joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423630
Capabilities:
Query remote server for available data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
push 0
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
mov eax, dword [ebx + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
mov edi, eax
test edi, edi
jne 0x42366a
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x423682
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, esi
jb 0x423678
sub eax, esi
jmp 0x42367b
sub eax, esi
dec eax
cmp eax, 0x1388
ja 0x42368f
cmp dword [ebx + 0x8c], 0
jne 0x42368f
test edi, edi
je 0x423641
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4269c0
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x84], 0
lea esi, [edi + 0x80]
mov ebx, dword [edi + 0x90]
ja 0x4269f0
push ebx
mov ecx, esi
call fcn.0042d100
test al, al
je 0x426ac9
push dword [esi + 4]
mov dword [ebp - 4], 0
push 0
push dword [esi + 8]
call fcn.004640b0
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [esi + 4]
mov eax, dword [edi + 0x10]
push dword [esi + 8]
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x426ac9
push dword [ebp - 4]
mov ecx, dword [ebp + 8]
push dword [esi + 8]
call fcn.00409590
push ebx
push 0
push dword [esi + 8]
call fcn.004640b0
mov eax, dword [edi + 0x40]
add esp, 0xc
cmp dword [eax - 0xc], 0
jne 0x426abd
push ebx
push 0
push dword [esi + 8]
call fcn.004640b0
add esp, 0xc
lea eax, [ebx - 1]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push 0
push eax
push dword [esi + 8]
mov eax, dword [edi + 0x10]
push 0x16
push eax
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x426ac9
push dword [esi + 8]
lea esi, [edi + 0x40]
mov ecx, esi
call fcn.00408bd0
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 0x78]
push esi
push eax
call fcn.0042a6f0
mov eax, dword [edi + 0x78]
mov eax, dword [eax + 8]
cmp eax, 0x12d
je 0x426aaa
cmp eax, 0x12e
je 0x426aaa
cmp eax, 0x12f
jne 0x426abd
mov ecx, dword [ebp + 8]
call fcn.00413990
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x426ae0
Capabilities:
Query remote server for available data
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x490108
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x4c7084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
nop dword [eax]
push 0
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
mov eax, dword [edi + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
mov ebx, eax
test ebx, ebx
jne 0x426b49
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x426b61
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, esi
jb 0x426b57
sub eax, esi
jmp 0x426b5a
sub eax, esi
dec eax
cmp eax, 0x1388
ja 0x426b6e
cmp dword [edi + 0x8c], 0
jne 0x426b6e
test ebx, ebx
je 0x426b20
cmp dword [edi + 0x70], 0
je 0x426b8d
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 0x28], vtable.pcutil::CAutoBuffer.0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push 0x19000
call fcn.0042d100
test al, al
je 0x426caf
mov esi, dword [ebp - 0x20]
push 0x19000
push 0
push esi
call fcn.004640b0
add esp, 0xc
mov dword [ebp - 0x14], 0
lea ecx, [edi + 0x28]
call fcn.004015a0
mov byte [ebp - 0xd], 0
cmp dword [eax + 0x14], 0x10
mov dword [eax + 0x10], 0
jb 0x426bf3
mov eax, dword [eax]
lea ecx, [ebp - 0xd]
push ecx
push eax
call fcn.00402090
add esp, 8
cmp dword [edi + 0x98], 0
jne 0x426c5d
mov eax, esi
mov dword [ebp - 0x18], eax
nop
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push ecx
push 0x19000
push eax
mov eax, dword [edi + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
mov esi, dword [ebp - 0x20]
mov ebx, eax
test ebx, ebx
je 0x426c40
push dword [ebp - 0x14]
lea ecx, [edi + 0x28]
push esi
call fcn.00409590
push 0x19000
push 0
push esi
call fcn.004640b0
add esp, 0xc
test ebx, ebx
je 0x426cb2
cmp dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x18]
ja 0x426c10
push 0x19000
push 0
push esi
call fcn.004640b0
add esp, 0xc
mov dword [ebp - 0x1c], 0x18fff
lea eax, [ebp - 0x1c]
push 0
push eax
mov eax, dword [edi + 0x10]
push esi
push 0x16
push eax
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x426caf
push dword [ebp - 0x20]
lea esi, [edi + 0x40]
mov ecx, esi
call fcn.00408bd0
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 0x78]
push esi
push eax
call fcn.0042a6f0
mov esi, dword [ebp - 0x20]
mov edi, 1
jmp 0x426cb4
mov esi, dword [ebp - 0x20]
xor edi, edi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x28], vtable.pcutil::CAutoBuffer.0
mov dword [ebp - 0x24], 0
test esi, esi
je 0x426cd6
push esi
call fcn.0044bc91
add esp, 4
mov dword [ebp - 0x20], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42edb0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x491a17
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4c7084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
call fcn.00408930
mov dword [ebp - 4], 0
lea ecx, [edi + 0x18]
call fcn.00408930
mov byte [ebp - 4], 1
lea ecx, [edi + 0x30]
call fcn.00408930
mov byte [ebp - 4], 2
lea ecx, [edi + 0x48]
call fcn.00408930
mov dword [ebp - 4], 4
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov byte [ebp - 4], 5
lea esi, [edi + 0x6c]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00431840
mov dword [esi], eax
mov byte [ebp - 4], 8
lea esi, [edi + 0x74]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004217f0
mov dword [esi], eax
mov byte [ebp - 4], 0xb
lea esi, [edi + 0x7c]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00431950
mov dword [esi], eax
mov byte [ebp - 4], 0xe
lea ecx, [edi + 0x84]
call fcn.00408930
mov byte [ebp - 4], 0xf
lea ecx, [edi + 0x9c]
call fcn.00408930
mov byte [ebp - 4], 0x10
lea eax, [edi + 0xb4]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42f390
Capabilities:
Delete file
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x491c3f
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x4c7084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x18]
call fcn.00412c30
mov dword [ebp - 4], 0
mov edx, eax
push str.cfg.dll
lea ecx, [ebp - 0x14]
call fcn.004089d0
add esp, 4
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00408c20
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x42f418
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
jmp 0x42f4e2
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov dword [ebp - 0x1c], edi
lea ecx, [edi + 1]
push ecx
call fcn.0044bc96
add esp, 4
mov esi, eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x18], esi
push 0
push eax
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x42f458
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
jmp 0x42f4e2
push 0x70
mov byte [esi + edi], 0
call fcn.0044ba2e
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 3
mov ecx, eax
call fcn.0042c240
mov esi, eax
mov byte [ebp - 4], 2
lea ecx, [edi + edi]
push ecx
call fcn.0044bc96
add esp, 4
mov edi, eax
mov ecx, esi
push edi
push dword [ebp - 0x1c]
mov dword [edi], 0
mov edx, dword [esi]
push dword [ebp - 0x18]
call dword [edx + 8]
mov ecx, dword [ebp - 0x20]
push edi
call fcn.0042f6e0
push edi
mov byte [ebp - 0xd], al
call fcn.0044bc91
push dword [ebp - 0x18]
call fcn.0044bc91
add esp, 8
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, byte [ebp - 0xd]
test bl, bl
jne 0x42f4e2
mov eax, dword [ebp - 0x14]
cmp dword [eax - 4], 1
jle 0x42f4db
push dword [eax - 0xc]
lea ecx, [ebp - 0x14]
call fcn.004098d0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00408c20
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42f510
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x491c78
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4c7084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.c:config.xml
lea ecx, [ebp - 0x14]
call fcn.00408c40
mov dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.00408d00
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
cmp dword [eax - 4], 1
jle 0x42f575
push dword [eax - 0xc]
lea ecx, [ebp - 0x10]
call fcn.004098d0
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00408c20
test esi, esi
je 0x42f5e2
push ecx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], esp
xorps xmm0, xmm0
mov dword [ebp - 0x10], 0
mov ecx, esp
movlpd qword [ebp - 0x20], xmm0
push eax
lea esi, [ebp - 0x20]
lea ebx, [ebp - 0x10]
call fcn.00408d00
mov byte [ebp - 4], 2
mov byte [ebp - 4], 0
mov edx, esi
mov ecx, ebx
call fcn.004222b0
add esp, 4
test eax, eax
je 0x42f5e2
mov esi, dword [ebp - 0x10]
mov ecx, edi
push esi
call fcn.0042f6e0
push esi
mov bl, al
call fcn.0044bc91
add esp, 4
jmp 0x42f5e4
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00408c20
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42f610
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x10], ecx
xor bl, bl
push esi
mov byte [ebp - 1], bl
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
jne 0x42f639
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0x81
push str.CONFIG
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov dword [ebp - 8], eax
test eax, eax
je 0x42f6c0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0xc], ebx
test ebx, ebx
je 0x42f6bd
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x42f6bd
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 8], eax
test eax, eax
je 0x42f6bd
lea eax, [ebx + 1]
push eax
call fcn.0044bc96
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x42f6a8
mov eax, dword [ebp - 0xc]
push eax
push dword [ebp - 8]
push ebx
mov byte [eax + ebx], 0
call fcn.00464650
add esp, 0xc
mov ecx, dword [ebp - 0x10]
push ebx
call fcn.0042f6e0
push ebx
mov byte [ebp - 1], al
call fcn.0044bc91
add esp, 4
mov bl, byte [ebp - 1]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
je 0x42f6d2
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4404a0
Capabilities:
Continue service
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push 0xf003f
push 0
push 0
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test eax, eax
jne 0x4404c1
pop esi
mov esp, ebp
pop ebp
ret
push edi
push 0xf01ff
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x4404db
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [ebp - 0x1c]
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push eax
push edi
movups xmmword [ebp - 0x18], xmm0
movq qword [ebp - 8], xmm0
call ebx
mov eax, dword [ebp - 0x18]
and eax, 1
jne 0x44050a
test byte [ebp - 0x18], 7
je 0x440560
test eax, eax
je 0x44051b
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
jmp 0x440528
lea eax, [ebp - 0x1c]
push eax
push 3
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x440560
lea eax, [ebp - 0x1c]
mov esi, 0x1e
push eax
push edi
call ebx
test eax, eax
je 0x440560
nop dword [eax]
mov eax, esi
dec esi
test eax, eax
jle 0x440560
test byte [ebp - 0x18], 1
jne 0x440560
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x1c]
push eax
push edi
call ebx
test eax, eax
jne 0x440540
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebx
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x443580
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x495cb3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4c7084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi], vtable.TiXmlNode.0
mov dword [esi + 0x34], 0xf
mov dword [esi + 0x30], 0
cmp dword [esi + 0x34], 0x10
jb 0x4435df
mov eax, dword [esi + 0x20]
jmp 0x4435e2
lea eax, [esi + 0x20]
mov byte [eax], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 1
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [ebp - 4], 0
lea eax, [esi + 0x40]
mov dword [esi], vtable.TiXmlElement.0
lea ecx, [eax + 0x14]
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0xffffffff
mov dword [eax + 0xc], 0
mov dword [eax], vtable.TiXmlAttribute.0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 0x10
jb 0x443653
mov ecx, dword [ecx]
mov byte [ecx], 0
lea ecx, [eax + 0x2c]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 0x10
jb 0x44366f
mov ecx, dword [ecx]
mov byte [ecx], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x48], eax
mov dword [eax + 0x44], eax
mov edi, dword [ebp + 8]
mov byte [ebp - 4], 1
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
cmp byte [edi], 0
jne 0x44369d
xor ecx, ecx
jmp 0x4436ab
mov ecx, edi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4436a2
sub ecx, ebx
push ecx
push edi
lea ecx, [esi + 0x20]
call fcn.00409360
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x443dc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x495eb3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4c7084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi], vtable.TiXmlNode.0
mov dword [esi + 0x34], 0xf
mov dword [esi + 0x30], 0
cmp dword [esi + 0x34], 0x10
jb 0x443e1f
mov eax, dword [esi + 0x20]
jmp 0x443e22
lea eax, [esi + 0x20]
mov byte [eax], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [ebp - 4], 0
mov dword [esi], vtable.TiXmlDocument.0
mov dword [esi + 0x5c], 0xf
mov dword [esi + 0x58], 0
cmp dword [esi + 0x5c], 0x10
jb 0x443e75
mov eax, dword [esi + 0x48]
jmp 0x443e78
lea eax, [esi + 0x48]
mov byte [eax], 0
mov ebx, dword [ebp + 8]
mov byte [ebp - 4], 1
mov dword [esi + 0x68], 0xffffffff
mov dword [esi + 0x64], 0xffffffff
mov dword [esi + 0x60], 4
mov byte [esi + 0x6c], 0
cmp byte [ebx], 0
jne 0x443ea4
xor ecx, ecx
jmp 0x443eba
mov ecx, ebx
lea eax, [ecx + 1]
mov dword [ebp + 8], eax
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x443eb0
sub ecx, dword [ebp + 8]
push ecx
push ebx
lea ecx, [esi + 0x20]
call fcn.00409360
push 0
push 0x4a5cf6
lea ecx, [esi + 0x48]
mov byte [esi + 0x40], 0
mov dword [esi + 0x44], 0
call fcn.00409360
mov dword [esi + 0x68], 0
mov eax, esi
mov dword [esi + 0x64], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x444050
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
test ebx, ebx
jne 0x4440ac
cmp byte [esi + 0x40], bl
jne 0x4440a3
mov edx, dword [str.Failed_to_open_file]
mov byte [esi + 0x40], 1
mov dword [esi + 0x44], 2
cmp byte [edx], bl
jne 0x44407d
xor ecx, ecx
jmp 0x44408b
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x444082
sub ecx, edi
push ecx
push edx
lea ecx, [esi + 0x48]
call fcn.00409360
mov dword [esi + 0x68], 0xffffffff
mov dword [esi + 0x64], 0xffffffff
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 8
mov edi, dword [esi + 0x18]
test edi, edi
je 0x4440c2
mov ecx, edi
mov edi, dword [edi + 0x3c]
push 1
mov eax, dword [ecx]
call dword [eax]
test edi, edi
jne 0x4440b3
push 2
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
push 0
push ebx
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
call fcn.00470991
push ebx
call fcn.0047f375
push 0
mov edi, eax
push 0
push ebx
mov dword [ebp + 8], edi
call fcn.00470991
add esp, 0x1c
test edi, edi
jg 0x44413c
cmp byte [esi + 0x40], 0
jne 0x4440a3
mov edx, dword [str.Error_document_empty.]
mov byte [esi + 0x40], 1
mov dword [esi + 0x44], 0xc
cmp byte [edx], 0
je 0x444079
mov ecx, edx
lea edi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x444130
jmp 0x444089
lea eax, [edi + 1]
push eax
call fcn.0044bc96
push ebx
mov ebx, dword [ebp + 8]
mov edi, eax
push 1
push ebx
push edi
mov byte [edi], 0
call fcn.0046f821
add esp, 0x14
cmp eax, 1
je 0x44419d
push edi
call fcn.0044bc91
add esp, 4
cmp byte [esi + 0x40], 0
jne 0x4440a3
mov edx, dword [str.Failed_to_open_file]
mov byte [esi + 0x40], 1
mov dword [esi + 0x44], 2
cmp byte [edx], 0
je 0x444079
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x444191
jmp 0x444089
mov byte [edi + ebx], 0
mov eax, edi
cmp byte [edi], 0
mov ecx, edi
je 0x4441ce
nop word [eax + eax]
mov dl, byte [eax]
mov ebx, eax
cmp dl, 0xd
jne 0x4441c5
inc eax
mov byte [ecx], 0xa
cmp byte [eax], 0xa
cmovne eax, ebx
jmp 0x4441c7
mov byte [ecx], dl
inc eax
inc ecx
cmp byte [eax], 0
jne 0x4441b0
mov byte [ecx], 0
mov ecx, esi
mov eax, dword [esi]
push 1
push 0
push edi
call dword [eax + 8]
push edi
call fcn.0044bc91
add esp, 4
cmp byte [esi + 0x40], 0
sete al
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x44d12a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x47e948
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047e60b

Function at 0x47e953
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047e78c

Function at 0x4825c4
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00482284
Function at 0x4017c4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x404004]
jne 0x4017ce
repz ret
jmp fcn.00401b99

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e072
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x3abb5e91
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x42e060
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e0d2
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x1d874a6b
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e072
nop
nop
mov ebx, 0x407358
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x6cf736cd
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x42e060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x42e0d2
nop
nop
nop
nop
mov ebx, 0x42cdf0
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0xaa257c6
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219