
adc eax, sym.imp.KERNEL32.DLL_GetModuleHandleA
call 0x402399
dec esp
outsd dx, dword [esi]
popal
dec esp
imul esp, dword [edx + 0x72], 0x41797261
add byte [eax - 1], dl
adc eax, sym.imp.KERNEL32.DLL_GetProcAddress
xor ecx, ecx
push ecx
push ecx
push ebx
push eax
push ecx
push ecx
push edi
call dword [sym.imp.KERNEL32.DLL_CreateRemoteThread]
xor esi, esi
test eax, eax
je 0x4023d8
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
sub esp, 4
push esp
push esi
call dword [sym.imp.KERNEL32.DLL_GetExitCodeThread]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov esi, dword [esp]
add esp, 4
push 0x8000
push 0
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_VirtualFreeEx]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, esi
jmp 0x4023fb
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8