joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4140c0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ecx, esi
push edi
movzx edi, byte [ebp + 0x14]
shr ecx, 2
dec edi
mov dword [ebp - 4], ecx
or edi, 0xdfdfdfdf
lea ebx, [eax + ecx*4]
neg ecx
mov dword [ebp + 0x14], ebx
je 0x41417e
test bl, 3
jne 0x414129
jmp 0x414100
mov eax, dword [ebx + ecx*4]
and eax, edi
imul eax, eax, 0xcc9e2d51
ror eax, 0x11
imul eax, eax, 0x1b873593
xor edx, eax
ror edx, 0x13
add edx, 0xfaddaf14
lea edx, [edx + edx*4]
add ecx, 1
jne 0x414100
jmp 0x41417e
lea esi, [ebx + 2]
mov ebx, dword [ebp - 4]
lea esi, [esi + ecx*4]
movzx ecx, byte [esi + 1]
lea esi, [esi + 4]
movzx eax, byte [esi - 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi - 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi - 6]
shl ecx, 8
or ecx, eax
and ecx, edi
imul eax, ecx, 0xcc9e2d51
ror eax, 0x11
imul eax, eax, 0x1b873593
xor edx, eax
ror edx, 0x13
add edx, 0xfaddaf14
lea edx, [edx + edx*4]
sub ebx, 1
jne 0x414132
mov ebx, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
mov eax, esi
xor ecx, ecx
and eax, 3
sub eax, 1
je 0x4141a4
sub eax, 1
je 0x41419b
sub eax, 1
jne 0x4141bc
movzx ecx, byte [ebx + 2]
shl ecx, 0x10
movzx eax, byte [ebx + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [ebx]
xor eax, ecx
and eax, edi
imul eax, eax, 0xcc9e2d51
ror eax, 0x11
imul eax, eax, 0x1b873593
xor edx, eax
xor edx, esi
mov eax, edx
shr eax, 0x10
xor eax, edx
imul ecx, eax, 0x85ebca6b
pop edi
pop esi
pop ebx
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
mov esp, ebp
pop ebp
ret

Function at 0x430770
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43079d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43079d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x420950
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x13000]
push edi
jmp 0x42096a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x420971
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x420960
mov eax, 1
add ebx, ebx
jne 0x420983
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x420978
jne 0x420994
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x420978
xor ecx, ecx
sub eax, 3
jb 0x4209a8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x420a1a
mov ebp, eax
add ebx, ebx
jne 0x4209b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4209c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4209e4
inc ecx
add ebx, ebx
jne 0x4209d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4209c5
jne 0x4209e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4209c5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x420a04
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4209f5
jmp 0x420966
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x420a04
add edi, ecx
jmp 0x420966
pop esi
mov edi, esi
mov ecx, 0x500
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x420a22
cmp byte [edi], 7
jne 0x420a22
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x420a27
lea edi, [esi + 0x1e000]
mov eax, dword [edi]
or eax, eax
je 0x420a9f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x235b4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x23668]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x420a54
mov ecx, edi
jns 0x420a83
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2366c]
or eax, eax
je 0x420a99
mov dword [ebx], eax
add ebx, 4
jmp 0x420a71
call dword [esi + 0x2367c]
mov ebp, dword [esi + 0x23670]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x420ad3
sub esp, 0xffffff80
jmp 0x401a3a
Function at 0x405660
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44819b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x45d320]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.0042b008
push 4
mov dword [ebp - 4], 0
call fcn.0042b821
mov edi, eax
add esp, 4
test edi, edi
je 0x4056e0
call fcn.0042add8
mov dword [edi], eax
call fcn.0042ab97
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0042aacc
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4056d6
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.0042aaf4
jmp 0x4056e2
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408c60
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
push str.advapi32.dll
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
jne 0x408c8b
push str.advapi32.dll
call fcn.00409350
mov edi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RegOpenKeyExW
push edi
call ebx
push str.RegCreateKeyExW
push edi
mov dword [esi + 4], eax
call ebx
push str.RegQueryValueExW
push edi
mov dword [esi + 8], eax
call ebx
push str.RegSetValueExW
push edi
mov dword [esi + 0x10], eax
call ebx
push str.RegEnumKeyExW
push edi
mov dword [esi + 0x14], eax
call ebx
push str.RegEnumValueW
push edi
mov dword [esi + 0x18], eax
call ebx
push str.RegDeleteValueW
push edi
mov dword [esi + 0x1c], eax
call ebx
push str.RegCloseKey
push edi
mov dword [esi + 0x20], eax
call ebx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0x10]
push eax
push ecx
push edx
mov ecx, esi
call fcn.00408be0
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x409250
Capabilities:
Get file attributes

Disassembly:
push esi
xor esi, esi
push edi
cmp dword [0x460a88], esi
jne 0x40928b
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x409281
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x460a84], eax
mov dword [0x460a88], 1
mov eax, dword [0x460a84]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4092a4
push ebx
push eax
call edi
mov esi, eax
test esi, esi
jne 0x4092e2
mov eax, dword [0x460a8c]
test eax, eax
jne 0x4092db
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x4092c5
mov eax, dword [0x453aac]
push eax
call dword [0x453aa8]
jmp 0x4092d2
mov ecx, dword [str.Kernel32.dll]
push ecx
call dword [0x453aa0]
test eax, eax
je 0x4092e2
mov dword [0x460a8c], eax
push ebx
push eax
call edi
pop edi
pop esi
ret
pop edi
mov eax, esi
pop esi
ret
Function at 0x40a950
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44980b
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x45d320]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x21c]
push ecx
push 0x104
mov dword [ebp - 0x23c], eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x40aa4e
lea edx, [ebp - 0x21c]
push edx
call fcn.00430465
add esp, 4
cmp word [ebp - 0x21c], 0
lea edi, [ebp - 0x21c]
je 0x40aa4e
movzx eax, word [edi]
mov dword [ebp - 0x240], eax
cmp eax, 0x43
jb 0x40aa2b
push eax
lea esi, [ebp - 0x238]
call fcn.0040b060
mov dword [ebp - 4], 0
cmp dword [ebp - 0x228], 0
je 0x40aa0c
mov ecx, dword [ebp - 0x23c]
lea edx, [ebp - 0x240]
call fcn.0040b990
push 0xffffffffffffffff
push 0
mov ecx, esi
push ecx
mov ecx, eax
call fcn.00409ce0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x224], 8
jb 0x40aa2b
mov edx, dword [ebp - 0x238]
push edx
call fcn.0042b4ae
add esp, 4
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40aa30
sub eax, edx
sar eax, 1
cmp word [edi + eax*2 + 2], cx
lea edi, [edi + eax*2 + 2]
jne 0x40a9c3
mov ecx, dword [ebp - 0x23c]
xor eax, eax
cmp dword [ecx + 8], eax
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042be98
mov esp, ebp
pop ebp
ret 4
Function at 0x40b3e0
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x470
mov eax, dword [0x45d320]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push edi
push str.Floppy
xor edi, edi
push eax
mov dword [ebp - 0x46c], edi
call fcn.0042fb28
add esp, 8
test eax, eax
setne al
test al, al
jne 0x40b61b
push esi
push 0x12
push 0
push 0
push 0x44fe88
call dword [0x461008]
mov esi, eax
cmp esi, 0xffffffff
je 0x40b609
xor eax, eax
push ebx
mov dword [ebp - 0x438], eax
mov dword [ebp - 0x434], eax
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x424], eax
lea eax, [ebp - 0x43c]
push eax
xor ebx, ebx
push ebx
push 0x44fe88
push ebx
mov edi, 0x1c
push esi
mov dword [ebp - 0x43c], edi
mov dword [ebp - 0x464], edi
call dword [0x46100c]
test eax, eax
je 0x40b5eb
jmp 0x40b495
mov edi, 0x1c
lea ecx, [ebp - 0x464]
push ecx
push ebx
push 0x44fe88
push 0
push esi
call dword [0x46100c]
push 0
lea edx, [ebp - 0x468]
push edx
push 0
push 0
lea eax, [ebp - 0x464]
push eax
push esi
mov dword [ebp - 0x468], 0
call dword [0x461010]
mov ecx, dword [ebp - 0x468]
test ecx, ecx
je 0x40b5b0
cmp ecx, 0x400
ja 0x40b5b0
xor eax, eax
mov dword [ebp - 0x420], eax
lea edx, [ebp - 0x420]
push edx
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x414], eax
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x40c], eax
mov dword [ebp - 0x408], eax
lea eax, [ebp - 0x468]
push eax
push ecx
lea ecx, [ebp - 0x404]
push ecx
lea edx, [ebp - 0x464]
push edx
push esi
mov dword [ebp - 0x404], 6
mov dword [ebp - 0x420], edi
call dword [0x461010]
test eax, eax
je 0x40b5b0
push 0
push 0
push 3
push 0
push 3
push 0
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40b5b0
push 0
lea ecx, [ebp - 0x470]
push ecx
push 0xc
lea edx, [ebp - 0x448]
push edx
push 0
push 0
push 0x2d1080
push edi
mov dword [ebp - 0x470], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x40b5a9
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x444]
je 0x40b5d1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x43c]
push ecx
inc ebx
push ebx
push 0x44fe88
push 0
push esi
call dword [0x46100c]
test eax, eax
jne 0x40b490
jmp 0x40b5eb
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [0x461014]
mov edx, dword [ebp - 0x40c]
mov dword [ebp - 0x46c], edx
push esi
call dword [0x461014]
mov eax, dword [ebp - 0x46c]
pop ebx
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042be98
mov esp, ebp
pop ebp
ret
pop esi
mov eax, edi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042be98
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.0042be98
mov esp, ebp
pop ebp
ret
Function at 0x40f8d0
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push edi
mov ebx, ecx
mov edi, edx
test esi, esi
je 0x40f914
mov dword [0x461028], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push 0xffffffffffffffff
push 0
push edi
mov ecx, 0x45edb4
mov dword [0x461030], eax
call fcn.00409ce0
push 0
push 0
push 0
push 0x414f50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.00423807
test eax, eax
je 0x40f92b
mov edi, str.time.windows.com
call fcn.0040f980
test eax, eax
jne 0x40f946
call fcn.00423807
test eax, eax
je 0x40f942
mov edi, str.time.nist.gov
call fcn.0040f980
test eax, eax
jne 0x40f946
xor edi, edi
jmp 0x40f94b
mov edi, 1
test esi, esi
je 0x40f96f
mov eax, dword [0x46102c]
mov dword [0x461028], 1
test eax, eax
je 0x40f96f
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, edi
pop edi
pop ebx
pop ecx
ret
Function at 0x4100e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x449308
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x45d320]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov esi, ecx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
push 0x1c
push str.url.dll_FileProtocolHandler
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], eax
call fcn.00408e20
push 0xffffffffffffffff
push 0
push esi
lea ecx, [ebp - 0x2c]
call fcn.00405750
mov eax, dword [ebp - 0x2c]
mov esi, 8
cmp dword [ebp - 0x18], esi
jae 0x41014e
lea eax, [ebp - 0x2c]
push 1
push 0
push eax
push str.rundll32.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [ebp - 0x18], esi
jb 0x410176
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.0042b4ae
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042be98
mov esp, ebp
pop ebp
ret

Function at 0x4116c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov ebx, eax
xor esi, esi
xor eax, eax
cmp ebx, esi
je 0x4117af
cmp dword [ebx + 8], 0x70b
jne 0x4117af
mov ecx, dword [ebx + 0xc]
cmp ecx, 0x201
je 0x4116fa
cmp ecx, 0x203
jne 0x4117af
mov eax, dword [ebp + 8]
push edi
push 0x27da
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 8]
push edx
mov edi, eax
push 0xb0
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push edi
call esi
mov eax, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x18]
push eax
push ecx
push 0xb1
push edi
call esi
mov esi, dword [ebx + 0x1c]
sub esi, dword [ebx + 0x18]
xor ecx, ecx
lea eax, [esi + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042b401
mov ebx, eax
lea eax, [esi + esi + 2]
push eax
push 0
push ebx
call fcn.0042c390
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
add esp, 0x10
push ebx
push 0
push 0x43e
push edi
call esi
mov ecx, dword [ebp + 8]
push 1
push 0
push 0
push ebx
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ebx
call fcn.0042c69d
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
add esp, 4
push edx
push eax
push 0xb1
push edi
call esi
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412010
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4492d8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x45d320]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
call section..text
mov esi, eax
mov eax, dword [ebp + 0xc]
sub eax, 0x110
je 0x41217d
dec eax
jne 0x412217
movzx ebx, word [ebp + 0x10]
push ebx
call fcn.0040ff60
add esp, 4
test eax, eax
jne 0x412173
cmp ebx, 0x27e4
jg 0x412143
je 0x4120ea
dec ebx
je 0x412088
dec ebx
je 0x4120d5
jmp 0x412217
push 0x104
push 0x460df0
push 0x27e6
xor eax, eax
push edi
mov word [0x460df0], ax
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
push 0x460df0
lea ecx, [ebp - 0x2c]
call fcn.00408d50
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [esi + 0x508]
mov dword [ebp - 4], 0
call fcn.00409ce0
lea ecx, [ebp - 0x2c]
call fcn.00409e10
mov edx, dword [ebp + 0x10]
push edx
push edi
call dword [sym.imp.USER32.dll_EndDialog]
mov eax, 1
jmp 0x41222b
push 0x27e0
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x30]
push ecx
push 0xb0
xor ebx, ebx
push esi
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
call edi
push 0xffffffffffffffff
push ebx
push 0xb1
push esi
call edi
push ebx
push ebx
push 0x301
push esi
call edi
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
push edx
push eax
push 0xb1
push esi
call edi
lea eax, [ebx + 1]
jmp 0x41222b
cmp ebx, 0x2806
jne 0x412217
cmp dword [esi + 0x500], 8
lea eax, [esi + 0x4ec]
jb 0x412160
mov eax, dword [eax]
push 1
push 0
push 0
push eax
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, 1
jmp 0x41222b
call fcn.0040ff00
cmp dword [0x45ed58], 8
mov eax, dword [0x45ed44]
jae 0x412195
mov eax, 0x45ed44
push eax
push 0x27e0
push edi
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x30
push 0xc5
push 0x27e6
push edi
call ebx
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x2776
push edi
call fcn.0040fcf0
add esi, 0x4ec
add esp, 8
cmp dword [esi + 0x10], 0
je 0x412210
push 0x2806
push edi
call ebx
cmp dword [esi + 0x14], 8
mov ebx, eax
jb 0x4121ec
mov esi, dword [esi]
push esi
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push ebx
call esi
push 5
push 0x2807
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call esi
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 0x14]
mov eax, 1
call fcn.004157b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042be98
mov esp, ebp
pop ebp
ret 0x10
Function at 0x413260
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push 0x454e60
push eax
xor bl, bl
call fcn.0042ce2d
mov esi, eax
add esp, 8
test esi, esi
je 0x4132a8
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
cmp ecx, eax
je 0x413299
push esi
sub eax, ecx
push eax
push 1
push ecx
call fcn.0042ccf5
add esp, 0x10
push esi
call fcn.0042cb2a
add esp, 4
pop esi
mov al, 1
pop ebx
pop ebp
ret
pop esi
mov al, bl
pop ebx
pop ebp
ret
Function at 0x414f70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x45d320]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x38]
push eax
push esi
xor bl, bl
call fcn.0042f4a2
add esp, 8
test eax, eax
jne 0x415023
push 0x454e88
push esi
call fcn.0042ce2d
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x415010
mov esi, dword [ebp + 0x14]
test esi, esi
jne 0x414fbe
mov esi, dword [ebp - 0x24]
push esi
mov ecx, edi
call fcn.0040d9a0
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x414fd9
push 0
push eax
push ebx
call fcn.0042f98a
add esp, 0xc
test esi, esi
je 0x414ff4
mov eax, dword [edi]
push ebx
push esi
push 1
push eax
call fcn.0042f388
add esp, 0x10
push eax
mov ecx, edi
call fcn.0040d9a0
push ebx
call fcn.0042cb2a
add esp, 4
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042be98
mov esp, ebp
pop ebp
ret
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042be98
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0042be98
mov esp, ebp
pop ebp
ret

Function at 0x415040
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448758
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x45d320]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
lea ecx, [ebp - 0x44]
push ecx
push esi
mov dword [ebp - 4], ebx
call fcn.0042f4a2
add esp, 8
test eax, eax
jne 0x415119
push 0x454e88
push esi
call fcn.0042ce2d
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x415119
mov edi, dword [ebp - 0x30]
push edi
lea ecx, [ebp - 0x5c]
call fcn.0040d9a0
cmp edi, ebx
jbe 0x4150d3
mov edx, dword [ebp - 0x5c]
push esi
push edi
push 1
push edx
call fcn.0042f388
add esp, 0x10
push eax
lea ecx, [ebp - 0x5c]
call fcn.0040d9a0
push esi
call fcn.0042cb2a
add esp, 4
lea eax, [ebp - 0x45]
push eax
lea ecx, [ebp - 0x5c]
mov byte [ebp - 0x45], bl
call fcn.00413a70
mov esi, dword [ebp - 0x5c]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4150f3
mov ecx, dword [ebp - 0x4c]
sub eax, edx
push eax
push esi
call fcn.00409830
mov al, 1
cmp esi, ebx
je 0x41511b
push esi
call fcn.0042b4ae
add esp, 4
mov al, 1
jmp 0x41511b
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042be98
mov esp, ebp
pop ebp
ret
Function at 0x418590
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
movzx ecx, word [edx + 0x14]
lea ecx, [ecx + edx + 0x18]
movzx edx, word [edx + 6]
push esi
xor eax, eax
xor esi, esi
test edx, edx
je 0x4185d9
push edi
lea esp, [esp]
mov edi, dword [ecx + 0xc]
cmp ebx, edi
jb 0x4185c0
mov eax, dword [ecx + 8]
add eax, edi
cmp ebx, eax
jb 0x4185ce
inc esi
add ecx, 0x28
cmp esi, edx
jb 0x4185b0
pop edi
xor eax, eax
pop esi
pop ebp
ret
mov eax, dword [ecx + 0x14]
sub eax, edi
add eax, ebx
add eax, dword [ebp + 8]
pop edi
pop esi
pop ebp
ret

Function at 0x4185e0
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
push 0
push 0x80
push 3
push 0
push 1
push closesocket
xor bl, bl
push eax
mov byte [ebp - 1], bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0xc], esi
cmp esi, 0xffffffff
je 0x4186d2
push 0
push 0
push 0
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
mov dword [ebp - 8], ebx
test ebx, ebx
je 0x4186c2
push edi
push 0
push 0
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x4186ba
mov ecx, 0x5a4d
cmp cx, word [edi]
jne 0x4186b0
mov esi, dword [edi + 0x3c]
add esi, edi
cmp dword [esi], 0x4550
jne 0x4186b0
mov edx, dword [ebp + 0xc]
push edx
push edi
mov eax, esi
call fcn.00418a40
add esp, 8
test al, al
jne 0x4186ac
mov eax, dword [esi + 0x88]
test eax, eax
je 0x4186b0
push edi
mov edx, esi
mov ebx, eax
call fcn.00418590
mov ecx, dword [ebp + 0xc]
add ecx, 0x20
push ecx
push 0x69
push 0x455098
push 0
push eax
push eax
push edi
push esi
call fcn.004186e0
mov ebx, dword [ebp - 8]
add esp, 0x24
test al, al
je 0x4186b0
mov byte [ebp - 1], 1
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [ebp - 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret