joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49f0d0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x26
xor esi, esi
call fcn.0049e060
add esp, 4
test eax, eax
je 0x49f0e9
mov esi, 1
push 0x28
call fcn.0049e060
add esp, 4
test eax, eax
je 0x49f0fa
or esi, 2
push 0xd
call fcn.0049e060
add esp, 4
test eax, eax
je 0x49f10b
or esi, 0x10
push 0x20
call fcn.0049e060
add esp, 4
test eax, eax
je 0x49f11c
or esi, 0x10
push 0x25
call fcn.0049e060
add esp, 4
test eax, eax
je 0x49f12d
or esi, 4
push 0x27
call fcn.0049e060
add esp, 4
test eax, eax
je 0x49f13e
or esi, 8
push 0x1b
call fcn.0049e060
add esp, 4
test eax, eax
je 0x49f14f
or esi, 0x60
push 8
call fcn.0049e060
add esp, 4
test eax, eax
je 0x49f160
or esi, 0x20
push 0
call fcn.0049e0e0
add esp, 4
test eax, 0x40000000
je 0x49f174
or esi, 1
test eax, 0x80000000
je 0x49f17e
or esi, 2
test eax, 0x10000000
je 0x49f188
or esi, 4
test eax, 0x20000000
je 0x49f192
or esi, 8
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x49f1a3
test eax, 0xfffffff
je 0x49f1a3
or esi, 0x10
mov eax, dword [0x7241e4]
test eax, eax
je 0x49f1b8
test esi, esi
je 0x49f1b8
or esi, 0x8000
jmp 0x49f1be
mov dword [0x7241e4], esi
test esi, 0x8000
jne 0x49f1ec
test esi, esi
je 0x49f1ec
push 0xaa
call fcn.004a7c00
push 0x3fb33333
push 0
push 0
push 0x64
push 0xaa
call fcn.004a8040
add esp, 0x18
mov eax, esi
pop esi
pop ebp
ret
Function at 0x4a2050
Capabilities:
Enumerate pe sections
Get disk information

Disassembly:
mov eax, dword [0x77c780]
sub esp, 8
test eax, eax
push ebx
push esi
push edi
jne 0x4a2110
lea eax, [esp + 0xc]
push 2
push eax
push 0
mov dword [0x77c780], 1
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edi, 0x5175ec
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xd]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x4a2110
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, 0x80000000
jne 0x4a2110
mov esi, dword [ebx + 0x3c]
add esi, ebx
mov edx, dword [esi + 0x54]
push edx
push ebx
call fcn.004a2120
xor edi, edi
add esp, 8
cmp word [esi + 6], di
jbe 0x4a2110
push ebp
xor ebp, ebp
xor eax, eax
mov ax, word [esi + 0x14]
add eax, ebp
mov edx, dword [eax + esi + 0x24]
mov ecx, dword [eax + esi + 0x20]
lea eax, [eax + esi + 0x18]
add edx, ebx
push ecx
push edx
call fcn.004a2120
xor eax, eax
add esp, 8
mov ax, word [esi + 6]
inc edi
add ebp, 0x28
cmp edi, eax
jb 0x4a20e1
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret

Function at 0x4a2120
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
mov eax, dword [0x77c77c]
sub esp, 0x28
test eax, eax
jne 0x4a2141
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 8]
mov dword [0x77c77c], ecx
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
push ebx
push ebp
push esi
push edi
lea edi, [eax + edx]
cmp eax, edi
jae 0x4a2235
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [esp + 0x14]
push 0x1c
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp eax, 0x1c
jne 0x4a222b
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
lea esi, [edx + eax]
cmp esi, edi
jbe 0x4a2186
mov esi, edi
cmp dword [esp + 0x24], 0x1000
jne 0x4a2200
mov ecx, dword [esp + 0x28]
test ch, 1
jne 0x4a2200
cmp ecx, 1
je 0x4a2200
cmp ecx, 8
je 0x4a2217
cmp ecx, 0x80
je 0x4a2217
lea ecx, [esp + 0x10]
mov edx, esi
push ecx
sub edx, eax
push 0x40
push edx
push eax
mov bl, 1
call ebp
test eax, eax
je 0x4a222b
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x28]
cmp eax, ecx
jne 0x4a221b
mov eax, dword [esp + 0x14]
cmp eax, esi
jae 0x4a21ea
mov ecx, dword [eax]
mov dword [eax], ecx
add eax, dword [0x77c77c]
cmp eax, esi
jb 0x4a21d4
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
test bl, bl
je 0x4a2200
lea edx, [esp + 0x10]
push edx
push ecx
mov ecx, esi
sub ecx, eax
push ecx
push eax
call ebp
test eax, eax
je 0x4a222b
cmp esi, edi
mov eax, esi
jb 0x4a215e
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x28
ret
xor bl, bl
jmp 0x4a21d0
lea edx, [esp + 0x10]
push edx
push eax
mov eax, dword [esp + 0x1c]
sub esi, eax
push esi
push eax
call ebp
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x28
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x28
ret
Function at 0x4ae830
Capabilities:
Log keystrokes via application hook

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
call dword [sym.imp.WINMM.dll_timeGetTime]
push eax
call fcn.004b00be
add esp, 4
push 0
push 0
push 0x4ae9e0
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0xc46c38], eax
mov ecx, 0xa
xor eax, eax
mov edi, 0xc46c00
rep stosd dword es:[edi], eax
push eax
mov dword [0xc46c00], 0x102b
mov dword [0xc46c04], 0x4ae400
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x80
push eax
mov dword [0xc46c10], eax
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
push 0
mov dword [0xc46c14], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push 4
mov dword [0xc46c18], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
push 0xc46c00
mov dword [0xc46c1c], eax
mov dword [0xc46c24], 0x518e60
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
jne 0x4ae8e1
push str.Win_Init_1_
call fcn.004ae330
add esp, 4
call fcn.0049b420
mov edx, dword [0xc46c28]
mov esi, eax
add esi, edx
call fcn.0049b430
mov ecx, dword [0xc46c2c]
mov edi, eax
lea eax, [esp + 0x10]
push 0
push eax
push 0
push 0x30
add edi, ecx
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
sub eax, ebx
sub ecx, ebp
cmp esi, eax
jl 0x4ae92c
mov ebp, ebx
jmp 0x4ae937
sub eax, esi
cdq
sub eax, edx
mov ebp, eax
sar ebp, 1
add ebp, ebx
cmp edi, ecx
jl 0x4ae941
mov ebx, dword [esp + 0x14]
jmp 0x4ae952
mov eax, ecx
sub eax, edi
cdq
sub eax, edx
mov ebx, eax
mov eax, dword [esp + 0x14]
sar ebx, 1
add ebx, eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push 0
push 0
push edi
push esi
push ebx
push ebp
push 0xcb0000
push str.Tarzan_Action_Game
push str.DITARZANAG
push 0x300
call dword [sym.imp.USER32.dll_CreateWindowExA]
test eax, eax
mov dword [0xc46c30], eax
jne 0x4ae99a
push str.Win_Init_2_
call fcn.004ae330
mov eax, dword [0xc46c30]
add esp, 4
mov ecx, dword [esp + 0x24]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push ecx
push eax
call esi
mov edx, dword [0xc46c30]
push 0xa
push edx
call esi
mov eax, dword [0xc46c30]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
call fcn.004ae3b0
pop edi
pop esi
pop ebp
mov dword [0x518dd8], eax
pop ebx
add esp, 0x10
ret

Function at 0x4ae9f0
Capabilities:
Get disk information

Disassembly:
sub esp, 8
lea eax, [esp]
push esi
push edi
push 2
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edi, 0x5175ec
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 9]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
pop edi
cmp eax, 3
pop esi
je 0x4aea49
push str.The_game_can_only_be_run_from_a_local_hard_disk.
call fcn.004ae330
add esp, 4
call fcn.00493f70
test eax, eax
je 0x4aea65
call fcn.004945b0
test eax, eax
jne 0x4aea65
mov dword [0xc46c3c], 1
add esp, 8
ret
Function at 0x4b0028
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4b0048
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004b157d
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4b006b
test byte [esp + 8], 2
je 0x4b006b
call fcn.004b15f0
mov dword [eax], 0xd
call fcn.004b15f9
mov dword [eax], 5
jmp 0x4b0044
xor eax, eax
ret

Function at 0x4b5aac
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x51b9d8
cmp edx, dword [eax]
je 0x4b5ace
add eax, 8
inc ecx
cmp eax, 0x51ba68
jl 0x4b5abf
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x51b9d8]
jne 0x4b5bfc
mov eax, dword [0xc46cbc]
cmp eax, 1
je 0x4b5bd6
test eax, eax
jne 0x4b5aff
cmp dword [0x519064], 1
je 0x4b5bd6
cmp edx, 0xfc
je 0x4b5bfc
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4b5b36
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004b6420
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004b53f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4b5b79
lea eax, [ebp - 0x1a4]
push eax
call fcn.004b53f0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4ba8e4
push edi
call fcn.004b7a30
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004b6420
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004b6430
lea eax, [ebp - 0xa0]
push 0x4ba8c4
push eax
call fcn.004b6430
push dword [esi + 0x51b9dc]
lea eax, [ebp - 0xa0]
push eax
call fcn.004b6430
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004b79a3
add esp, 0x2c
pop edi
jmp 0x4b5bfc
lea eax, [ebp + 8]
lea esi, [esi + 0x51b9dc]
push 0
push eax
push dword [esi]
call fcn.004b53f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x402400
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x402458
cmp byte [esi + ebx - 1], 0xa
je 0x40242c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4030f8], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret

Function at 0x402500
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
mov esi, eax
push ebx
sub esp, 0x1c
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
sub esp, 4
cmp eax, 0xffffffff
lea eax, [ebp - 0x10]
mov dword [esp + 8], eax
je 0x402590
mov dword [esp + 4], 1
mov dword [esp], esi
call sym._MsiOpenDatabaseW_12
sub esp, 0xc
mov ebx, eax
test eax, eax
jne 0x402550
mov eax, dword [ebp - 0x10]
xor ebx, ebx
mov dword [edi], eax
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x403030], 2
je 0x402545
mov eax, esi
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.failed_to_open_package_database__s___u__n
mov dword [esp + 8], str.open_database
mov dword [esp + 4], 0x403030
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x402545
mov dword [esp + 4], 3
mov dword [esp], esi
call sym._MsiOpenDatabaseW_12
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x4025f0
test byte [0x403030], 2
je 0x402545
mov eax, esi
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.failed_to_create_package_database__s___u__n
mov dword [esp + 8], str.open_database
mov dword [esp + 4], 0x403030
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x402545
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._MsiDatabaseCommit_4
sub esp, 4
mov ebx, eax
test eax, eax
je 0x40253e
test byte [0x403030], 2
jne 0x402628
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._MsiCloseHandle_4
sub esp, 4
jmp 0x402545
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.failed_to_commit_database___u__n
mov dword [esp + 8], str.open_database
mov dword [esp + 4], 0x403030
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x402611
Function at 0x402a20
Capabilities:
Get common file path
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x24
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
cmp eax, 2
jle 0x402a3d
mov edx, dword [ebx + 4]
cmp word [edx], 0x2d
je 0x402a60
mov dword [esp], str.Usage:_winemsibuilder__OPTION___MSIFILE__..._nOptions:_n___i_package.msi_table1.idt__table2.idt_..._____Import_one_or_more_tables_into_the_database._n___a_package.msi_stream_file____________________Add_stream_to_storage_with_contents_of_file._n_nExisting_tables_or_streams_will_be_overwritten._If_package.msi_does_not_exist_a_new_file_nwill_be_created_with_an_empty_database._n
mov esi, 1
call sym._wine_dbg_printf.constprop.0
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
movzx edx, word [edx + 2]
cmp dx, 0x61
je 0x402b90
cmp dx, 0x69
jne 0x402b50
cmp eax, 3
je 0x402a3d
mov eax, dword [ebx + 8]
lea edx, [ebp - 0x10]
mov esi, 1
call sym._open_database
test eax, eax
jne 0x402a4e
mov dword [esp + 4], 0
mov edi, dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov dword [esp], 0
call edi
lea edx, [eax + 1]
sub esp, 8
lea eax, [edx + edx]
mov dword [ebp - 0x18], edx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edx, dword [ebp - 0x18]
test eax, eax
mov dword [ebp - 0x14], eax
je 0x402b3b
mov eax, dword [ebp - 0x14]
mov dword [esp], edx
mov dword [esp + 4], eax
call edi
mov eax, dword [ebx + 0xc]
sub esp, 8
test eax, eax
je 0x402bb0
lea edi, [ebx + 0xc]
jmp 0x402afe
mov eax, dword [edi + 4]
add edi, 4
test eax, eax
je 0x402bb0
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._MsiDatabaseImportW_12
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x402af0
mov esi, 1
test byte [0x403030], 2
jne 0x402c07
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._MsiCloseHandle_4
sub esp, 4
jmp 0x402a4e
test byte [0x403030], 4
je 0x402a3d
mov dword [esp + 0xc], str.unknown_option_n
mov dword [esp + 8], str.wmain
mov dword [esp + 4], 0x403030
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0
jmp 0x402a3d
cmp eax, 4
jle 0x402a3d
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebx + 0xc]
mov eax, dword [ebx + 8]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp sym._add_stream
mov eax, dword [ebp - 0x10]
xor esi, esi
mov dword [esp], eax
call sym._MsiDatabaseCommit_4
sub esp, 4
test eax, eax
je 0x402b2f
mov esi, 1
test byte [0x403030], 2
je 0x402b2f
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.failed_to_commit_changes___u__n
mov dword [esp + 8], str.import_tables
mov dword [esp + 4], 0x403030
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x402b2f
mov eax, dword [edi]
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.failed_to_import_table__s___u__n
mov dword [esp + 8], str.import_tables
mov dword [esp + 4], 0x403030
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x402b2f
Function at 0x402c40
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
nop
nop
Function at 0x10001da0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, 0x5ab
and eax, 0xff
push esi
cdq
idiv ecx
mov esi, dword [esp + 0xc]
add dl, 0x3d
test esi, esi
jbe 0x10001dcd
mov eax, dword [esp + 8]
mov cl, byte [eax]
xor cl, dl
add cl, dl
mov byte [eax], cl
inc eax
dec esi
jne 0x10001dc1
pop esi
ret

Function at 0x10001dd0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push 0x400
push 0x26000
push 0x10007030
call fcn.10001da0
push 0x10007030
call fcn.100012f0
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x10001e15
mov eax, dword [esp + 0x10]
push eax
push ebx
call fcn.10001af0
add esp, 8
test eax, eax
jne 0x10001e19
push ebx
call fcn.10001b80
add esp, 4
pop edi
pop esi
pop ebx
ret
sub esp, 0x2a8
mov ecx, 0xaa
mov esi, str._____________
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call eax
push ebx
call fcn.10001b80
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10009761
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1001f5e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
call fcn.1000a23f
test eax, eax
je 0x10009876
xor ebx, ebx
mov dword [ebp - 0x214], 0x104
push ebx
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.shlwapi.dll_PathCreateFromUrlW]
test eax, eax
js 0x10009876
push ebx
push 0x80
push 3
push ebx
inc ebx
lea eax, [ebp - 0x20c]
push ebx
push SysReAllocStringLen
push eax
call dword [sym.imp.kernel32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x10009876
push 0
lea eax, [ebp - 0x218]
push eax
push 4
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.kernel32.dll_ReadFile]
push edi
mov esi, eax
call dword [sym.imp.kernel32.dll_CloseHandle]
test esi, esi
je 0x10009876
cmp dword [ebp - 0x218], 4
jne 0x10009876
push 3
lea eax, [ebp - 0x210]
push 0x10017620
push eax
call sub.VCRUNTIME140.dll_memcmp
add esp, 0xc
test eax, eax
je 0x10009840
push 3
lea eax, [ebp - 0x210]
push 0x10017624
push eax
call sub.VCRUNTIME140.dll_memcmp
add esp, 0xc
test eax, eax
je 0x10009840
mov al, bl
jmp 0x10009878
xor eax, eax
push eax
push eax
push eax
movsx ax, byte [ebp - 0x20d]
movzx eax, ax
push eax
call fcn.10009989
mov ecx, dword [0x10020678]
add esp, 0x10
mov edi, eax
mov esi, edx
call fcn.10009989
cmp edx, esi
jb 0x10009872
ja 0x1000983c
cmp eax, edi
jae 0x1000983c
xor bl, bl
jmp 0x1000983c
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10013bb0
leave
ret 4

Function at 0x10009989
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x10009998
pop dword [ebp - 0x40]
mov eax, 0x10009998
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x3d436
push 0
mov eax, 0xe8620e59
sub eax, 0xd860ad19
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0xf52d94d6
sub ecx, 0xf52d40c5
mov edi, eax
mov esi, 0xc9c9703c
add esi, 0x4638d3c4
add esi, dword [ebp - 0x40]
mov ebx, 0x1bf11ea8
sub ebx, 0x368d324b
sub dword [ebp - 0x3c], 0xe4f52931
mov edx, dword [esi]
xor edx, ebx
xor dword [ebp - 0x30], ebx
mov dword [edi], edx
add edi, 0x8a1cab21
add edi, 0x75e354e3
add esi, 0xac0a2fab
sub esi, 0xac0a2fa7
loop 0x100099f2
add eax, 0x21cfa285
sub eax, 0x21ce5f6e
mov ebx, eax
add eax, 0x63cd967b
sub eax, 0x63cd9676
mov ecx, 0x10000000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x1001224e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1001225d
pop dword [ebp - 0x4c]
mov eax, 0x93d95b0f
add eax, 0x7c27c74e
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x46b9e50a
sub dword [ebp - 0x5c], 0xf8679fbf
mov dword [ebp - 0x58], 0xc2e79a08
sub dword [ebp - 0x58], 0x90b44dc3
mov dword [ebp - 0x54], 0x341975b2
add dword [ebp - 0x54], 0x1832ce7c
mov dword [ebp - 0x50], 0x211ec8de
sub dword [ebp - 0x50], 0x211ec8de
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x7a4aa35
sub eax, 0xf7a3599d
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xaf675fb8
add dword [ebp - 0x5c], 0xc50b099e
mov dword [ebp - 0x58], 0xfba95068
sub dword [ebp - 0x58], 0xba3ceef3
mov dword [ebp - 0x54], 0x59c6ba26
sub dword [ebp - 0x54], 0xf6574dba
mov dword [ebp - 0x50], 0xe75f808e
sub dword [ebp - 0x50], 0xe75f808e
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3a632
push 0
call eax
mov ecx, 0x981ac5c
add ecx, 0xf67ea2e2
mov esi, eax
mov edi, 0x10041c00
add edi, dword [ebp - 0x4c]
mov ebx, 0xd1e067bd
sub ebx, 0xb385de3f
sub dword [ebp - 0x40], eax
mov edx, dword [edi]
xor dword [ebp - 0x18], ebx
xor edx, ebx
sub dword [ebp - 4], 0x1d91a377
mov dword [esi], edx
mov dword [ebp - 0x44], 0x3c7559a0
add esi, 4
add edi, 4
loop 0x10012374
add eax, 0x12fcb
xor ebx, ebx
add ebx, eax
add eax, 0x27bb6dba
add eax, 0xd844924b
mov ecx, 0x5ff4388e
sub ecx, 0x4ff4388e
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x1a0914ea
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x6ef51cde
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x402e10
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x440068]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
push edi
mov esi, ecx
call fcn.00401e00
test al, al
jne 0x402f06
lea ecx, [esp + 0xc]
call fcn.004015e0
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x402f1a
mov ebx, dword [esp + 0x20]
lea ecx, [esp + 0xc]
mov edi, dword [esp + 0xc]
cmp ebx, 8
push 6
cmovae ecx, edi
mov edx, eax
push str.Chrome
push ecx
call fcn.00404510
add esp, 0xc
cmp eax, 0xffffffff
jne 0x402f22
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0xc]
cmp ebx, 8
push 6
cmovae ecx, edi
push str.chrome
push ecx
call fcn.00404510
add esp, 0xc
cmp eax, 0xffffffff
jne 0x402f22
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x402ea9
mov eax, dword [esi]
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x483
je 0x402f1a
mov edx, dword [esp + 0x20]
cmp edx, 8
jb 0x402f06
mov ecx, dword [esp + 0xc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x402efc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402f90
push edx
push ecx
call fcn.004152ff
add esp, 8
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00415024
mov esp, ebp
pop ebp
ret
mov ebx, dword [esp + 0x20]
mov edi, dword [esp + 0xc]
cmp ebx, 8
jb 0x402f52
lea ebx, [ebx*2 + 2]
mov eax, edi
cmp ebx, 0x1000
jb 0x402f48
mov edi, dword [edi - 4]
add ebx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402f90
push ebx
push edi
call fcn.004152ff
add esp, 8
mov ecx, esi
call fcn.00401ff0
test al, al
jne 0x402f06
mov ecx, esi
call fcn.004023e0
test al, al
jne 0x402f06
mov ecx, esi
call fcn.004025a0
test al, al
jne 0x402f06
mov ecx, esi
call fcn.00402760
test al, al
jne 0x402f06
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00415024
mov esp, ebp
pop ebp
ret
call fcn.0041b091
int3