joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10027d90
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
push eax
call fcn.1002a2e0
mov esi, dword [esp + 0x38]
mov ebx, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
xor ebp, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x10], ebp
test ebx, ebx
je 0x10027ee0
test ecx, ecx
je 0x10027ee0
inc ecx
push ecx
call fcn.10030e87
mov ebp, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov edx, ecx
mov esi, edi
mov edi, ebp
push ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.10030e60
mov edi, eax
add esp, 0xc
test edi, edi
je 0x10027e09
mov byte [edi], 0
inc edi
lea eax, [esp + 0x1c]
push eax
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10027ecd
push 0x400
mov dword [esp + 0x18], 0x400
mov dword [esp + 0x1c], 1
call fcn.10030e87
add esp, 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push esi
push edx
push 0
push edi
push eax
call ebx
test eax, eax
je 0x10027e91
cmp eax, 0xea
jne 0x10027eb9
push esi
call fcn.10030864
mov ecx, dword [esp + 0x18]
push ecx
call fcn.10030e87
mov ecx, dword [esp + 0x24]
add esp, 8
lea edx, [esp + 0x14]
mov esi, eax
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push 0
push edi
push ecx
call ebx
test eax, eax
jne 0x10027e5c
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x10027e9f
cmp eax, 2
jne 0x10027eb9
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
call fcn.1002a170
add esp, 8
mov dword [esp + 0x10], eax
push esi
call fcn.10030864
mov edx, dword [esp + 0x20]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.10030864
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
jne 0x10027f0e
mov ebp, eax
mov eax, dword [esp + 0x48]
test eax, eax
je 0x10027f1a
mov edx, dword [esp + 0x40]
test edx, edx
je 0x10027f1a
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
call fcn.1002a170
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x10027f40
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret
Function at 0x1002b318
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003a478
push 0x1002c7b4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_VirtualQuery]
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x38], ecx
cmp word [ecx], 0x5a4d
jne 0x1002b39e
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x3c], eax
cmp dword [eax], 0x4550
je 0x1002b376
xor al, al
or dword [ebp - 4], 0xffffffff
jmp 0x1002b3a4
mov edx, dword [eax + 0xd8]
lea esi, [edx + ecx]
cmp dword [ebp + 0xc], esi
jb 0x1002b36e
mov eax, dword [eax + 0xdc]
add eax, edx
add eax, ecx
cmp dword [ebp + 0xc], eax
jae 0x1002b36e
mov al, 1
jmp 0x1002b370
or dword [ebp - 4], 0xffffffff
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1002b403
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push esi
mov esi, dword [0x10045319]
test esi, esi
je 0x1002b427
lea eax, [esp + 4]
push eax
push 0x40
push 0x10000
push esi
call dword [sym.imp.kernel32.dll_VirtualProtect]
mov esi, dword [esi + 4]
jmp 0x1002b40b
pop esi
pop ecx
ret

Function at 0x1002b42a
Capabilities:
Resume thread

Disassembly:
push ecx
call dword [sym.imp.kernel32.dll_GetCurrentThreadId_1]
cmp dword [0x10045325], eax
je 0x1002b440
mov eax, 0x10dd
pop ecx
ret
push ebx
push esi
mov esi, dword [0x10045335]
xor ebx, ebx
cmp esi, ebx
push edi
je 0x1002b48d
lea eax, [esp + 0xc]
push eax
mov eax, dword [esi + 0x10]
push dword [esi + 0x14]
movzx eax, byte [eax + 0x17]
push eax
push dword [esi + 0xc]
call dword [sym.imp.kernel32.dll_VirtualProtect]
cmp dword [esi + 4], ebx
jne 0x1002b47e
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x1002b47e
push eax
call fcn.1002b4f4
pop ecx
mov dword [esi + 0x10], ebx
mov edi, dword [esi]
push esi
call fcn.1002c88c
cmp edi, ebx
pop ecx
mov esi, edi
jne 0x1002b44f
mov dword [0x10045335], ebx
call fcn.1002b4cd
mov esi, dword [0x10045331]
cmp esi, ebx
je 0x1002b4ba
push dword [esi + 4]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov edi, dword [esi]
push esi
call fcn.1002c88c
cmp edi, ebx
pop ecx
mov esi, edi
jne 0x1002b4a2
pop edi
mov dword [0x10045331], ebx
mov dword [0x10045325], ebx
pop esi
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x1002b777
Capabilities:
Suspend thread

Disassembly:
mov eax, dword [0x10045329]
push esi
test eax, eax
push edi
jne 0x1002b7e1
call dword [sym.imp.kernel32.dll_GetCurrentThread]
mov edi, dword [esp + 0xc]
cmp edi, eax
je 0x1002b7df
push 8
call fcn.1002c8f8
mov esi, eax
pop ecx
test esi, esi
jne 0x1002b7a3
push 8
pop edi
jmp 0x1002b7be
push edi
call dword [sym.imp.kernel32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x1002b7cf
call dword [sym.imp.kernel32.dll_GetLastError_1]
push esi
mov edi, eax
call fcn.1002c88c
pop ecx
and dword [0x1004532d], 0
mov dword [0x10045329], edi
mov eax, edi
jmp 0x1002b7e1
mov dword [esi + 4], edi
mov eax, dword [0x10045331]
mov dword [esi], eax
mov dword [0x10045331], esi
xor eax, eax
pop edi
pop esi
ret 4
Function at 0x1002ba9e
Capabilities:
Allocate or change rwx memory
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp esi, 0x7ff80000
mov ebx, 0x10000
jbe 0x1002bac2
lea eax, [esi - 0x7ff80000]
mov dword [ebp + 8], eax
jmp 0x1002bac5
mov dword [ebp + 8], ebx
cmp esi, 0x80000000
jae 0x1002bad8
lea eax, [esi + 0x7ff80000]
mov dword [ebp - 4], eax
jmp 0x1002badf
mov dword [ebp - 4], 0xfff80000
mov eax, dword [0x1004531d]
mov ecx, dword [0x10045319]
test eax, eax
jne 0x1002baf9
test ecx, ecx
je 0x1002bb0e
mov eax, ecx
mov dword [0x1004531d], eax
mov edx, dword [eax + 8]
test edx, edx
je 0x1002bb0e
cmp edx, dword [ebp + 8]
jb 0x1002bb0e
cmp edx, dword [ebp - 4]
jbe 0x1002bc67
mov eax, ecx
test ecx, ecx
mov dword [0x1004531d], eax
je 0x1002bb3e
test eax, eax
je 0x1002bb32
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x1002bb32
cmp ecx, dword [ebp + 8]
jb 0x1002bb32
cmp ecx, dword [ebp - 4]
jbe 0x1002bc67
mov eax, dword [eax + 4]
test eax, eax
mov dword [0x1004531d], eax
jne 0x1002bb1d
mov eax, esi
and eax, 0xffff
sub esi, eax
cmp esi, dword [ebp + 8]
mov edi, esi
jbe 0x1002bba6
cmp edi, 0x70000000
jb 0x1002bb63
cmp edi, 0x80000000
ja 0x1002bb63
mov edi, 0x6fff0000
lea eax, [ebp - 0x20]
push 0x1c
push eax
push edi
call dword [sym.imp.kernel32.dll_VirtualQuery]
test eax, eax
je 0x1002bba6
cmp dword [ebp - 0x10], ebx
jne 0x1002bb7e
cmp dword [ebp - 0x14], ebx
jae 0x1002bb8e
mov eax, dword [ebp - 0x1c]
lea edi, [eax - 0x10000]
cmp edi, dword [ebp + 8]
ja 0x1002bb4e
jmp 0x1002bba6
push 0x40
push 0x3000
push ebx
push edi
call dword [sym.imp.kernel32.dll_VirtualAlloc_1]
test eax, eax
mov dword [0x1004531d], eax
jne 0x1002bc1d
cmp esi, dword [ebp - 4]
jae 0x1002bc8e
cmp esi, 0x70000000
jb 0x1002bbc4
cmp esi, 0x80000000
ja 0x1002bbc4
mov esi, 0x80010000
lea eax, [ebp - 0x20]
push 0x1c
push eax
push esi
call dword [sym.imp.kernel32.dll_VirtualQuery]
test eax, eax
je 0x1002bc8e
cmp dword [ebp - 0x10], ebx
jne 0x1002bc12
cmp dword [ebp - 0x14], ebx
jb 0x1002bc12
mov ecx, esi
and ecx, 0xffff
je 0x1002bbfa
mov eax, ebx
sub eax, ecx
sub dword [ebp - 0x14], eax
add dword [ebp - 0x20], eax
mov esi, dword [ebp - 0x20]
push 0x40
push 0x3000
push ebx
push esi
call dword [sym.imp.kernel32.dll_VirtualAlloc_1]
test eax, eax
mov dword [0x1004531d], eax
jne 0x1002bc1d
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
lea esi, [eax + ecx]
jmp 0x1002bba6
mov dword [eax], 0x52727464
mov eax, dword [0x1004531d]
xor ecx, ecx
mov dword [eax + 8], ecx
mov eax, dword [0x1004531d]
mov edx, dword [0x10045319]
mov dword [eax + 4], edx
mov eax, dword [0x1004531d]
mov dword [0x10045319], eax
add eax, 0xffe0
mov edx, 0x7fd
mov dword [eax + 0x18], ecx
mov ecx, eax
sub eax, 0x20
dec edx
jne 0x1002bc4f
mov eax, dword [0x1004531d]
mov dword [eax + 8], ecx
mov eax, dword [0x1004531d]
mov esi, dword [eax + 8]
cmp esi, dword [ebp + 8]
jb 0x1002bc8e
cmp esi, dword [ebp - 4]
ja 0x1002bc8e
mov ecx, dword [esi + 0x18]
push 0x20
push 0xcc
push esi
mov dword [eax + 8], ecx
call fcn.1002c8a0
add esp, 0xc
mov eax, esi
jmp 0x1002bc90
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1002bc95
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003a488
push 0x1002c7b4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_VirtualQuery]
test eax, eax
je 0x1002bd0a
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x34]
cmp word [ecx], 0x5a4d
jne 0x1002bd06
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x3c], eax
cmp dword [eax], 0x4550
jne 0x1002bd06
cmp word [eax + 0x14], 0
jne 0x1002bcfb
xor eax, eax
or dword [ebp - 4], 0xffffffff
jmp 0x1002bd0c
mov eax, ecx
jmp 0x1002bcf5
or dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1002bd1b
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call dword [sym.imp.kernel32.dll_GetCurrentThreadId_1]
cmp dword [0x10045325], eax
je 0x1002bd3a
mov eax, 0x10dd
jmp 0x1002be10
mov eax, dword [0x10045329]
test eax, eax
jne 0x1002be10
mov edi, dword [ebp + 8]
test edi, edi
jne 0x1002bd56
push 6
pop eax
jmp 0x1002be10
cmp dword [edi], 0
jne 0x1002bd68
push 6
pop eax
mov dword [0x10045329], eax
jmp 0x1002be0a
push 0x18
call fcn.1002c8f8
mov esi, eax
pop ecx
test esi, esi
jne 0x1002bd7b
push 8
pop edi
jmp 0x1002bdf4
mov edi, dword [edi]
push 0
push dword [ebp + 0xc]
call fcn.1002b2b0
movzx ecx, byte [edi + 0x17]
mov ebx, dword [edi + 0x18]
xor edx, edx
sub ebx, ecx
cmp ecx, edx
je 0x1002bde9
cmp ecx, 0x17
ja 0x1002bde9
cmp dword [edi + 0x1c], eax
jne 0x1002bde9
lea eax, [ebp - 4]
mov dword [ebp - 4], edx
push eax
push 0x40
push ecx
push ebx
call dword [sym.imp.kernel32.dll_VirtualProtect]
test eax, eax
jne 0x1002bdbf
call dword [sym.imp.kernel32.dll_GetLastError_1]
mov edi, eax
jmp 0x1002bdf4
mov eax, dword [ebp + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], eax
mov dword [esi + 0x10], edi
mov dword [esi + 0xc], ebx
mov eax, dword [ebp - 4]
mov dword [esi + 0x14], eax
mov eax, dword [0x10045335]
mov dword [esi], eax
mov dword [0x10045335], esi
xor eax, eax
jmp 0x1002be10
cmp dword [0x10045321], edx
push 9
pop edi
jne 0x1002bdfa
mov dword [0x10045329], edi
test esi, esi
je 0x1002be05
push esi
call fcn.1002c88c
pop ecx
mov eax, edi
mov edi, dword [ebp + 8]
mov dword [0x1004532d], edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x113e3bd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 0x2c]
jne 0x1f74311
push 0xb37dce88
mov byte [esp], cl
and ecx, esp
shrd ecx, esi, cl
mov ecx, dword [ebx]
push edi
stc
or ecx, ecx
mov byte [esp], dh
lea esp, [esp + 8]
je 0x1f74311
lea edi, [edi*8 - 0x2033993]
lea edi, [ecx - 0x3713e45]
call fcn.0113a0e0
call 0x1987ab1c
push ds
iretd

Function at 0x11522ec
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 0x10]
je 0x1135acf
test sp, 0xd365
stc
stc
cmp al, ah
pushal
jmp 0x1f7a8b5
lea esp, [esp + 0x20]
jne 0x1f76227
push ebp
mov byte [esp], 0xd3
mov dword [esp], ebp
inc esi
call fcn.01f76852

Function at 0x13e5403
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0xd7526587
lea esp, [esp + 8]
je 0x1f74311
bswap bx
mov bl, al
pushfd
mov ebx, eax
lahf
push 0x6325cdbc
pushal
lea eax, [ebp - 8]
push dword [esp]
mov dword [esp + 0x28], eax
call fcn.0113c18e
push ecx
adc byte [si + 0x6b65], bh
inc eax
add dh, byte [ebx - 0x5378d555]
lodsb al, byte [esi]
jge 0x13e544b
adc ch, bl
mov dword [edx], esp
sub ch, cl
jns 0x13e5477
int 0x79
xor al, 0xd9
xor al, 0xd9
fbstp tbyte [eax + 0x76]
aaa
cmp eax, 0x3f93c216
fsubr st(2), st(0)
jns 0x13e5446
mov bl, 0x24
jmp 0xe9860d07
cdq
mov dword [0x4dbed134], eax
add ch, byte [esi + 0x5b80f63]
fcomp qword [ebp + 0x59]
mov ebp, 0xc73f1a6f
out 0xd8, al
loopne 0x13e550c
hlt
invalid

Function at 0x1f761dd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 0x44]
je 0x1f74311
pushfd
not dx
lea edx, [ebx + 4]
lea esp, [esp + 4]

Function at 0x1f77cea
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushal
mov dword [esp + 0x14], 0xb40c00d9
ror al, 3
bt si, 5
call fcn.01f734ba
inc al
push 0xca264c31
jmp 0x113b531

Function at 0x1f7a0ed
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movzx eax, bl
mov eax, dword [edx + 8]
pushfd
pushfd
push 0x1e9b313d
pushfd
lea esp, [esp + 0x14]
jmp 0x1f74314
jmp 0x11528eb

Function at 0x1f7d152
Capabilities:
Check http status code

Disassembly:
mov byte ss:[eax], dl
mov byte [esp], 0x72
mov word [esp + 4], sp
mov byte [esp], al
mov word [esp + 4], 0x34d4
lea esp, [esp + 8]
jmp 0x1f7abb8
call fcn.01f7ac33
pushfd
bt dx, dx
sal al, 7
sar al, 1
movzx eax, byte [esi - 1]
clc
clc
lea esi, [esi - 1]
mov byte [esp], 0xf4
xor al, bl
mov word [esp], 0x5901
pushfd
ror al, 7
pushfd
cmp cl, 0xc8
clc
sub al, 0xcd
add esp, 0xc
jae 0x1f7c458
xor al, 0x23
clc
push ebx
xor bl, al
pushfd
bt esp, 0x1b
test dl, al
test bh, dl
cbw
mov byte [esp], 0xd5
push dword [esp + 4]
clc
cwde
push 0x44a90b2f
sub ebp, 4
call fcn.01f7b9a2
mov eax, dword [ebp + 4]
pushal
push 0x8583dda3
idiv dword [ebp + 8]
call fcn.01f7a9aa
das
mov eax, dword [ebp]
and dl, 0xb4
mov dl, byte [ebp + 4]
cmp cx, 0xc6ca
stc
stc
add ebp, 6
push ebp
mov byte [esp], 0xa1
push eax
jmp 0x1f7ab4e
call fcn.01f7c1bc
clc
call fcn.01f7c136
pushfd
mov dword [ebp], edx
pushfd
mov byte [esp], ah
mov dword [esp + 4], 0x9982af95
jmp 0x1f7c766
lea esp, [esp + 0x30]
jne 0x1f7a9fd
shld bx, di, 6
mov ebx, eax
jmp 0x1f7c240
mov byte [esp], 0xfd
pushfd
pop dword [esp + 0x10]
mov dword [esp + 8], esp
pushal
jmp 0x1f7b76f
Function at 0x4011c9
Capabilities:
Create process on windows
Delete file
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
push ebx
push esi
push edi
mov edi, 0x493e0
push edi
call sub.MSVCRT.dll_malloc
xor ebx, ebx
push edi
mov esi, eax
push ebx
push esi
mov word [esi], bx
call sub.MSVCRT.dll_memset
lea eax, [ebp - 8]
push eax
push esi
mov dword [ebp - 8], 0xfeff
call sub.MSVCRT.dll_wcscat
push str._____Please_dont_forget______Write_in_e_mail_subject:_Strings_for:
push esi
call sub.MSVCRT.dll_wcscat
add esp, 0x20
xor ecx, ecx
call fcn.0040118f
push eax
push esi
call sub.MSVCRT.dll_wcscat
push str._LNG:xxxx
push esi
call sub.MSVCRT.dll_wcscat
mov edi, 0x409cf8
push edi
push esi
call sub.MSVCRT.dll_wcscat
push edi
push esi
call sub.MSVCRT.dll_wcscat
add esp, 0x20
push 0x19
pop ecx
call fcn.0040118f
push eax
push esi
call sub.MSVCRT.dll_wcscat
push edi
push esi
call sub.MSVCRT.dll_wcscat
push edi
push esi
call sub.MSVCRT.dll_wcscat
push 0x4db4a4
push esi
call sub.MSVCRT.dll_wcscat
mov eax, dword [0x4de934]
mov dword [ebp - 0x808], eax
xor eax, eax
mov ecx, 0x1ff
lea edi, [ebp - 0x804]
add esp, 0x20
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x808]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x808]
push str.translate_
push eax
call sub.MSVCRT.dll_wcscat
lea eax, [ebp - 0x808]
push 0x406014
push eax
call sub.MSVCRT.dll_wcscat
lea eax, [ebp - 0x808]
push str..txt
push eax
call sub.MSVCRT.dll_wcscat
add esp, 0x18
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push 0x80
push 4
push ebx
push 1
push 0x40000000
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40131c
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
lea ecx, [ebp - 4]
push ecx
shl eax, 1
push eax
push esi
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 5
push ebx
push ebx
lea eax, [ebp - 0x808]
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push esi
call sub.MSVCRT.dll_free
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40137c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, eax
mov dword [0x4dd444], eax
call fcn.00401ef6
call fcn.0040267e
test eax, eax
je 0x40146d
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
cmp ax, 0x407
mov dword [0x4dd910], 1
je 0x4013d4
cmp ax, 0x807
je 0x4013d4
cmp ax, 0xc07
je 0x4013d4
cmp ax, 0x1007
je 0x4013d4
cmp ax, 0x1407
jne 0x4013da
mov dword [0x4dd910], edi
cmp ax, 0x40c
je 0x4013f8
cmp ax, 0x80c
je 0x4013f8
cmp ax, 0xc0c
je 0x4013f8
cmp ax, 0x140c
je 0x4013f8
cmp ax, 0x100c
jne 0x401402
mov dword [0x4dd910], 3
cmp ax, 0x410
je 0x40140e
cmp ax, 0x810
jne 0x401418
mov dword [0x4dd910], 2
cmp ax, 0x419
jne 0x401428
mov dword [0x4dd910], 4
cmp ax, 0x41e
push 5
pop esi
jne 0x401437
mov dword [0x4dd910], esi
cmp ax, 0x41f
jne 0x401447
mov dword [0x4dd910], 6
cmp ax, 0x424
jne 0x401457
mov dword [0x4dd910], 7
call fcn.00402988
mov ecx, dword [0x4dd444]
mov edx, esi
call fcn.0040191d
test eax, eax
jne 0x401475
pop edi
xor eax, eax
pop esi
leave
ret 0x10
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push edi
push edi
push edi
lea eax, [ebp - 0x1c]
push eax
call esi
test eax, eax
je 0x4014b7
lea eax, [ebp - 0x1c]
push eax
push edi
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x4014ae
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push edi
push edi
push edi
lea eax, [ebp - 0x1c]
push eax
jmp 0x401482
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4025e5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push 1
pop eax
cmp dword [0x4dd4bc], eax
jne 0x4025fd
and dword [0x4dd4bc], 0
leave
ret
lea ecx, [ebp - 4]
push ecx
mov dword [0x4dd4bc], eax
xor eax, eax
push eax
push dword [0x4dd4b8]
mov dword [ebp - 4], eax
push 0x402448
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
leave
ret
Function at 0x403ca8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 2
xor edi, edi
mov esi, ecx
push edi
push dword [esi + 0x20c]
call sub.MSVCRT.dll_fseek
push dword [esi + 0x20c]
lea ebx, [esi + 0x214]
call sub.MSVCRT.dll_ftell
push dword [esi + 0x210]
mov dword [ebx], eax
push 1
push 4
push ebx
call sub.MSVCRT.dll_fwrite
add esp, 0x20
cmp eax, 1
jae 0x403cfa
push str.Write_Error
mov ecx, esi
call fcn.004031b5
add dword [esi + 0x218], 4
cmp dword [ebx], edi
je 0x403eeb
push dword [esi + 0x20c]
call sub.MSVCRT.dll_rewind
pop ecx
mov ecx, esi
mov dword [ebx], edi
call fcn.004035d6
mov ecx, esi
call fcn.004032b4
and dword [ebp - 4], 0
mov dword [ebp - 0x10], edi
lea edi, [esi + 0x220]
mov ecx, 0x3f1
mov eax, 0x20202020
mov dword [ebp - 0xc], 0xfc4
rep stosd dword es:[edi], eax
push dword [esi + 0x20c]
call sub.MSVCRT.dll_getc
cmp ax, 0xffff
pop ecx
je 0x403d6c
movsx ecx, word [ebp - 4]
inc dword [ebp - 4]
cmp word [ebp - 4], 0x3c
mov byte [ecx + esi + 0x11e4], al
jl 0x403d45
movsx eax, word [ebp - 4]
mov dword [ebx], eax
mov edi, 0xfc3
push edi
mov ecx, esi
call fcn.004032d8
dec edi
cmp di, 0xf88
jge 0x403d77
push 0xfc4
mov ecx, esi
call fcn.004032d8
mov edi, 0xfff
mov eax, dword [ebp - 4]
cmp word [esi + 0x125e], ax
jle 0x403dab
mov word [esi + 0x125e], ax
mov ax, word [esi + 0x125e]
cmp ax, 2
jg 0x403dd8
movsx eax, word [ebp - 0xc]
mov word [esi + 0x125e], 1
movzx ax, byte [eax + esi + 0x220]
mov ecx, esi
push eax
call fcn.00403776
jmp 0x403df8
add eax, 0xfd
push eax
mov ecx, esi
call fcn.00403776
xor eax, eax
mov ax, word [esi + 0x125c]
dec ax
mov ecx, esi
push eax
call fcn.0040387f
mov ax, word [esi + 0x125e]
and dword [ebp - 8], 0
test ax, ax
mov dword [ebp - 0x14], eax
jle 0x403e6b
push dword [esi + 0x20c]
call sub.MSVCRT.dll_getc
cmp ax, 0xffff
pop ecx
mov dword [ebp - 0x18], eax
je 0x403e6b
push dword [ebp - 0x10]
mov ecx, esi
call fcn.004034a2
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0x18]
movsx eax, cx
add eax, esi
cmp cx, 0x3b
mov byte [eax + 0x220], dl
jge 0x403e47
mov byte [eax + 0x1220], dl
mov eax, dword [ebp - 0xc]
inc ecx
and ecx, edi
inc eax
and eax, edi
mov dword [ebp - 0x10], ecx
push eax
mov ecx, esi
mov dword [ebp - 0xc], eax
call fcn.004032d8
inc dword [ebp - 8]
mov ax, word [ebp - 8]
cmp ax, word [ebp - 0x14]
jl 0x403e0b
movsx eax, word [ebp - 8]
add dword [ebx], eax
mov edx, dword [ebx]
mov ecx, dword [esi + 0x21c]
cmp edx, ecx
lea eax, [esi + 0x21c]
jbe 0x403e8b
add ecx, 0x400
mov dword [eax], ecx
mov ax, word [ebp - 8]
inc dword [ebp - 8]
cmp ax, word [ebp - 0x14]
jge 0x403ed9
movsx eax, word [ebp - 0x14]
movsx ecx, word [ebp - 8]
sub eax, ecx
inc eax
mov dword [ebp - 0x14], eax
push dword [ebp - 0x10]
mov ecx, esi
call fcn.004034a2
mov eax, dword [ebp - 0x10]
inc eax
and eax, edi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
inc eax
and eax, edi
dec dword [ebp - 4]
cmp word [ebp - 4], 0
mov dword [ebp - 0xc], eax
je 0x403ed4
push eax
mov ecx, esi
call fcn.004032d8
dec dword [ebp - 0x14]
jne 0x403ea6
cmp word [ebp - 4], 0
jg 0x403d98
mov ecx, esi
call fcn.0040396d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403ef0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov ecx, dword [0x4de938]
xor ebx, ebx
cmp ecx, ebx
push edi
je 0x403f1c
mov ecx, dword [ecx]
lea eax, [esi + 0x214]
mov dword [eax], ecx
add dword [0x4de93c], 4
cmp dword [eax], ebx
jmp 0x403f48
push dword [esi + 0x20c]
lea edi, [esi + 0x214]
push 1
push 4
push edi
call sub.MSVCRT.dll_fread
add esp, 0x10
cmp eax, 1
jae 0x403f46
push str.Read_Error
mov ecx, esi
call fcn.004031b5
cmp dword [edi], ebx
je 0x404086
mov ecx, esi
call fcn.00403a13
mov ecx, esi
call fcn.004035d6
lea edi, [esi + 0x220]
mov ecx, 0x3f1
mov eax, 0x20202020
rep stosd dword es:[edi], eax
cmp dword [esi + 0x214], ebx
mov dword [ebp - 4], 0xfc4
mov dword [ebp - 8], ebx
jbe 0x404086
mov edi, 0xfff
mov ecx, esi
call fcn.00403a39
mov ebx, eax
cmp bx, 0x100
jge 0x403fea
mov eax, dword [0x4de948]
test eax, eax
je 0x403fbe
mov ecx, dword [0x4de94c]
lea edx, [ecx + 1]
cmp edx, dword [0x4de944]
jge 0x403fcf
mov byte [ecx + eax], bl
inc dword [0x4de94c]
jmp 0x403fcf
push dword [esi + 0x210]
movsx eax, bx
push eax
call sub.MSVCRT.dll_putc
pop ecx
pop ecx
mov eax, dword [ebp - 4]
movsx ecx, ax
inc eax
and eax, edi
inc dword [ebp - 8]
mov byte [ecx + esi + 0x220], bl
mov dword [ebp - 4], eax
jmp 0x404077
mov ecx, esi
call fcn.00403b79
xor ecx, ecx
mov cx, ax
mov eax, dword [ebp - 4]
sub eax, ecx
dec eax
lea ecx, [ebx - 0xfd]
and eax, edi
test cx, cx
jle 0x404077
movsx eax, ax
mov dword [ebp - 0xc], eax
movsx eax, cx
add dword [ebp - 8], eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
and eax, edi
movzx bx, byte [eax + esi + 0x220]
mov eax, dword [0x4de948]
test eax, eax
je 0x40404b
mov ecx, dword [0x4de94c]
lea edx, [ecx + 1]
cmp edx, dword [0x4de944]
jge 0x40405c
mov byte [ecx + eax], bl
inc dword [0x4de94c]
jmp 0x40405c
push dword [esi + 0x210]
movsx eax, bx
push eax
call sub.MSVCRT.dll_putc
pop ecx
pop ecx
mov eax, dword [ebp - 4]
movsx ecx, ax
inc eax
and eax, edi
inc dword [ebp - 0xc]
dec dword [ebp - 0x10]
mov byte [ecx + esi + 0x220], bl
mov dword [ebp - 4], eax
jne 0x404018
mov eax, dword [ebp - 8]
cmp eax, dword [esi + 0x214]
jb 0x403f89
pop edi
pop esi
pop ebx
leave
ret