joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007b0b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x1007b241
mov eax, dword [ebx]
mov ecx, ebx
mov eax, dword [eax + 0x280]
call eax
test al, al
je 0x1007b241
mov eax, dword [0x100ccfc0]
cmp dword [eax + 0x174], 0xffffffff
je 0x1007b241
mov eax, dword [0x100cd270]
add eax, 0xffffff91
xor eax, 0xc8375248
cmp dword [eax + ebx], 0
mov eax, dword [0x100cd238]
setle cl
add eax, 0xffffff9f
xor eax, 0xc837523a
xor edi, edi
mov byte [eax + ebx], cl
mov eax, dword [0x100cd22c]
add eax, 0xffffffa2
xor eax, 0xc8375237
mov dword [eax + ebx + 0xc], 0
mov eax, dword [0x100cd230]
add eax, 0xffffffa1
xor eax, 0xc8375238
mov dword [eax + ebx + 0xc], 0
mov ecx, dword [0x100cd234]
lea eax, [ecx - 0x60]
xor eax, 0xc8375239
mov edx, dword [eax + ebx + 0xc]
mov dword [ebp - 4], edx
test edx, edx
je 0x1007b19e
lea eax, [ecx - 0x60]
xor eax, 0xc8375239
mov eax, dword [eax + ebx]
mov esi, dword [eax + edi*4]
lea ebx, [eax + edi*4]
test esi, esi
je 0x1007b196
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
jne 0x1007b18a
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 4]
call eax
test al, al
je 0x1007b187
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
mov edx, dword [ebp - 4]
mov dword [ebx], 0
mov ecx, dword [0x100cd234]
mov ebx, dword [ebp + 8]
inc edi
cmp edi, edx
jb 0x1007b153
lea eax, [ecx - 0x60]
xor eax, 0xc8375239
lea ecx, [ebx + 8]
push 0
mov dword [eax + ebx + 0xc], 0
mov eax, dword [ebx + 8]
mov eax, dword [eax + 0x1c]
call eax
mov eax, dword [ebx + 8]
lea ecx, [ebx + 8]
push 0
mov eax, dword [eax + 0x14]
call eax
mov ecx, dword [0x100ccfd4]
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x1007b232
nop dword [eax]
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
inc ecx
cmp byte [esi + ecx], 0
jne 0x1007b1f6
xor edx, edx
test ecx, ecx
je 0x1007b21c
movsx eax, byte [esi + edx]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x1007b203
cmp edi, 0x79705c5e
je 0x1007b227
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x1007b232
mov ecx, dword [ebp - 4]
jmp 0x1007b1e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov ecx, dword [eax + ebx*4]
jmp 0x1007b234
xor ecx, ecx
push 0
push dword [ebp + 8]
push 0
call dword [0x100cd0c0]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10086140
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x100d2440]
sub esp, 0x10
push ebx
push esi
push edi
test al, 1
jne 0x100861a8
or eax, 1
mov dword [0x100d2440], eax
mov eax, dword [0x100ccf4c]
mov ebx, dword [eax + 0x30]
jmp 0x1008619c
mov edi, dword [ebx + 0xc]
mov esi, 0x811c9dc5
xor ecx, ecx
nop
inc ecx
cmp byte [edi + ecx], 0
jne 0x10086170
xor edx, edx
test ecx, ecx
je 0x10086199
nop dword [eax]
movsx eax, byte [edi + edx]
inc edx
xor eax, esi
imul esi, eax, 0x1000193
cmp edx, ecx
jb 0x10086180
cmp esi, 0xcc254ccd
je 0x100861a0
mov ebx, dword [ebx + 4]
test ebx, ebx
jne 0x10086164
mov dword [0x100d2444], ebx
jmp 0x100861ae
mov ebx, dword [0x100d2444]
mov eax, dword [ebx]
movss xmm0, dword [0x100b6cb8]
push ecx
mov ecx, ebx
movss dword [esp], xmm0
mov eax, dword [eax + 0x3c]
call eax
cmp byte [0x100b6e80], 0
je 0x1008632b
mov eax, dword [0x100ccfac]
movss xmm1, dword [eax + 0x10]
comiss xmm1, dword [0x100d20f8]
ja 0x1008632b
movss xmm2, dword [0x100d20fc]
xorps xmm0, xmm0
comiss xmm0, xmm2
jae 0x1008632b
subss xmm1, dword [0x100d20f4]
mov eax, dword [0x100a9174]
movss xmm0, dword [0x1009f2b8]
mov ecx, dword [0x100ccf5c]
cdq
divss xmm1, xmm2
sub eax, edx
mov word [ebp - 4], 0xc8c8
mov ebx, eax
mov byte [ebp - 2], 0xc8
mov eax, dword [0x100a9178]
cdq
sub eax, edx
sar ebx, 1
mov edi, eax
mov dword [ebp - 0x10], ebx
sar edi, 1
mov dword [ebp - 0xc], edi
subss xmm0, xmm1
mulss xmm0, dword [0x1009f3cc]
cvttss2si eax, xmm0
mov byte [ebp - 1], al
push dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ecx]
mov eax, dword [eax + 0x38]
call eax
mov ecx, dword [0x100ccf5c]
lea edx, [edi - 1]
push edx
lea esi, [ebx - 1]
add ebx, 0xfffffffa
push esi
mov eax, dword [ecx]
lea edx, [edi - 6]
push edx
push ebx
mov eax, dword [eax + 0x4c]
call eax
mov ecx, dword [0x100ccf5c]
mov eax, dword [ebp - 8]
mov byte [ebp - 1], al
mov word [ebp - 4], 0xc8c8
mov eax, dword [ecx]
mov byte [ebp - 2], 0xc8
push dword [ebp - 4]
mov eax, dword [eax + 0x38]
call eax
mov ecx, dword [0x100ccf5c]
inc edi
mov edx, dword [ebp - 0xc]
push edi
push esi
mov eax, dword [ecx]
add edx, 6
push edx
push ebx
mov eax, dword [eax + 0x4c]
call eax
mov ecx, dword [0x100ccf5c]
mov eax, dword [ebp - 8]
mov byte [ebp - 1], al
mov word [ebp - 4], 0xc8c8
mov eax, dword [ecx]
mov byte [ebp - 2], 0xc8
push dword [ebp - 4]
mov eax, dword [eax + 0x38]
call eax
mov ebx, dword [ebp - 0x10]
mov ecx, dword [0x100ccf5c]
push edi
mov edi, dword [ebp - 0xc]
lea esi, [ebx + 1]
add ebx, 6
mov eax, dword [ecx]
push esi
lea edx, [edi + 6]
push edx
mov eax, dword [eax + 0x4c]
push ebx
call eax
mov ecx, dword [0x100ccf5c]
mov eax, dword [ebp - 8]
mov byte [ebp - 1], al
mov word [ebp - 4], 0xc8c8
mov eax, dword [ecx]
mov byte [ebp - 2], 0xc8
push dword [ebp - 4]
mov eax, dword [eax + 0x38]
call eax
mov ecx, dword [0x100ccf5c]
lea edx, [edi - 1]
push edx
push esi
lea edx, [edi - 6]
mov eax, dword [ecx]
push edx
push ebx
mov eax, dword [eax + 0x4c]
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408a1c
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4d0
push esi
push edi
lea eax, [ebp - 0x10]
push eax
mov edi, 0x4b6
push edi
mov esi, ecx
call fcn.004071bd
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
push 1
inc eax
inc eax
push edi
mov ecx, esi
mov dword [esi + 0x58], eax
call fcn.004071da
push 1
inc edi
push edi
mov ecx, esi
call fcn.004071da
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
push 0x103
push 0x2b4
lea eax, [ebp - 0x4d0]
push eax
push 0
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [ebp - 0x4d0]
push edi
push dword [esi + 4]
mov dword [esi + 0x50], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x407823
push 0xfffffffffffffffc
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov ecx, esi
mov dword [esi + 0x54], eax
call fcn.004086eb
mov ecx, esi
mov edi, eax
call fcn.00407b90
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x4094f0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x40952b
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x409512
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x409523
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x40952d
inc edi
add eax, 0x28
cmp edi, esi
jb 0x409508
xor eax, eax
pop edi
pop esi
ret

Function at 0x40c8ae
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40c8d4
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
je 0x40c8d4
xor al, al
jmp 0x40c8f4
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.00413790
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4
Function at 0x413370
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
sub eax, 1
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x4199e0], ecx
add edx, 1
cmp edx, 0x100
jb 0x413372
cmp edx, 0x800
jae 0x41345b
mov edi, edi
mov eax, dword [edx*4 + 0x4195e0]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x4199e0]
add edx, 1
cmp edx, 0x800
mov dword [edx*4 + 0x4199dc], eax
jb 0x413430
mov dword [0x4199b4], 0x413ab0
call fcn.004135a0
test eax, eax
jne 0x413478
mov dword [0x4199b4], 0x4139d0
ret

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x2ce608e8
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x4e3b3696
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x56a1a7
Capabilities:
Encode data using xor

Disassembly:
xchg ebp, eax
dec edi
in eax, 0x65
cmc
test al, 0xa5
pop es
push cs
rcl dword [ebp - 0x78], cl
xor al, 0xf2
xor al, 0x83
nop
dec esi
sbb bl, byte [edx - 0x678f55b]
pop esi
lea esi, [ebx - 0xb]
jae 0x56a1a9
dec esi
jne 0x56a234
shr dword gs:[esi + 0xf03be82], cl
sal dword [ebx + 0x21], cl
int3
int3
test dword [ecx + ebx*4 - 0x39], esi
adc esi, ebx
cmp edx, dword [esi]
mov ch, byte [ebx - 0x1614646b]
aam 0xeb
xor al, 0xea
add eax, dword [ecx - 0x5c3f2f92]
xor edx, dword [edx - 0xa]
add eax, 0x95215c7
pushal
ljmp 0xa3c0:0xd06e8103
test byte [0x95215c7], 0x60
cmp byte [ecx - 0x28e89880], al
mov esp, 0xca66b3b0
inc ebp
jne 0x56a24e
mov ebx, 0x8db20ff
xor al, 0x16
mov byte [ebx], al
and eax, 0x9be7d882
js 0x56a20a
pop eax
jg 0x56a21a
mov esp, dword [eax - 0x4f9385fb]
jo 0x56a2e0
add al, 0x61
push eax
invalid
push edi
salc
push ss
shl byte [ebp - 0x50], cl
xchg esi, eax
adc dword [esi + 0x27956381], esp
xchg esi, eax
xor al, 0xa7
pop ss
xchg esi, eax
and eax, 0x4f2356e3
push ss
mov byte [edx - 0x3c], 0x11
jg 0x56a22b
mov dh, 0xd1
push esi
xlatb
push ebp
xlatb
in eax, 0xf2
and al, 0xe0
cmc
xchg esi, eax
xor eax, 0x25f612f1
lodsb al, byte [esi]
test dword [edx - 0x3f], eax
xchg esi, eax
inc edi
or byte [edx + 0x41], 0xf1
xor eax, 0x43a549b5
inc ebx
jl 0x56a2c6
push es
and al, 0x2b
adc byte [esi], dl
fldcw word [ebx]
mov ebx, dword [ebp - 0x30998b00]
test eax, 0xa058b993
push 0x5d65c1dd
sbb dword [esp + eax*4 - 0x45], esp
dec ecx
test eax, 0xb74ae3
ror byte [ebx - 0xc], 1
and al, 0xd9
push eax
add al, 0x38
leave
mov dl, 0xb5
fidivr dword [esi + 0x3e12f928]
sbb al, 0x7c
and eax, 0x99d80d66
scasb al, byte es:[edi]
ja 0x56a286
sbb esp, edi
aad 0x9d
mov cl, 0x8d
xor edx, dword [ebp + 0x1d89d5e9]
std
jmp 0xa06b7d15
Function at 0x7c5d4d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x7ce388
cmp edx, dword [eax]
je 0x7c5d6f
add eax, 8
inc ecx
cmp eax, 0x7ce418
jl 0x7c5d60
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x7ce388]
jne 0x7c5e9d
mov eax, dword [0xbd1ce4]
cmp eax, 1
je 0x7c5e77
test eax, eax
jne 0x7c5da0
cmp dword [0x7ce2b4], 1
je 0x7c5e77
cmp edx, 0xfc
je 0x7c5e9d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x7c5dd7
lea eax, [ebp - 0x1a4]
push 0x7cb928
push eax
call fcn.007c6730
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.007c6bc0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x7c5e1a
lea eax, [ebp - 0x1a4]
push eax
call fcn.007c6bc0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x7cb924
push edi
call fcn.007c8a90
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x7cb908
push eax
call fcn.007c6730
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.007c6740
lea eax, [ebp - 0xa0]
push 0x7cb904
push eax
call fcn.007c6740
push dword [esi + 0x7ce38c]
lea eax, [ebp - 0xa0]
push eax
call fcn.007c6740
push 0x12010
lea eax, [ebp - 0xa0]
push 0x7cb8dc
push eax
call fcn.007c8a04
add esp, 0x2c
pop edi
jmp 0x7c5e9d
lea eax, [ebp + 8]
lea esi, [esi + 0x7ce38c]
push 0
push eax
push dword [esi]
call fcn.007c6bc0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x67b090
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x584015
lea edi, [esi - 0x183015]
push edi
or ebp, 0xffffffff
jmp 0x67b0b2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x67b0b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x67b0a8
mov eax, 1
add ebx, ebx
jne 0x67b0cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x67b0dc
jne 0x67b0fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x67b0fb
dec eax
add ebx, ebx
jne 0x67b0e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x67b0c0
add ebx, ebx
jne 0x67b0f7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x67b14d
xor ecx, ecx
sub eax, 3
jb 0x67b113
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x67b182
sar eax, 1
mov ebp, eax
jmp 0x67b11e
add ebx, ebx
jne 0x67b11e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x67b0ec
inc ecx
add ebx, ebx
jne 0x67b12c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x67b0ec
add ebx, ebx
jne 0x67b139
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x67b12e
jne 0x67b14a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x67b12e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x67b16c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x67b15e
jmp 0x67b0ae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x67b16c
add edi, ecx
jmp 0x67b0ae
pop esi
mov edi, esi
mov ecx, 0x4ef4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x67b18a
cmp byte [edi], 0x1a
jne 0x67b18a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x67b18f
lea edi, [esi + 0x278000]
mov eax, dword [edi]
or eax, eax
je 0x67b1fe
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2818f8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x281a38]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x67b1bc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x281a3c]
or eax, eax
je 0x67b1f8
mov dword [ebx], eax
add ebx, 4
jmp 0x67b1d9
call dword [esi + 0x281a4c]
mov ebp, dword [esi + 0x281a40]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x67b232
sub esp, 0xffffff80
jmp 0x4012b0
Function at 0x401040
Capabilities:
Accept command line arguments
Create process memory minidump

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x10]
push ebx
sub esp, 0x20
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call dword [sym.imp.shcore.dll_CommandLineToArgvW]
mov ecx, dword [ebp - 0x10]
mov edx, eax
sub esp, 8
mov eax, 1
test ecx, ecx
jle 0x401171
mov ebx, dword [edx]
cmp word [ebx], 0x30
jne 0x401090
movzx eax, word [ebx + 2]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_towlower]
cmp ax, 0x78
je 0x401180
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcstoul]
mov esi, eax
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0x410
call dword [sym.imp.kernel32.dll_OpenProcess]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x4011a0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov dword [esp], str.minidump.dmp
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
mov edi, eax
cmp eax, 0xffffffff
je 0x4011b0
mov dword [esp + 4], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 2
mov dword [esp + 8], eax
mov dword [esp], ebx
call sym._MiniDumpWriteDump_28
sub esp, 0x1c
mov esi, eax
mov dword [esp], edi
mov edi, dword [sym.imp.kernel32.dll_CloseHandle]
call edi
sub esp, 4
mov dword [esp], ebx
call edi
xor eax, eax
sub esp, 4
test esi, esi
sete al
shl eax, 2
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcstoul]
mov esi, eax
jmp 0x4010ab
lea esp, [ebp - 0xc]
mov eax, 2
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, 3
sub esp, 4
jmp 0x401171
Function at 0x4011d0
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x58
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x40125b
cmp ax, 9
je 0x401248
cmp ax, 0x20
je 0x401248
mov dword [ebp - 0x54], 0
xor edi, edi
nop
cmp ax, 0x5c
je 0x4012b0
cmp ax, 0x22
je 0x4012c0
mov dword [ebp - 0x54], 0
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x40125b
cmp ax, 9
sete cl
cmp ax, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x401200
test edi, 1
jne 0x401200
lea esi, [esi]
movzx eax, word [ebx + 2]
add ebx, 2
cmp ax, 9
je 0x401248
cmp ax, 0x20
je 0x401248
lea eax, [ebp - 0x50]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x24], 1
je 0x4012d8
movzx esi, word [ebp - 0x20]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._wWinMain_16
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
inc dword [ebp - 0x54]
jmp 0x40121b
and dword [ebp - 0x54], 1
jne 0x401214
xor edi, 1
jmp 0x40121b
mov eax, 1
mov esi, 1
mov word [ebp - 0x20], ax
jmp 0x401274

Function at 0x4012f0
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
nop
nop
Function at 0x4033b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov edx, dword [eax + 4]
mov ecx, dword [eax]
cmp edx, 0xffffffff
jne 0x4033df
mov edx, ecx
lea esi, [edx + 2]
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4033d0
sub edx, esi
sar edx, 1
push dword [ebp + 0xc]
lea eax, [edx + edx]
push eax
push ecx
mov ecx, edi
call fcn.0040b030
mov esi, eax
cmp esi, 0xffffffff
je 0x40342d
push 0
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
lea eax, [ebp + 8]
push eax
push 4
push 0x4777f8
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp + 8], 4
je 0x403436
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp + 8]
cmp eax, 0xffffffff
jne 0x40343b
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret 8
mov eax, 4
pop edi
add eax, esi
pop esi
pop ebp
ret 8
Function at 0x403c30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
xor ecx, ecx
lea eax, [esi + 0xc]
push edi
mov dword [ebp + 8], ecx
mov dword [esi], eax
mov dword [esi + 4], 0
mov dword [esi + 8], 1
mov word [eax], cx
lea eax, [ebp + 8]
push eax
mov eax, dword [ebx + 4]
push ecx
push ecx
push ecx
push dword [ebx]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x403cc8
mov eax, dword [ebp + 8]
xor ecx, ecx
shr eax, 1
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042cd58
mov edi, eax
add esp, 4
test edi, edi
je 0x403cce
lea eax, [ebp + 8]
push eax
mov eax, dword [ebx + 4]
push edi
push 0
push 0
push dword [ebx]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x403cc8
push edi
mov ecx, esi
call fcn.0040b360
push 2
push edi
call fcn.0042cd4a
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4045d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push edi
lea edi, [edx + 2]
nop word [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4045e0
sub edx, edi
sar edx, 1
lea eax, [edx*2 + 2]
push eax
push dword [ebp + 0xc]
mov eax, dword [ecx + 4]
push 2
push 0
push dword [ecx]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
test eax, eax
je 0x40463e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
test ecx, ecx
je 0x404630
jle 0x404635
mov eax, dword [ebp + 8]
movzx ecx, cx
or ecx, 0x80070000
mov dword [eax], ecx
pop ebp
ret 8
mov ecx, 0x8007054f
mov eax, dword [ebp + 8]
mov dword [eax], ecx
pop ebp
ret 8
mov eax, dword [ebp + 8]
mov dword [eax], 0
pop ebp
ret 8