joyce8/EMBER2024-capa huggingface dataset:
Function at 0xcdfd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xcdfd58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xcdfd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xcdfd94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xcdfd94
push eax
push esi
call fcn.00ce220b
add esp, 8
pop esi
ret 0x10

Function at 0xcdfda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xcdfe22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xcdfe15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xcf8320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00ce1dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xcdfdda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xcdfe30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xcdfec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xcdfeb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xcf8320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00ce1dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xcdfeab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xcdfe6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xce0000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xce0131
push esi
call fcn.00ce3145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00cd2080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xce0131
push 0
push ebp
call fcn.00cd23a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00cd2260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xce008b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00cd22f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xce0121
push 0xcf8918
push edi
call fcn.00ce13f0
push eax
push ebx
push esi
call fcn.00cdff60
push 0xcf88f8
push edi
call fcn.00ce13f0
push eax
push ebx
push esi
call fcn.00cdff60
push 0xcf88d8
push edi
call fcn.00ce13f0
push eax
push ebx
push esi
call fcn.00cdff60
push 0xcf88c0
push edi
call fcn.00ce13f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00cdff60
push 0xcf88a0
push edi
call fcn.00ce13f0
push eax
push ebx
push esi
call fcn.00cdff60
push 0xcf8888
push edi
call fcn.00ce13f0
push eax
push ebx
push esi
call fcn.00cdff60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xce11b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00ce1140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00ce1140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00ce1140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00ce1140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xce1bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xce1c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xcf387c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xce1c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xce1c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x407df4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x7b6008], 0x8088405
inc edx
mov dword [ebx + 0x7b6008], edx
mul edx
mov eax, edx
pop ebx
ret
Function at 0x4207f8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x420851
test eax, edx
je 0x420854
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x42080f
movzx eax, word [eax]
sub eax, ecx
jmp 0x420836
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x420837
add ecx, 4
js 0x420827
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x420834
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x420836
xor eax, eax
ret
test eax, eax
je 0x420860
test edx, edx
jne 0x420800
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x4295b8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.0040acdc
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040fd70
mov edi, eax
cmp edi, 0x104
jbe 0x429563
mov eax, edi
add eax, eax
call fcn.00407a0c
mov esi, eax
jmp 0x429565
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040fd70
push esi
call fcn.00412e84
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x42959e
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x429588
mov eax, esp
cmp esi, eax
je 0x4295ab
mov eax, esi
call fcn.00407a28
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x4295e4
cmp bl, 0
je 0x4295e0
cmp bl, 0x41
jl 0x4295db
cmp bl, 0x5a
jg 0x4295db
or bl, 0x20
xor al, bl
inc esi
jmp 0x4295bf
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x429524
Function at 0x714e14
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x714e1c
mov eax, edx
pop esi
pop ebx
ret
Function at 0x7a1bea
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi + 0x30], eax
xor edx, edx
mov dword [esi + 0x4c], edx
xor ecx, ecx
mov dword [esi + 0x20], ecx
push esi
call fcn.007a1bc8
pop ecx
xor ecx, ecx
mov eax, ecx
xor edx, edx
mov ebx, eax
shr ebx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor ebx, eax
mov eax, ebx
inc edx
cmp edx, 8
jl 0x7a1c0e
mov dword [esi + ecx*4 + 0x70], eax
inc ecx
cmp ecx, 0x100
jb 0x7a1c0a
pop esi
pop ebx
pop ebp
ret

Function at 0x7a47bb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
mov esi, pe_nt_image_headers32
or ebx, 0x100
add edi, edi
mov eax, ebx
shr eax, 7
and eax, 1
push eax
mov edx, esi
and edx, edi
add edx, esi
mov ecx, ebx
shr ecx, 8
add edx, ecx
shl edx, 2
add edx, dword [ebp + 0xc]
push edx
push dword [ebp + 8]
call fcn.007a4729
add esp, 0xc
add ebx, ebx
mov ecx, ebx
xor ecx, edi
not ecx
and esi, ecx
cmp ebx, 0x10000
jb 0x7a47d2
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x7a487b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 0xc]
xor edx, edx
or eax, 0x100
mov ecx, eax
shr ecx, 8
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx + ecx*4]
mov ebx, eax
shr ebx, 7
and ebx, 1
neg ebx
and ebx, 0x7ff
xor ecx, ebx
shr ecx, 4
mov ebx, dword [ebp + 0x10]
add edx, dword [ebx + ecx*4]
add eax, eax
cmp eax, 0x10000
jb 0x7a4889
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x7a48bd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov edx, pe_nt_image_headers32
or eax, 0x100
add ecx, ecx
mov esi, edx
and esi, ecx
add esi, edx
mov edi, eax
shr edi, 8
add esi, edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + esi*4]
mov edi, eax
shr edi, 7
and edi, 1
neg edi
and edi, 0x7ff
xor esi, edi
shr esi, 4
mov edi, dword [ebp + 0x14]
add ebx, dword [edi + esi*4]
add eax, eax
mov esi, eax
xor esi, ecx
not esi
and edx, esi
cmp eax, 0x10000
jb 0x7a48d5
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x7a499f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
xor edx, edx
mov ecx, dword [ebp + 0xc]
mov edi, 1
shl edi, cl
or eax, edi
cmp eax, 1
je 0x7a49e4
mov ecx, eax
shr ecx, 1
mov ecx, dword [ebx + ecx*4]
mov edi, eax
and edi, 1
neg edi
and edi, 0x7ff
xor ecx, edi
shr ecx, 4
add edx, dword [esi + ecx*4]
shr eax, 1
cmp eax, 1
jne 0x7a49c1
mov eax, edx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x7a49eb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
xor eax, eax
mov dword [ebp - 4], eax
mov eax, 1
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x7a4a36
mov edx, ebx
and edx, 1
shr ebx, 1
mov esi, dword [ebp + 8]
mov esi, dword [esi + eax*4]
mov edi, edx
neg edi
and edi, 0x7ff
xor esi, edi
shr esi, 4
mov edi, dword [ebp + 0x14]
mov esi, dword [edi + esi*4]
add dword [ebp - 4], esi
add eax, eax
or edx, eax
mov eax, edx
dec ecx
test ecx, ecx
jne 0x7a4a06
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x7aa958
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
xor edx, edx
add edx, 0x18
add eax, edx
mov edx, dword [ebp - 0x2c]
movzx edx, word [edx + 0x14]
add eax, edx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
movzx eax, word [eax + 6]
dec eax
test eax, eax
jl 0x7aaa8b
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0x10], 0
jne 0x7aaa17
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jle 0x7aaa11
push 4
push 0x1000
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0xc]
add eax, dword [ebp - 0x1c]
push eax
call fcn.006c0a6c
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x7aa9ef
mov byte [ebp - 0xd], 0
jmp 0x7aaa8f
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0xc]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
mov dword [eax + 8], edx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
call fcn.00408354
add dword [ebp - 0x24], 0x28
jmp 0x7aaa7f
push 4
push 0x1000
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0xc]
add eax, dword [ebp - 0x1c]
push eax
call fcn.006c0a6c
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x7aaa43
mov byte [ebp - 0xd], 0
jmp 0x7aaa8f
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0xc]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x14]
add eax, dword [ebp - 4]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
call fcn.00407bb0
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
mov dword [eax + 8], edx
add dword [ebp - 0x24], 0x28
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jne 0x7aa9ab
mov byte [ebp - 0xd], 1
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret
Function at 0x7ad918
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x7ace59
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00407dcc
mov eax, dword [0x7bd6bc]
inc dword [eax]
mov eax, 3
call fcn.00407df4
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x7ad966
mov eax, dword [0x7bd54c]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x28], 1
jne 0x7ad976
mov eax, dword [0x7bd540]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x28], 2
jne 0x7ad986
mov eax, dword [0x7bd6a0]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x78], 0
je 0x7ada4f
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x78]
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
call fcn.00407dcc
mov eax, dword [0x7bd6bc]
inc dword [eax]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x34], eax
fild qword [ebp - 0x38]
fdiv dword [0x7ace88]
call fcn.00408254
call fcn.00407df4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x20]
add eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x14]
mov eax, dword [eax + edx*4]
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x24]
add eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x14]
movzx eax, word [eax + edx*2]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x1c]
add eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x24]
mov eax, dword [eax + edx*4]
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x10], eax
cmp byte [ebp - 1], 0
jne 0x7ada4f
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 4]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
call fcn.00407bb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7ada68
cmp dword [ebp - 0x10], 0
jne 0x7ada7d
mov eax, 0x64
call fcn.007ac9c4
jmp 0x7ad92f
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407e55
Capabilities:
Encode data using xor

Disassembly:
call 0x407d44
sub ecx, ecx
sub cx, 0xff76
call 0x407e55
rcr byte [esi - 0x7f], 0x76
push cs
inc ebp
nop
sti
jp 0x407de3
xor dword [esi + 0xe], 0x7afb9045
sub esi, 0xfffffffc
out dx, al
cld
loop 0x407e58
mov ecx, 0x3d82352b
das
adc byte [esi + 0x1b], dh
invalid
Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40601c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x406028
push 0x406024
push 0x406020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x406028]
push dword [0x406024]
push dword [0x406020]
mov dword [0x406014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x40129c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x84], 0
call fcn.00401994
mov esi, eax
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov eax, esi
or al, 0x40
push eax
lea eax, [0x4044a5]
lea edx, [fcn.00401a04]
sub eax, edx
push eax
push fcn.00401a04
call sub.KERNEL32.dll_VirtualProtect
cmp dword [ebp - 4], 0
je 0x401337
push esi
call fcn.0040188f
lea eax, [ebp - 0x84]
push eax
push esi
call fcn.004018dd
mov eax, esi
add eax, 0x1cc00
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x84]
push eax
mov edi, dword [ebp - 0x88]
mov eax, esi
mov ecx, edi
or cl, 1
cdq
idiv ecx
mov ebx, eax
add ebx, edi
push ebx
lea edi, [0x4060e4]
mov ebx, esi
dec ebx
and edi, ebx
push edi
call fcn.00401a04
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401994
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push edi
and dword [ebp - 0x118], 0
xor edi, edi
mov dword [ebp - 0x114], 0xa
mov byte [ebp - 0x104], 0
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x10e]
push eax
push 1
push 1
lea eax, [ebp - 0x104]
push eax
call sub.CRYPT32.DLL_CryptBinaryToStringA
call sub.KERNEL32.dll_GetLastError
push 0
push 0
call sub.SHLWAPI.DLL_PathAppendA
movsx edi, byte [ebp - 0x10e]
sub edi, 0x41
mov eax, edi
pop edi
leave
ret

Function at 0x450012
Capabilities:
Encode data using xor

Disassembly:
push dword fs:[0]
mov dword fs:[0], esp
xor ebx, ebx
push ebx
push ebx
push 0x80000000
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [0x44ff28]
sub edi, edi
sub ecx, ecx
mov cl, 0xe5
inc edi
loop 0x45003a
call 0x450042
pop esi
sub esi, 0xffffffc2
push esi
sub ebx, ebx
or ebx, 0x2394
mov al, byte [esi]
xor ax, di
xchg byte [esi], al
inc esi
sub ebx, 1
cmp ebx, 0
ja 0x450052
pop esi
mov esp, dword fs:[0]
pop dword fs:[0]
pop edi
pop ebp
jmp esi
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x40d058], 1
mov dword [0x40d054], 1
mov dword [0x40d050], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x40d00c], eax
mov eax, dword [0x40d064]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x40d078]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x40d060]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x408b70], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056
Function at 0x401800
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x401860
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x40d06c]
test esi, esi
jle 0x401980
mov eax, dword [0x40d070]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x401894
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401917
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401880
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x4019a7
mov eax, dword [0x40d070]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x40d070]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401987
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401910
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x401920
add dword [0x40d06c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x40d070]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401910
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x40189e
mov eax, dword [0x40d070]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop