joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007e662
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100a2bb4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push edi
push eax
push esi
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 0x208
push eax
xor edi, edi
push edi
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1007e712
xor ecx, ecx
cmp dword [ebp - 8], 2
mov word [esi + 0x206], cx
jne 0x1007e707
mov ecx, esi
mov dword [ebp - 8], 1
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x1007e6b4
sub ecx, edx
sar ecx, 1
lea ebx, [ecx + 1]
lea eax, [ebx + ebx]
call fcn.100378c3
mov edi, esp
test edi, edi
jne 0x1007e6d9
push 8
pop eax
jmp 0x1007e712
push esi
mov edx, ebx
mov ecx, edi
call fcn.1002706a
mov ebx, 0x104
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, ebx
jle 0x1007e6f8
push 0x6f
pop eax
test eax, eax
jne 0x1007e707
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1007e707
inc eax
cmp dword [ebp - 8], 1
je 0x1007e712
mov eax, 0x65d
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10037870
mov esp, ebp
pop ebp
ret
Function at 0x10080ca0
Capabilities:
Create thread

Disassembly:
push 0x20
mov eax, 0x1003ad51
call fcn.10037f34
mov edi, ecx
mov dword [ebp - 0x18], edi
cmp dword [0x100a47c8], 0
je 0x10080e3c
xor esi, esi
mov ebx, esi
mov dword [ebp - 0x14], esi
cmp dword [edi + 0x2c], ebx
jne 0x10080e94
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push esi
push esi
push esi
push esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebx, eax
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x14], esi
je 0x10080daa
test ebx, ebx
je 0x10080daa
push 0x20
mov dword [ebp - 4], esi
push 0x1300000
push dword [0x100a3570]
call dword [sym.imp.MSDART.DLL_MpHeapAlloc]
mov ecx, eax
add esp, 0xc
mov dword [ebp - 0x28], ecx
mov byte [ebp - 4], 1
test ecx, ecx
je 0x10080d30
mov eax, dword [ebp - 0x14]
push ecx
push eax
call fcn.10080a29
jmp 0x10080d32
mov eax, esi
push 0x20
push 0x1300000
push dword [0x100a3570]
mov dword [edi + 0x2c], eax
call dword [sym.imp.MSDART.DLL_MpHeapAlloc]
add esp, 0xc
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x10080e44
push ecx
push ebx
mov ecx, eax
call fcn.10080a29
jmp 0x10080e46
mov eax, dword [edi + 0x2c]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x10080dd2
mov ecx, eax
call fcn.1007f3fb
push dword [ebp - 0x20]
push dword [0x100a3570]
call dword [sym.imp.MSDART.DLL_MpHeapFree]
pop ecx
pop ecx
mov dword [edi + 0x2c], esi
mov dword [ebp - 0x14], esi
mov eax, dword [edi + 0x30]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x10080df9
mov ecx, eax
call fcn.1007f3fb
push dword [ebp - 0x20]
push dword [0x100a3570]
call dword [sym.imp.MSDART.DLL_MpHeapFree]
pop ecx
pop ecx
mov dword [edi + 0x30], esi
mov ebx, esi
cmp dword [edi + 0x34], 0
je 0x10080e13
push dword [edi + 0x34]
push dword [0x100a3570]
call dword [sym.imp.MSDART.DLL_MpHeapFree]
pop ecx
pop ecx
mov dword [edi + 0x34], esi
test ebx, ebx
je 0x10080e1e
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x10080e2c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [edi + 0x24], 0
je 0x10080e3c
push esi
push dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
xor al, al
call fcn.10037e99
ret
mov eax, esi
push 8
push 0x1300000
push dword [0x100a3570]
mov dword [edi + 0x30], eax
call dword [sym.imp.MSDART.DLL_MpHeapAlloc]
add esp, 0xc
mov dword [ebp - 0x28], eax
test eax, eax
je 0x10080e73
mov edx, dword [edi + 0x30]
mov ecx, dword [edi + 0x2c]
mov dword [eax], ecx
mov dword [eax + 4], edx
jmp 0x10080e75
mov eax, esi
cmp dword [edi + 0x2c], 0
mov dword [edi + 0x34], eax
je 0x10080daa
cmp dword [edi + 0x30], 0
je 0x10080daa
test eax, eax
je 0x10080daa
lea eax, [ebp - 0x24]
push eax
push esi
push dword [edi + 0x30]
push 0x10080640
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x24], eax
test eax, eax
je 0x10080daa
lea eax, [ebp - 0x24]
push eax
push esi
push dword [edi + 0x34]
push 0x100806e0
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x28], eax
test eax, eax
je 0x10080daa
mov al, 1
jmp 0x10080e3e
Function at 0x10084080
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push edi
xor ebx, ebx
mov edi, dword [eax + 0x128]
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], ebx
call fcn.10083cd6
test eax, eax
js 0x100840b3
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x100840b3
mov bl, 1
cmp dword [ebp - 4], 0
je 0x100840ca
push dword [ebp - 4]
push dword [0x100a3570]
call dword [sym.imp.MSDART.DLL_MpHeapFree]
pop ecx
pop ecx
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1008900f
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x38
mov eax, 0x1003b06b
call fcn.10037f34
mov dword [ebp - 0x18], edx
mov edi, ecx
xor esi, esi
push esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocString
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x24], edi
cmp edi, 0xffffffff
jne 0x10089067
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push 0x1009ded8
push eax
call sub.msvcrt.dll__CxxThrowException
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x10089084
mov dword [ebp - 0x2c], 5
lea eax, [ebp - 0x2c]
push 0x1009ded8
jmp 0x10089061
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x38], eax
cmp eax, 0xffffffff
jne 0x100890a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push 0x1009ded8
jmp 0x10089061
shr eax, 1
xor ecx, ecx
push 2
mov dword [ebp - 0x20], eax
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
push 0x1300000
push dword [0x100a3570]
call dword [sym.imp.MSDART.DLL_MpHeapAlloc]
mov ebx, eax
add esp, 0xc
mov dword [ebp - 0x14], ebx
test ebx, ebx
jne 0x100890ed
mov dword [ebp - 0x34], 8
lea eax, [ebp - 0x34]
push 0x1009ded8
jmp 0x10089061
push esi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], esi
push eax
push dword [ebp - 0x38]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1008911a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x3c]
push 0x1009ded8
jmp 0x10089061
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov word [ebx + eax*2], cx
cmp dword [ebp - 0x1c], ecx
je 0x10089166
cmp eax, 0x40
jbe 0x10089166
push 0x40
push str._oledb__r_n__Everything_after_this_line_is_an_OLE_DB_initstring_r_n
push ebx
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x10089166
mov eax, dword [ebp - 0x20]
cmp word [ebx + eax*2 - 4], 0xd
jne 0x1008915c
cmp word [ebx + eax*2 - 2], 0xa
jne 0x1008915c
xor ecx, ecx
mov word [ebx + eax*2 - 4], cx
mov eax, dword [ebp - 0x18]
mov dword [eax], ebx
jmp 0x10089206
mov dword [ebp - 0x40], 0x800300fb
lea eax, [ebp - 0x40]
push 0x1009ded8
jmp 0x10089061
cmp edi, 0xffffffff
je 0x10089212
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test byte [0x100a4750], 2
je 0x10089233
mov ecx, dword [0x100aa154]
mov edx, 0x191009
push esi
push 0x1001921c
call fcn.1005682f
mov esi, eax
mov eax, esi
call fcn.10037e99
ret
Function at 0x1008a1f4
Capabilities:
Clear file content
Write file on windows

Disassembly:
push 0x34
mov eax, 0x1003b14b
call fcn.10037f34
mov eax, edx
mov dword [ebp - 0x18], eax
mov edi, ecx
mov dword [ebp - 0x38], edi
or dword [ebp - 0x14], 0xffffffff
test edi, edi
je 0x1008a3fb
test eax, eax
je 0x1008a3fb
mov ecx, eax
xor ebx, ebx
push 2
mov dword [ebp - 4], ebx
pop esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, esi
cmp ax, bx
jne 0x1008a22b
sub ecx, edx
sar ecx, 1
mov dword [ebp - 0x30], ecx
lea eax, [ecx + 0x43]
xor ecx, ecx
mov dword [ebp - 0x20], eax
mul esi
seto cl
neg ecx
or ecx, eax
push ecx
push 0x1300000
push dword [0x100a3570]
call dword [sym.imp.MSDART.DLL_MpHeapAlloc]
mov esi, eax
add esp, 0xc
mov dword [ebp - 0x3c], esi
mov byte [ebp - 4], 1
test esi, esi
jne 0x1008a284
mov dword [ebp - 0x1c], 0xe
lea eax, [ebp - 0x1c]
push 0x1009ded8
push eax
call sub.msvcrt.dll__CxxThrowException
push dword [ebp - 0x18]
push str._oledb__r_n__Everything_after_this_line_is_an_OLE_DB_initstring_r_n
push 0x10019280
push dword [ebp - 0x20]
push esi
call fcn.10032cbe
add esp, 0x14
mov dword [ebp - 0x20], eax
mov word [esi], 0xfeff
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
push 0x80
push dword [ebp + 8]
push ebx
push ebx
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x14], edi
cmp edi, 0xffffffff
jne 0x1008a2e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push 0x1009ded8
jmp 0x1008a27e
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x1008a30b
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 0x14], 0xffffffff
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 5
push 0x1009dea4
jmp 0x1008a27e
push ebx
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
push eax
mov eax, dword [ebp - 0x30]
lea eax, [eax*2 + 0x84]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1008a395
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x34]
push 0x1009ded8
jmp 0x1008a27e
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
push dword [0x100a3570]
call dword [sym.imp.MSDART.DLL_MpHeapFree]
mov ebx, dword [ebp - 0x20]
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
cmp edi, 0xffffffff
je 0x1008a3be
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
js 0x1008a3d6
mov ecx, dword [0x100a4788]
cmp byte [ecx + 0x24], 0
je 0x1008a3d6
push dword [ebp - 0x38]
call fcn.10087c0c
test byte [0x100a4750], 2
je 0x1008a3f7
mov ecx, dword [0x100aa154]
mov edx, 0x1a6409
push ebx
push 0x10019298
call fcn.1005682f
mov ebx, eax
mov eax, ebx
jmp 0x1008a400
mov eax, 0x80070057
call fcn.10037e99
ret
Function at 0x1009625f
Capabilities:
Check for software breakpoints

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
xor esi, esi
xor ebx, ebx
push edi
mov dword [esp + 0x1c], ebx
lea edi, [edx + 4]
mov edx, dword [ebp + 8]
lea ecx, [esp + 0xc]
and dword [esp + 0xc], 0
push ecx
push dword [ebp + 0xc]
lea ecx, [edi + 4]
call fcn.10033970
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x10096341
and dword [esp + 0x14], 0
cmp dword [edi], 0
jbe 0x10096341
xor ecx, ecx
mov dword [esp + 0x18], ecx
mov eax, dword [edi - 4]
and dword [esp + 0x10], 0
mov ebx, dword [ecx + eax]
lea eax, [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, ebx
push eax
call fcn.100340d2
pop ecx
cmp eax, 0xffffffff
je 0x10096321
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
test eax, eax
jne 0x100962fe
mov edx, dword [ebp + 0x18]
lea eax, [edi + 4]
push ecx
mov ecx, dword [ebp + 0x14]
push eax
call fcn.10095f5c
mov esi, eax
pop ecx
pop ecx
test esi, esi
js 0x1009637c
mov eax, dword [ebp + 0x10]
inc dword [eax]
jmp 0x10096321
mov edx, 0x400
test edx, eax
jne 0x10096321
cmp ebx, 0xcc
je 0x1009631c
cmp ebx, 0x7f
je 0x1009631c
cmp ebx, 0x86
jne 0x10096321
or eax, edx
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
inc eax
add ecx, 0x34
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
cmp eax, dword [edi]
jb 0x100962af
mov ebx, dword [esp + 0x1c]
inc ebx
add edi, 0x18
mov dword [esp + 0x1c], ebx
cmp ebx, 1
jb 0x10096278
test byte [0x100a4750], 2
je 0x10096373
mov edx, 0x39009
mov ecx, dword [0x100aa190]
push esi
push 0x1001def0
call fcn.1005682f
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x100a4750]
test al, 2
je 0x10096373
push 0xd4
mov edx, 0x1001de90
mov ecx, esi
call fcn.10051341
mov eax, dword [0x100a4750]
pop ecx
test al, 2
je 0x10096373
mov edx, 0x35009
jmp 0x10096360

Function at 0x1009c57a
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [0x100a5044]
push esi
push edi
test eax, eax
jne 0x1009c593
call fcn.1009c64f
test eax, eax
je 0x1009c5df
mov eax, dword [0x100a5044]
cmp eax, 1
jne 0x1009c5af
push 0xd
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x1009c5df
jmp 0x1009c625
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov ecx, eax
test ecx, ecx
je 0x1009c5c8
xor eax, eax
mov edi, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
mov eax, ecx
jmp 0x1009c625
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x1009c5e3
xor eax, eax
jmp 0x1009c625
mov eax, dword [esi]
push dword [0x100a5044]
call dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov edi, eax
test edi, edi
je 0x1009c609
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x1009c625
lea edi, [esi + 0xff0]
push esi
push dword [0x100a5044]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x1009c60f
mov eax, esi
pop edi
pop esi
ret
Function at 0x1009c850
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x100a2bb4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x110]
xor ebx, ebx
push eax
push 0x20019
push ebx
push 0x10022ae0
push SysReAllocString
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1009c915
push edi
lea eax, [ebp - 0x114]
mov dword [ebp - 0x10c], 1
push eax
lea eax, [ebp - 0x108]
mov edi, 0x104
push eax
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x114], edi
push eax
push ebx
push ebx
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1009c904
cmp dword [ebp - 0x10c], 2
lea eax, [ebp - 0x108]
mov byte [ebp - 5], bl
jne 0x1009c8f3
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
dec eax
lea ecx, [edi - 1]
cmp ecx, eax
sbb ebx, ebx
inc ebx
jmp 0x1009c904
push eax
mov edx, edi
mov ecx, esi
call fcn.1005597c
xor ebx, ebx
test eax, eax
setns bl
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop edi
jmp 0x1009c917
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10037870
mov esp, ebp
pop ebp
ret
Function at 0x4010f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
cmp ebx, dword [0x4972c0]
jne 0x401150
cmp edi, 0x111
jae 0x401130
cmp edi, 0x12
jb 0x401130
cmp edi, dword [0x4a9380]
je 0x42e78b
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push edx
push eax
push edi
push ebx
call dword [sym.imp.USER32.dll_DefWindowProcW]
pop esi
mov esp, ebp
pop ebp
ret 8
cmp edi, 0x113
jne 0x40115b
mov eax, dword [ebp + 8]
push 0x4a84b8
mov esi, ebx
call fcn.00401230
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [0x4972c0]
test eax, eax
je 0x401100
jmp 0x401119
cmp edi, 0x10
ja 0x401199
je 0x42e70b
lea eax, [edi - 1]
cmp eax, 6
ja case.0x40116e.3
jmp dword [eax*4 + 0x401214]
push 1
push ebx
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, 0x4a84b8
call fcn.00401000
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
cmp edi, 0x312
ja 0x401202
je 0x42e770
cmp edi, 0x11
je 0x42e740
cmp edi, 0x111
jne case.0x40116e.3
jmp 0x42e721
push 0
push 0x2ee
push 1
push ebx
call dword [sym.imp.USER32.dll_SetTimer]
push str.TaskbarCreated
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
cmp dword [0x4a84b8], 0
mov dword [0x4a9380], eax
jne 0x401147
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov dword [0x4a84b8], eax
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
cmp edi, 0x401
jne case.0x40116e.3
jmp 0x42e7b1
invalid
insb byte es:[edi], dx
cld
invalid
movsd dword es:[edi], dword [esi]
jmp 0x42e70d
invalid
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.0042d2b4
aam 0xc8
adc eax, dword [ecx - 0x73]
test esp, edx
clc
invalid
clc
invalid
clc
invalid
loope 0x42e76a
invalid
test ebp, esp
clc
invalid
sbb bh, bh
jne 0x42e7c9
call fcn.0042d279
add esp, 0xc
mov dword [ebp - 0x6e4], eax
call fcn.0042d2b4
mov ebp, 0x8d6ac2e5
invalid
in eax, 0xc2
push 0xffffffffffffff8d
invalid
test eax, ebp
clc
invalid
Function at 0x40cd80
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x18
push esi
xor eax, eax
push 0xffffffffffffffff
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0xc]
push eax
push ecx
mov ecx, dword [esp + 0x2c]
push edx
mov dword [esp + 0x20], 1
call fcn.0040ab50
test eax, eax
jne 0x42f461
lea ecx, [esp + 8]
call fcn.0040cfb0
mov ecx, dword [esp + 0x24]
test al, al
setne al
lea esi, [esp + 8]
mov byte [ecx], al
call fcn.004092c0
xor eax, eax
pop esi
add esp, 0x18
ret 8
jns 0x42f479
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
inc eax
or byte [eax - 0x18], dl
xor ebx, esi
invalid
Function at 0x40f5e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a8
push ebx
push esi
mov ebx, 0x4848e8
call fcn.0040f580
mov esi, eax
lea eax, [esp + 0xa8]
push esi
push eax
call fcn.00413990
push esi
call fcn.004112ef
add esp, 0xc
lea esi, [esp + 0x18]
call fcn.0040f6a0
lea eax, [esp + 0xa8]
mov ecx, esi
call fcn.0040f6d0
xor ebx, ebx
mov dword [edi + 8], ebx
xor ecx, ecx
mov eax, ebx
movzx edx, byte [esp + ecx + 0x18]
add eax, edx
movzx edx, byte [esp + ecx + 0x19]
add eax, edx
movzx edx, byte [esp + ecx + 0x1a]
add eax, edx
movzx edx, byte [esp + ecx + 0x1b]
add ecx, 4
add eax, edx
cmp ecx, 0x10
jl 0x40f631
mov dword [edi + 8], eax
mov eax, dword [ebp + 8]
push 0x4876c8
push eax
call fcn.00414e06
add esp, 8
mov dword [edi], eax
cmp eax, ebx
je 0x42b2ee
push edi
call fcn.0040f450
cmp eax, ebx
je 0x42b2f8
mov ecx, dword [edi]
push ecx
mov esi, eax
call fcn.00414e94
add esp, 4
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, 1
jmp 0x40f690
mov edx, dword [edi]
push edx
push 0x10
lea eax, [esp + 0x10]
push 1
push eax
call fcn.004151b0
add esp, 0x10
push 0xf522522c
push 0x10
lea ecx, [esp + 0x10]
push ecx
call fcn.0044afdc
xor eax, eax
mov dword [edi + 8], ebx
xor ecx, ecx
movzx edx, byte [esp + eax + 8]
inc eax
imul ecx, edx
cmp eax, 0x10
jl 0x42b324
mov eax, dword [edi]
push eax
mov dword [edi + 8], ecx
call fcn.00415484
add esp, 4
mov dword [edi + 4], eax
xor eax, eax
jmp 0x40f690

Function at 0x40f6a0
Capabilities:
Hash data with md5

Disassembly:
push 8
lea eax, [esi + 0x44]
push 0
push eax
call fcn.004131f0
add esp, 0xc
mov dword [esi + 0x34], 0x67452301
mov dword [esi + 0x38], 0xefcdab89
mov dword [esi + 0x3c], 0x98badcfe
mov dword [esi + 0x40], 0x10325476
ret

Function at 0x4103e0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4972c8]
push esi
push 0
mov esi, dword [sym.imp.USER32.dll_CreateWindowExW]
push eax
push 0
push 0
push 0x64
push 0x12c
push accept
push accept
push 0xcf0000
push str.AutoIt_v3
push str.AutoIt_v3
push 0
call esi
mov ecx, dword [0x4972c8]
push 0
push ecx
push 1
push eax
push 0
push 0
push 0
push 0
push 0x50b008c4
push 0
push str.edit
push 0
mov dword [0x4972c0], eax
call esi
mov edx, dword [0x4972c0]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edx
mov dword [0x4972bc], eax
call esi
mov eax, dword [0x4972c0]
push 0
push eax
call esi
pop esi
ret

Function at 0x421fa7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x490e80]
jne 0x421fb1
repz ret
jmp fcn.00426243
Function at 0x4523ce
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x430
push ebx
push ebp
push esi
mov esi, dword [esp + 0x440]
push edi
xor ebp, ebp
mov eax, dword [esi]
push eax
push 4
lea ecx, [esp + 0x1c]
push 1
push ecx
call fcn.004151b0
add esp, 0x10
push 0x816ce3f5
push 4
lea edx, [esp + 0x1c]
push edx
call fcn.0044afdc
lea eax, [esp + 0x14]
push 0x487704
push eax
mov byte [esp + 0x20], 0
call fcn.004151d0
add esp, 8
test eax, eax
jne 0x452562
mov ecx, dword [esi]
push ecx
push 1
lea edx, [esp + 0x18]
push 4
push edx
inc ebp
call fcn.004151b0
mov edi, dword [esp + 0x20]
mov eax, dword [esi]
push eax
xor edi, 0x1485767
lea ebx, [edi + edi]
push ebx
lea ecx, [esp + 0x38]
push 1
push ecx
call fcn.004151b0
add esp, 0x20
add edi, 0x1d6a5be3
push edi
push ebx
lea edx, [esp + 0x28]
push edx
call fcn.0044afdc
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x234]
xor eax, eax
push edx
mov word [esp + ebx + 0x28], ax
call fcn.00411691
mov eax, dword [esi]
push eax
push 1
lea ecx, [esp + 0x20]
push 4
push ecx
call fcn.004151b0
mov edi, dword [esp + 0x28]
mov edx, dword [esi]
push edx
xor edi, 0xbf367894
lea ebx, [edi + edi]
push ebx
lea eax, [esp + 0x40]
push 1
push eax
call fcn.004151b0
add esp, 0x28
add edi, 0x55f70346
push edi
push ebx
lea ecx, [esp + 0x28]
push ecx
call fcn.0044afdc
mov ecx, dword [esp + 0x44c]
lea eax, [esp + 0x20]
push eax
xor edx, edx
push ecx
mov word [esp + ebx + 0x28], dx
call fcn.00411691
mov edi, dword [esp + 0x450]
lea edx, [esp + 0x238]
push edi
push edx
call fcn.004133e4
add esp, 0x10
test eax, eax
je 0x452553
push 0x4876f8
push edi
call fcn.004133e4
add esp, 8
test eax, eax
jne 0x452510
test ebp, ebp
je 0x452553
mov eax, dword [esi]
push 1
push 1
push eax
call fcn.0041557c
mov ecx, dword [esi]
add esp, 0xc
push ecx
push 1
lea edx, [esp + 0x24]
push 4
push edx
call fcn.004151b0
mov eax, dword [esp + 0x2c]
xor eax, 0x87bc
mov dword [esp + 0x2c], eax
add eax, 0x18
push 1
push eax
mov eax, dword [esi]
push eax
call fcn.0041557c
add esp, 0x1c
jmp 0x4523e1
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x430
ret 0xc
pop edi
pop esi
pop ebp
mov eax, 6
pop ebx
add esp, 0x430
ret 0xc