joyce8/EMBER2024-capa huggingface dataset:
Function at 0x59f510
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x5ac568], 0x1b77
mov dword [ebp - 0xc], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
mov dword [0x5ac568], 0x2357
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x10], eax
mov dword [0x5ac568], 0x2042
mov dword [ebp - 8], 0
jmp 0x59f5a6
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
movzx eax, word [eax + ecx*2 - 0x1a]
cmp eax, 0x6c
je 0x59f5c2
jmp 0x59f651
jmp 0x59f55c
jmp 0x59f64b
mov dword [0x5ac568], 0xe2e
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
movzx eax, word [eax + ecx*2 - 0x14]
cmp eax, 0x64
je 0x59f5f2
jmp 0x59f64b
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x104
jge 0x59f55c
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
movzx eax, word [eax + ecx*2]
cmp eax, 0
je 0x59f573
jmp 0x59f59b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx eax, word [ecx + eax*2 - 0x18]
cmp eax, 0x6f
jne 0x59f64f
mov dword [0x5ac56c], 0x2099
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
movzx eax, word [eax + ecx*2 - 0x16]
cmp eax, 0x61
je 0x59f57a
jmp 0x59f64d
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
movzx eax, word [eax + ecx*2 - 0x12]
cmp eax, 0x64
jne 0x59f575
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx eax, word [ecx + eax*2 - 0x10]
cmp eax, 0x6c
jne 0x59f646
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
movzx eax, word [eax + ecx*2 - 0xe]
cmp eax, 0x6c
jne 0x59f644
mov eax, dword [0x5ac568]
sub eax, 0x2531
mov dword [0x5ac56c], eax
mov dword [ebp - 4], 1
jmp 0x59f658
jmp 0x59f646
jmp 0x59f575
jmp 0x59f64d
jmp 0x59f64f
jmp 0x59f651
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
add esp, 0x10
pop ebp
ret

Function at 0x59f7d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [fcn.0059f7d0]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x59f808
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
jne 0x59f806
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
jmp 0x59f831
jmp 0x59f808
mov eax, dword [ebp - 4]
sub eax, 0x1000
and eax, 0xfffff000
mov dword [ebp - 4], eax
mov al, 1
test al, 1
jne 0x59f7df
jmp 0x59f820
mov dword [0x5ac56c], 0x1b8b
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
add esp, 8
pop ebp
ret
Function at 0x402180
Capabilities:
Get disk information
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x420024]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, edx
mov dword [ebp - 0x218], 0
mov esi, ecx
mov dword [ebp - 8], esi
mov dword [ebp - 0xa], 0
movzx eax, word [edi]
mov word [ebp - 0xc], ax
movzx eax, word [edi + 2]
mov word [ebp - 0xa], ax
xor eax, eax
push 0x208
push eax
mov word [ebp - 8], ax
lea eax, [ebp - 0x214]
push eax
call fcn.00406b90
add esp, 0xc
lea eax, [ebp - 0x214]
push 0x104
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x402211
lea eax, [ebp - 0x214]
mov ecx, esi
push eax
call fcn.00401120
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004045c5
mov esp, ebp
pop ebp
ret
push edi
push str.Error_getting_device_for__ls_n
call fcn.004010f0
add esp, 8
push 1
call fcn.00407899
int3
Function at 0x402ac0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x417679
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x420024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 2
mov eax, dword [ebp + 8]
test eax, eax
je 0x402b06
mov eax, dword [eax]
jmp 0x402b08
xor eax, eax
push 0
push 0
push 3
push 0
push 0
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x402b64
cmp esi, 0xffffffff
je 0x402b64
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ecx
mov ebx, eax
mov ecx, edi
push ebx
call fcn.00404120
mov dword [ebp - 0x10], 1
test ebx, ebx
je 0x402b83
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
push dword [edi]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x402b64
cmp dword [ebp - 0x14], ebx
je 0x402b83
push 0
push 0
push 0x80004005
lea ecx, [ebp - 0x2c]
call fcn.00401650
push 0x41f4b4
lea eax, [ebp - 0x2c]
push eax
call fcn.00406964
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp + 8]
call fcn.004011c0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402bb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4176b8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x420024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 2
mov eax, dword [ebp + 8]
test eax, eax
je 0x402be8
mov eax, dword [eax]
jmp 0x402bea
xor eax, eax
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
je 0x402c36
cmp esi, 0xffffffff
je 0x402c36
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
sub eax, ecx
je 0x402c55
push 0
lea edx, [ebp - 0x10]
push edx
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x402c36
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp + 0xc]
cmp dword [ebp - 0x10], eax
je 0x402c55
push 0
push 0
push 0x80004005
lea ecx, [ebp - 0x24]
call fcn.00401650
push 0x41f4b4
lea eax, [ebp - 0x24]
push eax
call fcn.00406964
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp + 8]
call fcn.004011c0
lea ecx, [ebp + 0xc]
call fcn.00404040
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x403d60
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4178d0
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x420024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0
push ecx
call fcn.0040ac49
add esp, 0xc
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x403de3
push 0
push 0
push 0x80004005
lea ecx, [ebp - 0x3c]
call fcn.00401650
push 0x41f4b4
lea eax, [ebp - 0x3c]
push eax
call fcn.00406964
mov dword [ebp - 0x24], 0
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 1
push eax
push 1
push 0
push 0
push 0xf01ff
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x403dc4
push 4
lea eax, [ebp - 0x2c]
push eax
push 0xc
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
push 0x44
lea eax, [ebp - 0x90]
push 0
push eax
call fcn.00406b90
add esp, 0xc
mov dword [ebp - 0x90], 0x44
movups xmm0, xmmword [str.cmd.exe]
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x88], str.WinSta0Default
push eax
lea eax, [ebp - 0x90]
push eax
push 0
push 0
push 0x10
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push dword [ebp - 0x24]
movups xmmword [ebp - 0x20], xmm0
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x403e87
push dword [ebp - 0x4c]
call esi
push dword [ebp - 0x48]
call esi
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x403e9d
cmp eax, 0xffffffff
je 0x403e9d
push eax
call esi
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x403eac
cmp eax, 0xffffffff
je 0x403eac
push eax
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004045c5
mov esp, ebp
pop ebp
ret

Function at 0x40727c
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsAlloc
push 0x418388
push str.FlsAlloc
push 0
call fcn.004071fc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4072ae
push dword [ebp + 8]
mov ecx, esi
call fcn.0040499d
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x4072f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsGetValue
push 0x4183ac
push str.FlsGetValue
push 2
call fcn.004071fc
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x407321
mov ecx, esi
call fcn.0040499d
call esi
jmp 0x407327
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret
Function at 0x40732a
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsSetValue
push 0x4183c0
push str.FlsSetValue
push 3
call fcn.004071fc
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x40735e
mov ecx, esi
call fcn.0040499d
call esi
jmp 0x407364
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret

Function at 0x40f8ed
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0040f563

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40b044
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407b04
xor eax, eax
push ebp
push 0x40b104
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 0xc]
push eax
push 3
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx eax, ax
push eax
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.0040858c
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040873c
mov eax, dword [ebx]
call fcn.0040aef4
test al, al
jne 0x40b0e1
mov word [ebp - 8], 0
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.0040858c
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040873c
mov eax, dword [ebx]
call fcn.0040aef4
test al, al
jne 0x40b0e1
mov eax, ebx
call fcn.00407a20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b10b
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00407a80
lea eax, [ebp - 4]
call fcn.00407a20
ret

Function at 0x40caa4
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x40d1cc
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1278
push ebx
push esi
push edi
mov dword [ebp - 0x8a4], 1
push ecx
push ebx
add esp, 4
and ecx, 0x5455
or ecx, 0x2dc
or ecx, 0x8f1f
pop ecx
push ebx
sub ebx, 0x10724
add ebx, 0x105ed
sub ebx, 0x3a37
sub ebx, 0x12660
pop ebx
imul eax, dword [ebp - 0x8a4], 0xe9
add eax, 0x15f3673a
imul ecx, dword [ebp - 0x8a4], 0xe9
sub eax, ecx
xor eax, 0x8a134
imul eax, dword [ebp - 0x8a4]
imul edx, dword [ebp - 0x8a4], 0xe9
sub eax, edx
mov dword [ebp - 0x8a8], eax
push esi
push esi
add esp, 4
or esi, 0x1586d
jmp 0x40d261
jmp 0x40d26a
pop esi
push edx
and edx, 0xed96
add edx, 0x784e
add edx, 0x1015d
pop edx
mov dword [ebp - 0x6c], 1
push eax
push edx
add esp, 4
or eax, 0x13c02
jmp 0x40d299
pop eax
push edi
call fcn.0040d2a8
add byte [edi], bh
dec edi
aaa
inc eax
inc edx
push eax
aas
Function at 0x4246e4
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x4c090c
mov eax, esi
mov edx, 8
test al, 1
je 0x424700
shr eax, 1
xor eax, 0xedb88320
jmp 0x424702
shr eax, 1
dec edx
jne 0x4246f3
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4246ec
pop esi
ret

Function at 0x424718
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x4c0908], 0
jne 0x424742
call fcn.004246e4
mov dword [esp], 0x4c0908
mov edx, dword [esp]
mov eax, 1
lock xchg dword [edx], eax
mov eax, edi
test esi, esi
je 0x42476c
mov edx, 0xff
and edx, ebx
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x4c090c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x424748
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4014d9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x254
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [esp], 0
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0
call ebx
mov dword [ebp - 0x21c], 6
push edx
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x218], 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push ecx
push ecx
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
mov dword [ebp - 0x220], eax
call dword [sym.imp.USER32.dll_LoadIconA]
push edx
push edx
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x238]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_RegisterClassW]
push ecx
mov dword [esp], 0
call ebx
push ebx
lea ebx, [ebp - 0x210]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
push eax
push eax
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
push eax
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push eax
push eax
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80000000
call dword [sym.imp.KERNEL32.dll_CreateFileW]
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push eax
lea eax, [ebx - 3]
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x4016dd
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xa4
mov dword [ebp - 0x88], 0
call fcn.004014d9
test eax, eax
jne 0x401777
lea eax, [ebp - 0x8c]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
mov eax, 0x4021e2
sub eax, 0x401780
mov dword [esp], 0x401780
mov dword [esp + 4], eax
mov dword [ebp - 0x8c], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp dword [ebp - 0x8c], 0
je 0x401777
lea ebx, [ebp - 0x88]
mov dword [esp], 0
call fcn.00401446
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.0040164f
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1ba00
mov dword [esp], 0x40300c
call fcn.00401ee5
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x8ddf6c
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8ddf72
pop ebp
sub ebp, 6
sub ebp, 0x4ddf6c
jmp 0x8ddfd0
jmp 0x8ddfd9
mov eax, 0x4ddf6c
add eax, ebp
add eax, 0x93
mov ecx, 0x634
mov edx, 0xa7d6e3a0
xor byte [eax], dl
inc eax
dec ecx
jne 0x8ddff0
jmp 0x8de003
retf 0xc8e0
Function at 0x40121a
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x401243
mov al, byte [esi + 1]
inc esi
test al, al
je 0x40123b
cmp al, 0x22
jne 0x40122f
cmp byte [esi], 0x22
jne 0x40124d
inc esi
jmp 0x40124d
cmp al, 0x20
jle 0x40124d
inc esi
cmp byte [esi], 0x20
jg 0x401247
mov al, byte [esi]
test al, al
je 0x401257
cmp al, 0x20
jle 0x401240
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00401bda
push 0x403004
push section..data
call fcn.00401bc0
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x401287
movzx eax, word [ebp - 0x14]
jmp 0x40128a
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.00401bf2
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4013d0
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ebp, esp
add esp, 0xfffffffc
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [0x40334c], eax
lea ecx, [ebp - 4]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov eax, dword [ebp + 4]
mov dword [0x40319d], eax
xor eax, eax
mov ecx, 0x16
push eax
dec ecx
jne 0x401401
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [ebp - 0x5c]
push ecx
mov eax, 0x30
mov dword [ecx], eax
mov eax, dword [0x40319d]
mov dword [ebp - 0x48], eax
mov eax, 0x4018d6
mov dword [ebp - 0x54], eax
mov ecx, str.secondclass
mov dword [ebp - 0x34], ecx
call dword [sym.imp.USER32.dll_RegisterClassExA]
push str.Riched32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor ecx, ecx
push ecx
push dword [0x40319d]
push ecx
push ecx
push 0x12e
push 0x7a
push 0x34c
push 0x2aa
push 0x40000
lea eax, str.bytesma
push eax
mov eax, 0x4030f5
push eax
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x403398], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x403398]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor ebx, ebx
lea edi, [ebp - 0x50]
jmp 0x4014b5
push edi
call dword [sym.imp.USER32.dll_TranslateMessage]
push edi
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_GetMessageA]
test al, al
jne 0x4014a7
mov esp, ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x70012b7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x70012c6
pop dword [ebp - 0x14]
mov eax, 0xc1f0cdd4
add eax, 0x450f44f2
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x3ddd952d
add dword [ebp - 0x24], 0x1074b01e
mov dword [ebp - 0x20], 0xca981b77
add dword [ebp - 0x20], 0x679b30ce
mov dword [ebp - 0x1c], 0x18289f88
add dword [ebp - 0x1c], 0x3423a4a6
mov dword [ebp - 0x18], 0xe5e74f98
add dword [ebp - 0x18], 0x1a18b068
lea eax, [ebp - 0x24]
push eax
mov eax, 0x68f2570a
sub eax, 0x61f116da
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x481a8568
add dword [ebp - 0x24], 0x2c57e3ee
mov dword [ebp - 0x20], 0xdee5e41b
sub dword [ebp - 0x20], 0x9d7982a6
mov dword [ebp - 0x1c], 0xbd9dcb1b
sub dword [ebp - 0x1c], 0x5a2e5eaf
mov dword [ebp - 0x18], 0x71965909
sub dword [ebp - 0x18], 0x71965909
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xdb139ff8
sub eax, 0xd4125fc4
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x383a8
push 0
call eax
mov ecx, 0x7764e324
add ecx, 0x889b5d0a
xor edx, edx
add edx, eax
mov edi, 0xe0f8e038
add edi, 0x260933c8
add edi, dword [ebp - 0x14]
mov esi, 0x3123781
sub dword [ebp - 8], 0xd1ba7a4d
mov ebx, dword [edi]
add ebx, esi
xor dword [ebp - 4], 0x8a2b606f
mov dword [edx], ebx
sub dword [ebp - 8], ebx
add edx, 4
add edi, 0x50860db9
sub edi, 0x50860db5
loop 0x70013e4
add eax, 0xe5bcc36
sub eax, 0xe5ad8ab
mov ebx, eax
add eax, 0x7a475214
sub eax, 0x7a47520f
mov ecx, 0x9d4f3510
add ecx, 0x69b0caf0
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x700dc1f
Capabilities:
Set current directory

Disassembly:
push 8
mov eax, 0x7012b4c
call fcn.07001ce0
mov edi, ecx
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
push esi
call fcn.0700de1f
xor ebx, ebx
mov dword [edi], vtable.FileSharedStream.0
mov dword [edi + 0xc], ebx
mov byte [edi + 0x10], bl
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [edi + 0x18]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0700e7aa
lea ecx, [ebp - 0x10]
call fcn.0700dbbc
mov eax, dword [edi + 0x14]
mov byte [ebp - 4], 2
push dword [eax + 0x14]
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov eax, dword [edi + 0x14]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x700dc8c
mov eax, dword [eax + 0x14]
jmp 0x700dc91
mov eax, 0x70148c2
push 0x7016240
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov dword [edi + 0xc], eax
pop ecx
pop ecx
test eax, eax
je 0x700dcbf
mov ecx, edi
call fcn.07007930
lea ecx, [ebp - 0x10]
call fcn.070012b7
mov eax, edi
call fcn.07001e84
ret 4
push str.file_does_not_exist
push ebx
call fcn.070012b7
int3