joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44c8ef
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.00446212
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x44c92b
call fcn.0044cb40
mov dword [esi + 0xc], 1
jmp 0x44c930
call fcn.0044cb40
cmp dword [esi], 0
je 0x44c979
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x44c953
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.0043e9ba
jmp 0x44c964
push 0xff
mov ecx, esi
call fcn.00404164
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.00434772
jmp 0x44c99d
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x44c99d
push dword [esi]
push dword [ebp - 4]
call fcn.00458b6f
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x44ca95
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.0044cb40
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x44cadd
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0043e9ba
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00434772
jmp 0x44cae8
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.00458b6f
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x44ed0b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
je 0x44ed25
mov edi, dword [esi + 0xc]
jmp 0x44ed65
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov edi, eax
test edi, edi
jne 0x44ed3e
call fcn.0044b0b1
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov edi, eax
test edi, edi
jne 0x44ed53
call fcn.0044b0b1
push edi
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov edi, eax
test edi, edi
jne 0x44ed65
call fcn.0044b0b1
call fcn.0044d57e
cmp dword [eax + 0x3c], 0
je 0x44ed7a
push edi
mov ecx, ebx
call fcn.0044e444
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.0044ef57
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x44eda3
push ecx
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x44edaf
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x451441
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
mov eax, ecx
push edi
mov edi, esi
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], esi
je 0x45148b
call fcn.0044d57e
push 0xf0
push dword [ebp + 0xc]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
test eax, eax
je 0x451488
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov edi, eax
test edi, edi
je 0x4514d9
push edi
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov esi, eax
mov eax, dword [ebp - 4]
xor ebx, ebx
inc ebx
test esi, esi
je 0x4514b7
mov ecx, dword [eax]
push dword [ebp + 0x10]
push esi
mov esi, dword [ecx + 0x20]
mov ecx, esi
push dword [ebp + 8]
call fcn.005813a9
mov ecx, dword [ebp - 4]
call esi
mov ebx, eax
test edi, edi
je 0x4514b7
push edi
call dword [sym.imp.KERNEL32.DLL_FreeResource]
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x70]
test edi, edi
je 0x4514d7
mov eax, dword [edi]
push dword [ebp + 0x10]
mov esi, dword [eax + 0xa0]
mov ecx, esi
call fcn.005813a9
mov ecx, edi
call esi
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x452425
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x5a4594
call fcn.005813e6
mov eax, ecx
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp + 0x10]
xor edi, edi
mov ecx, dword [ebp + 0x14]
push edi
mov dword [ebx], edi
mov dword [ecx], edi
cmp dword [eax + 0x58], edi
je 0x4524cf
push dword [ebp + 8]
mov ecx, eax
call fcn.0045275d
mov esi, eax
test esi, esi
je 0x452562
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0x14]
mov dword [ebp - 4], edi
push eax
push edi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], edi
push eax
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x14], edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
test eax, eax
jne 0x4524b8
push edx
call fcn.0043defb
pop ecx
lea ecx, [ebp - 0x14]
mov dword [ebx], eax
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4524b8
xor edi, edi
inc edi
jmp 0x4524c2
push dword [ebx]
call fcn.0043def6
pop ecx
mov dword [ebx], edi
lea ecx, [ebp - 0x24]
call fcn.004522ea
jmp 0x452560
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov esi, dword [esi + 0x84]
mov ecx, esi
push eax
call fcn.005813a9
mov ecx, dword [ebp - 0x18]
call esi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 1
mov esi, dword [eax - 0xc]
mov dword [ebp - 0x18], esi
test esi, esi
je 0x452558
mov ecx, dword [ebp + 0x14]
mov eax, esi
shr eax, 1
push eax
mov dword [ecx], eax
call fcn.0043defb
mov dword [ebx], eax
pop ecx
test esi, esi
jle 0x452552
mov esi, dword [ebp + 0x10]
lea eax, [edi + 1]
push eax
lea ecx, [ebp - 0x10]
call fcn.00406988
push edi
lea ecx, [ebp - 0x10]
lea ebx, [eax - 1]
shl bl, 4
sub bl, 0x41
call fcn.00406988
add al, bl
mov edx, edi
test edx, edx
jns 0x452543
add edx, 1
sar edx, 1
mov ecx, dword [esi]
add edi, 2
mov byte [edx + ecx], al
cmp edi, dword [ebp - 0x18]
jl 0x45251a
mov eax, dword [ebp - 0x10]
xor edi, edi
inc edi
lea ecx, [eax - 0x10]
call fcn.00404048
mov eax, edi
call fcn.005813af
ret 0x10

Function at 0x45256a
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x4525bd
push esi
push dword [ebp + 8]
call fcn.0045275d
mov edi, eax
test edi, edi
jne 0x45258d
mov eax, dword [ebp + 0x10]
jmp 0x4525cf
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x452588
mov eax, dword [ebp - 8]
jmp 0x4525cf
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4b2eb8
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.00558afb
call fcn.0044d5d2
cmp dword [eax + 0x14], 0
jne 0x4b2ed3
mov ecx, esi
pop esi
jmp fcn.004b2203
pop esi
ret

Function at 0x4ba0e4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
test esi, esi
jne 0x4ba0fd
call fcn.0044d57e
mov esi, dword [eax + 0xc]
push 0x5ef3b0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x4ba153
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov edi, eax
test edi, edi
je 0x4ba152
push edi
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x4ba133
xor esi, esi
jmp 0x4ba149
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov ecx, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.004ba15b
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.DLL_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4ffbd0
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.00403759
call fcn.0044d5d2
cmp dword [eax + 0x14], 0
jne 0x4ffbeb
mov ecx, esi
pop esi
jmp fcn.004ff44e
pop esi
ret

Function at 0x59c2f5
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0059bfb5

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x42f77b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x481020
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x40
cmp dword [0x4a4910], 1
jge 0x48108f
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x481065
mov edx, dword [ebx + 8]
movzx eax, word [edx]
movzx ecx, word [ebx + 0xc]
cmp eax, ecx
je 0x481065
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x481042
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x48107b
mov eax, dword [ebx + 8]
mov dword [ebp - 4], eax
jmp 0x481082
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
jmp 0x48118d
movzx ecx, word [ebx + 0xc]
movd xmm0, ecx
movdqa xmmword [ebp - 0x30], xmm0
pshuflw xmm0, xmmword [ebp - 0x30], 0
movdqa xmmword [ebp - 0x30], xmm0
pshufd xmm0, xmmword [ebp - 0x30], 0
movdqa xmmword [ebp - 0x30], xmm0
mov edx, dword [ebx + 8]
and edx, 0xfff
cmp edx, 0xff0
ja 0x48115e
mov eax, dword [ebx + 8]
movdqu xmm0, xmmword [eax]
movdqa xmmword [ebp - 0x40], xmm0
movdqa xmm0, xmmword [ebp - 0x20]
pxor xmm0, xmmword [ebp - 0x20]
movdqa xmmword [ebp - 0x20], xmm0
movdqa xmm0, xmmword [ebp - 0x20]
pcmpeqw xmm0, xmmword [ebp - 0x40]
movdqa xmmword [ebp - 0x20], xmm0
movdqa xmm0, xmmword [ebp - 0x40]
pcmpeqw xmm0, xmmword [ebp - 0x30]
movdqa xmmword [ebp - 0x40], xmm0
movdqa xmm0, xmmword [ebp - 0x20]
por xmm0, xmmword [ebp - 0x40]
movdqa xmmword [ebp - 0x20], xmm0
movdqa xmm0, xmmword [ebp - 0x20]
pmovmskb ecx, xmm0
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x481153
bsf edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebx + 8]
mov dword [ebx + 8], eax
mov ecx, dword [ebx + 8]
movzx edx, word [ecx]
movzx eax, word [ebx + 0xc]
cmp edx, eax
jne 0x481147
mov ecx, dword [ebx + 8]
mov dword [ebp - 0xc], ecx
jmp 0x48114e
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
jmp 0x48118d
mov edx, dword [ebx + 8]
add edx, 0x10
mov dword [ebx + 8], edx
jmp 0x481188
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x481171
mov eax, dword [ebx + 8]
jmp 0x48118d
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x48117f
xor eax, eax
jmp 0x48118d
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x4810b2
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x8c213b
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x8c1ea3
sub esp, 4
mov dword [esp], 0xa750c27e
pop eax
sub edi, 1
sub eax, 0x49d7cece
call fcn.008c2198
or eax, edi
add edi, 0xa6c51ba0
dec edi
xor dword [edx], ebx
add eax, edi
push 0x3d42646d
mov eax, dword [esp]
add esp, 4
inc edx
push 0x98d74754
pop eax
sub edi, 0xee798827
add edi, 0x911d4407
cmp edx, ecx
jne fcn.008c213b
add eax, edi
or edi, eax
and eax, edi
ret
Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..pdata
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x4f290639
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..pdata_1
nop
nop
mov ebx, 0x42e3d0
mov ecx, 0x15030ffe
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4056c0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40895c]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40895c]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40895c]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40895c]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x40c1a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x9000]
push edi
or ebp, 0xffffffff
jmp 0x40c1c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40c1c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40c1b8
mov eax, 1
add ebx, ebx
jne 0x40c1db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40c1d0
jne 0x40c1ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c1d0
xor ecx, ecx
sub eax, 3
jb 0x40c200
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40c272
mov ebp, eax
add ebx, ebx
jne 0x40c20b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40c218
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40c23c
inc ecx
add ebx, ebx
jne 0x40c228
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40c21d
jne 0x40c239
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c21d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40c25c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40c24d
jmp 0x40c1be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40c25c
add edi, ecx
jmp 0x40c1be
pop esi
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x40c2bb
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xcc04]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xcc54]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40c279
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xcc5c]
or eax, eax
je 0x40c2b5
mov dword [ebx], eax
add ebx, 4
jmp 0x40c296
call dword [esi + 0xcc58]
mov ebp, dword [esi + 0xcc60]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40c2ef
sub esp, 0xffffff80
jmp 0x407000
Function at 0x44a380
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ebx
push esi
push edi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push str.GetFirmwareEnvironmentVariableA
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
je 0x44a3c9
mov ecx, dword [0x4d09f4]
push 0x4d06fc
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
test ebx, ebx
je 0x44a3ef
push 0
push 0
push str.154CDFAF_2381_4cad_AB99_138517127D5C
push 0x4d13d4
call ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
dec eax
pop edi
neg eax
sbb eax, eax
pop esi
neg eax
pop ebx
pop ecx
ret
pop edi
mov al, bl
pop esi
pop ebx
pop ecx
ret

Function at 0x46b973
Capabilities:
Encode data using xor

Disassembly:
dec esi
sub dword [eax - 0x7fab5315], ebp
push esp
invalid

Function at 0x4c598e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4cd5a8
cmp edx, dword [eax]
je 0x4c59b0
add eax, 8
inc ecx
cmp eax, 0x4cd638
jl 0x4c59a1
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4cd5a8]
jne 0x4c5ade
mov eax, dword [0x4d1c80]
cmp eax, 1
je 0x4c5ab8
test eax, eax
jne 0x4c59e1
cmp dword [0x4cd4ec], 1
je 0x4c5ab8
cmp edx, 0xfc
je 0x4c5ade
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4c5a18
lea eax, [ebp - 0x1a4]
push 0x4c9b84
push eax
call fcn.004c60a0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004c62d0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4c5a5b
lea eax, [ebp - 0x1a4]
push eax
call fcn.004c62d0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c9b80
push edi
call fcn.004c7aa0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4c9b64
push eax
call fcn.004c60a0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004c60b0
lea eax, [ebp - 0xa0]
push 0x4c9b60
push eax
call fcn.004c60b0
push dword [esi + 0x4cd5ac]
lea eax, [ebp - 0xa0]
push eax
call fcn.004c60b0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4c9b38
push eax
call fcn.004c7a14
add esp, 0x2c
pop edi
jmp 0x4c5ade
lea eax, [ebp + 8]
lea esi, [esi + 0x4cd5ac]
push 0
push eax
push dword [esi]
call fcn.004c62d0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401123
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [esp + 0x14]
lea eax, [esp + 0x18]
mov edi, ecx
push eax
call fcn.0040117e
xor ebp, ebp
pop ecx
pop ecx
mov ebx, dword [eax]
mov dword [eax], ebp
cmp dword [esp + 0x14], ebp
je 0x401152
push 4
push dword [esp + 0x18]
call fcn.004021ef
pop ecx
pop ecx
lea esi, [edi + 4]
push esi
push ebp
push ebx
push 0x401107
push ebp
push ebp
call fcn.004073c7
add esp, 0x18
mov dword [edi], eax
test eax, eax
je 0x401174
pop edi
pop esi
pop ebp
pop ebx
ret 4
push 6
mov dword [esi], ebp
call fcn.00401f1c
int3

Function at 0x40157f
Capabilities:
Encode data using xor

Disassembly:
push ebp
xor ebp, ebp
push esi
mov esi, ebp
cmp dword [esp + 0x10], esi
jbe 0x4016ad
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_InitializeAcl]
push edi
mov edi, dword [esp + 0x14]
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0xda
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x98
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xc8
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0xea
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x97
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x10
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0xc2
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x58
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x47
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 5
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xb7
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x57
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x6d
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0xee
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x80
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xf1
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x66
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x8d
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x31
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x8b
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xe7
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x9d
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xb4
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xc2
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x9d
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x99
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x4a
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xbf
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xcd
inc esi
cmp esi, dword [esp + 0x18]
jb 0x40159b
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x805f80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push eax
push 0x40
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp + 0xc]
add esp, 0x10
test eax, eax
jne 0x805fa3
mov eax, 1
jmp 0x8060ae
mov edx, dword [ebp + 8]
movzx eax, word [edx]
cmp eax, 0x5a4d
jne 0x805fb9
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x3c], 0
jne 0x805fc3
mov eax, 2
jmp 0x8060ae
mov edx, dword [ebp + 0x10]
push edx
push 0xf8
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x40
push edx
call dword [ebp + 0xc]
add esp, 0x10
test eax, eax
jne 0x805fee
mov eax, 1
jmp 0x8060ae
mov eax, dword [ebp + 8]
cmp dword [eax + 0x40], 0x4550
jne 0x806014
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + 0x58]
cmp edx, 0x10b
jne 0x806014
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0x46]
test ecx, ecx
jne 0x80601e
mov eax, 2
jmp 0x8060ae
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0x46]
imul eax, eax, 0x28
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x140], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x140]
push eax
call fcn.00812080
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x138], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 0x138], 0
jne 0x80605f
mov eax, 3
jmp 0x8060ae
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0x54]
lea ecx, [ecx + eax + 0x18]
mov edx, dword [ebp + 8]
mov dword [edx + 0x13c], ecx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x140]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x13c]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
push eax
call dword [ebp + 0xc]
add esp, 0x10
test eax, eax
jne 0x8060ac
mov eax, 1
jmp 0x8060ae
xor eax, eax
pop ebp
ret

Function at 0x806a40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
je 0x806a56
xor eax, eax
jmp 0x806a96
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x3c]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0x4550
jne 0x806a7b
mov edx, dword [ebp - 4]
movzx eax, word [edx + 0x18]
cmp eax, 0x10b
je 0x806a7f
xor eax, eax
jmp 0x806a96
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x78]
push ecx
call fcn.00806aa0
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x812c70
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret