joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55153c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404174
xor eax, eax
push ebp
push 0x5515d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5c1b14]
mov dword [eax], 0x18f13e8
mov eax, dword [ebp - 4]
call fcn.00403fc0
test al, al
jbe 0x5515b1
mov byte [ebp - 5], al
mov bl, 1
mov eax, 0x80
call fcn.00402c1c
or eax, 0x80
mov esi, ebx
and esi, 0xff
mov edx, dword [ebp - 4]
movzx edx, byte [edx + esi - 1]
xor eax, edx
push eax
lea eax, [ebp - 4]
call fcn.00404190
pop edx
mov byte [eax + esi - 1], dl
inc ebx
dec byte [ebp - 5]
jne 0x55157c
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00403d94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5515d8
lea eax, [ebp - 4]
call fcn.00403d40
ret

Function at 0x5519d0
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, eax
mov byte [ebp - 1], 0
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
mov eax, ebx
call fcn.00404184
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x551a82
xor eax, eax
push ebp
push 0x551a7b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, 2
call fcn.00551964
push eax
xor eax, eax
call fcn.00551964
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x551a48
mov eax, 2
call fcn.00551964
cmp eax, dword [ebp - 0xc]
je 0x551a4c
xor eax, eax
jmp 0x551a4e
mov al, 1
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
jne 0x551a64
mov eax, ebx
call fcn.00404184
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x551a82
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
mov al, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x551a8c
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x551bc4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
mov edx, 0x104
call fcn.004042f4
push 0x104
lea eax, [ebp - 8]
call fcn.00404190
push eax
push 0x551bd8
call sub.kernel32.dll_GetEnvironmentVariableA
mov edx, eax
lea eax, [ebp - 8]
call fcn.004042f4
mov eax, dword [ebp - 8]
call fcn.00403fc0
test eax, eax
jle 0x551ba6
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.00402bfc
mov dword [ebp - 0x4c], 0x44
mov dword [ebp - 0x20], 1
mov word [ebp - 0x1c], 0
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x210
push 0
push 0
push 0
push dword [ebp - 8]
push 0x551be8
push ebx
push 0x551bf8
push esi
lea eax, [ebp - 0x60]
mov edx, 5
call fcn.00404080
mov eax, dword [ebp - 0x60]
call fcn.00404184
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x551ba6
xor eax, eax
push ebp
push 0x551b9f
push dword fs:[eax]
mov dword fs:[eax], esp
push edi
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
setne byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x551ba6
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x551bcb
lea eax, [ebp - 0x60]
call fcn.00403d40
lea eax, [ebp - 8]
call fcn.00403d40
ret

Function at 0x551bfc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404184
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x551c19
and eax, 0x10
cmp eax, 0x10
je 0x551c1d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x56cc84
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404184
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x56cc9d
test al, 0x10
jne 0x56cca1
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x56fce0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x56fd0e
mov eax, ebx
call fcn.00570784
cmp dword [ebx + 0x3c], 0
je 0x56fd07
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x56fd7f
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x56fd71
cmp dword [ebx + 8], 0
je 0x56fd30
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x56fd42
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x56fd71
cmp dword [ebx + 8], 0
je 0x56fd23
cmp eax, 3
je 0x56fd55
dec eax
jne 0x56fd23
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x56fd23
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x56fd23
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x56fd9d
cmp dword [ebx + 0x10], 0xcc
je 0x56fd9d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0056fda8
pop ebx
ret
Function at 0x58c564
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x58c7af
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebx + 0x344], ecx
mov eax, dword [ebp + 8]
mov dword [ebx + 0x348], eax
lea edx, [ebp - 0x14]
mov eax, dword [0x5c1998]
mov eax, dword [eax]
call fcn.00454584
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00408e7c
lea eax, [ebp - 0x18]
mov ecx, 0x58c7cc
mov edx, dword [ebp - 0x10]
call fcn.0040400c
mov eax, dword [ebp - 0x18]
call fcn.0056cc84
test al, al
jne 0x58c5e9
lea eax, [ebp - 0x1c]
mov ecx, 0x58c7cc
mov edx, dword [ebp - 0x10]
call fcn.0040400c
mov eax, dword [ebp - 0x1c]
call fcn.00409010
lea eax, [ebp - 8]
mov ecx, 0x58c7dc
mov edx, dword [ebp - 0x10]
call fcn.0040400c
mov eax, dword [ebp - 8]
call fcn.0056cc84
test al, al
jne 0x58c60d
mov eax, dword [ebp - 8]
call fcn.00409010
lea eax, [ebp - 0xc]
mov ecx, 0x58c7f4
mov edx, dword [ebp - 0x10]
call fcn.0040400c
mov eax, dword [ebp - 0xc]
call fcn.0056cc84
test al, al
jne 0x58c631
mov eax, dword [ebp - 0xc]
call fcn.00409010
call sub.kernel32.dll_GetLogicalDrives
mov esi, eax
test esi, 1
setne al
test al, al
je 0x58c651
test esi, 2
jne 0x58c70c
test esi, 1
setne dl
test al, al
je 0x58c6a7
xor edx, edx
mov eax, dword [ebx + 0x330]
call fcn.0042ce58
xor eax, eax
mov dword [ebx + 0x350], eax
cmp dword [ebx + 0x344], 0
jne 0x58c69b
mov byte [ebx + 0x340], 1
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4bbfb4]
call fcn.004bc0a8
mov dword [ebx + 0x344], eax
mov eax, dword [ebx + 0x344]
mov dword [ebx + 0x34c], eax
test esi, 2
je 0x58c6fd
mov edx, 1
mov eax, dword [ebx + 0x330]
call fcn.0042ce58
mov dword [ebx + 0x350], 1
cmp dword [ebx + 0x348], 0
jne 0x58c6f1
mov byte [ebx + 0x341], 1
mov eax, dword [ebp - 0xc]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4bbfb4]
call fcn.004bc0a8
mov dword [ebx + 0x348], eax
mov eax, dword [ebx + 0x348]
mov dword [ebx + 0x34c], eax
xor edx, edx
mov eax, dword [ebx + 0x330]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
jmp 0x58c78a
xor eax, eax
mov dword [ebx + 0x350], eax
xor edx, edx
mov eax, dword [ebx + 0x330]
call fcn.0042ce58
cmp dword [ebx + 0x344], 0
jne 0x58c749
mov byte [ebx + 0x340], 1
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4bbfb4]
call fcn.004bc0a8
mov dword [ebx + 0x344], eax
cmp dword [ebx + 0x348], 0
jne 0x58c771
mov byte [ebx + 0x341], 1
mov eax, dword [ebp - 0xc]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4bbfb4]
call fcn.004bc0a8
mov dword [ebx + 0x348], eax
mov eax, dword [ebx + 0x344]
mov dword [ebx + 0x34c], eax
mov dl, 1
mov eax, dword [ebx + 0x330]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xd8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58c7b6
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.00403d64
ret
Function at 0x595cbc
Capabilities:
Get disk information

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetLogicalDrives
mov ebx, eax
test bl, 1
je 0x595ce1
test bl, 2
je 0x595ce1
xor edx, edx
mov eax, dword [esi + 0x4c4]
call fcn.00445f2c
pop esi
pop ebx
ret
xor edx, edx
mov eax, dword [esi + 0x484]
call fcn.00445f2c
pop esi
pop ebx
ret
Function at 0x657f80
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 4
push ebx
push esi
push edi
push ebp
mov esi, dword [esp + 0x18]
mov byte [esp + 0x13], 0
lea eax, [esi + 4]
mov edi, dword [esp + 0x1c]
mov dword [esi], eax
mov ax, word [edi + 4]
mov word [esi + 4], ax
mov ax, word [edi + 0xa]
mov word [esi + 6], ax
mov ax, word [edi + 0x14]
mov word [esi + 0x16], ax
mov ax, word [edi + 8]
mov word [esi + 8], ax
mov ax, word [edi + 6]
mov word [esi + 0xa], ax
lea eax, [esi + 0x24]
mov dword [esi + 0x10], eax
lea eax, [esi + 4]
push eax
call fcn.00657e80
or al, al
jne 0x65810a
test byte [edi + 0x1c], 4
je 0x657fe3
mov byte [esp + 0x13], 1
sub cx, cx
sub dx, dx
lea esp, [esp]
mov ebp, ecx
and ebp, 0xffff
lea eax, [ebp*8]
sub eax, ebp
shl eax, 2
lea eax, [eax + eax*4]
lea ebx, [esi + eax]
lea eax, [ebp*4]
mov word [ebx + 0x36], cx
lea eax, [eax + eax*8]
lea ebp, [edi + eax]
mov ax, word [ebp + 0xe]
mov word [ebx + 0x9c], ax
mov ax, word [ebp + 0x12]
mov word [ebx + 0x8e], ax
mov ax, word [ebp + 0x16]
mov word [ebx + 0x34], ax
mov ax, word [ebp + 0x18]
mov word [ebx + 0x32], ax
mov eax, dword [ebp + 0x1c]
mov dword [ebx + 0x2c], eax
cmp cx, 3
mov eax, dword [ebp + 0x20]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp + 0x24]
mov dword [ebx + 0x28], eax
lea eax, [esi + 4]
mov dword [ebx + 0xa4], eax
jne 0x658070
mov dword [ebx + 0xa8], 0
jmp 0x65807c
lea eax, [ebx + 0xb0]
mov dword [ebx + 0xa8], eax
or cx, cx
jne 0x658090
mov dword [ebx + 0xac], 0
jmp 0x658099
lea eax, [ebx - 0x68]
mov dword [ebx + 0xac], eax
cmp byte [esp + 0x13], 0
je 0x6580b0
cmp word [ebp + 0xe], 0xffff
jne 0x6580b0
or dword [ebx + 0x2c], 8
jmp 0x6580b6
mov word [ebx + 0x36], dx
inc dx
inc cx
cmp cx, 4
jb 0x657ff0
push esi
call fcn.00657ef0
push esi
call fcn.00657e30
push esi
call fcn.00657df0
mov eax, dword [esi + 0x10]
push eax
call fcn.006592b0
mov word [esi + 0xc], ax
or ax, ax
je 0x658100
lea eax, [esi + 4]
push eax
call fcn.00659100
sub ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 8
push esi
call fcn.00657dc0
mov ax, 9
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 8

Function at 0x65a200
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push esi
push edi
lea eax, [esp + 0xa]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
push eax
push esi
call fcn.00658120
mov eax, dword [esp + 0xc]
push 0xd
mov ax, word [eax + 4]
push eax
call fcn.00659d30
or al, al
jne 0x65a28a
mov eax, dword [esp + 0x10]
push eax
push esi
call fcn.0065ab20
or al, al
jne 0x65a28a
mov eax, dword [esp + 0xc]
mov ax, word [eax + 0xa]
push eax
mov eax, dword [esp + 0x10]
mov al, byte [eax + 8]
push eax
mov eax, dword [esp + 0x14]
mov ax, word [eax + 6]
push eax
mov eax, dword [esp + 0x18]
mov ax, word [eax + 4]
push eax
mov eax, dword [esp + 0x20]
push eax
push esi
call fcn.0065a9e0
mov di, ax
mov eax, dword [esp + 0x10]
push eax
push esi
call fcn.0065ab70
or di, di
je 0x65a28a
mov ax, di
pop edi
pop esi
add esp, 0xc
ret 8
Function at 0x65a330
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [esp + 0xe]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
mov edi, dword [esp + 0x28]
push eax
mov esi, dword [esp + 0x28]
push edi
push esi
call fcn.00658120
lea eax, [esp + 0xe]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
push edi
push esi
call fcn.00658120
mov eax, dword [esp + 0x10]
push 0xe
mov ax, word [eax + 4]
push eax
call fcn.00659d30
or al, al
jne 0x65a413
mov eax, dword [esp + 0x14]
push eax
push esi
call fcn.0065ab20
mov bx, ax
or bl, bl
jne 0x65a3e2
mov eax, dword [esp + 0x10]
mov ax, word [eax + 0xe]
push eax
mov eax, dword [esp + 0x14]
mov ax, word [eax + 0xc]
push eax
mov eax, dword [esp + 0x18]
mov ax, word [eax + 0xa]
push eax
mov eax, dword [esp + 0x1c]
mov al, byte [eax + 8]
push eax
mov eax, dword [esp + 0x20]
mov ax, word [eax + 6]
push eax
mov eax, dword [esp + 0x24]
mov ax, word [eax + 4]
push eax
mov eax, dword [esp + 0x2c]
push eax
push esi
call fcn.0065aa30
mov bx, ax
mov eax, dword [esp + 0x14]
push eax
push esi
call fcn.0065ab70
push esi
call fcn.00658230
cmp ax, 0xd
jne 0x65a3f2
mov bx, 0xd
cmp bl, 0xd
je 0x65a3fd
cmp bx, 3
jne 0x65a410
mov ax, word [esp + 0xe]
dec word [esp + 0xe]
or ax, ax
jne 0x65a382
mov ax, bx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 8

Function at 0x65c5b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
mov byte [esp + 8], 0x53
mov byte [esp + 9], 0x59
mov byte [esp + 0xa], 0x53
mov byte [esp + 0xb], 0x54
mov byte [esp + 0xc], 0x45
mov byte [esp + 0xd], 0x4d
mov byte [esp + 0xe], 0x2e
mov byte [esp + 0xf], 0x49
mov byte [esp + 0x10], 0x4e
mov byte [esp + 0x11], 0x49
mov byte [esp + 0x12], 0
mov byte [esp + 0x14], 0x53
mov byte [esp + 0x15], 0x65
mov byte [esp + 0x16], 0x6e
mov byte [esp + 0x17], 0x74
mov byte [esp + 0x18], 0x69
mov byte [esp + 0x19], 0x6e
mov byte [esp + 0x1a], 0x65
mov byte [esp + 0x1b], 0x6c
mov byte [esp + 0x1c], 0x53
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x1e], 0x74
mov byte [esp + 0x1f], 0x75
mov byte [esp + 0x20], 0x70
mov byte [esp + 0x21], 0
mov byte [esp], 0x49
mov byte [esp + 1], 0x6f
lea eax, [esp + 8]
mov byte [esp + 2], 0x45
mov byte [esp + 3], 0x6e
mov byte [esp + 4], 0x74
mov byte [esp + 5], 0x72
mov byte [esp + 6], 0x79
mov byte [esp + 7], 0
push eax
lea eax, [esp + 4]
push 0
push eax
lea eax, [esp + 0x20]
push eax
call fcn.0065d9ee
add esp, 0x24
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4010d0
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_narrow_argv
call sym.__initialize_narrow_environment
call sym.___p___argc
mov ebx, dword [eax]
call sym.___p___argv
mov esi, dword [eax]
call sym.__get_initial_narrow_environment
mov edi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 8]
mov eax, dword [edx + 0x3c]
cmp word [edx + eax + 0x5c], 2
sete dl
movzx edx, dl
add edx, 1
mov dword [esp], edx
call sym.__set_app_type
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call dbg.main
mov dword [esp], eax
call sym._exit

Function at 0x401190
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
call dbg.__main
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov ebx, eax
movzx eax, byte [eax]
test al, al
je 0x40121e
cmp al, 9
je 0x401210
cmp al, 0x20
je 0x401210
xor edi, edi
mov dword [ebp - 0x6c], 0
lea esi, [esi]
cmp al, 0x5c
je 0x401274
cmp al, 0x22
je 0x401280
mov dword [ebp - 0x6c], 0
add ebx, 1
movzx eax, byte [ebx]
test al, al
je 0x40121e
cmp al, 9
sete cl
cmp al, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x4011d0
test edi, 1
jne 0x4011d0
nop
lea esi, [esi]
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x401210
cmp al, 0x20
je 0x401210
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
sub esp, 4
test byte [ebp - 0x30], 1
jne 0x401239
mov word [ebp - 0x2c], 1
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
sub esp, 4
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp + 0xc], esi
mov dword [esp], eax
call dbg.WinMain@16
sub esp, 0x10
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
add dword [ebp - 0x6c], 1
jmp 0x4011e7
and dword [ebp - 0x6c], 1
jne 0x4011e0
xor edi, 1
jmp 0x4011e7
Function at 0x10005050
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10061e00
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x10076040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ecx]
lea eax, [ebp - 0x1c]
push eax
call fcn.10007d40
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
movups xmm0, xmmword [ebp - 0x1c]
push 1
mov dword [esi + 0x10], 0
movups xmmword [esi], xmm0
mov dword [esi + 0x14], 0
xorps xmm0, xmm0
movups xmmword [ecx], xmm0
push 0x100667c4
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.10009af0
xorps xmm0, xmm0
mov eax, esi
movups xmmword [esi + 0x30], xmm0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0xf
mov byte [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10005100
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10061e00
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x10076040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ecx]
lea eax, [ebp - 0x1c]
push eax
call fcn.10007df0
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
movups xmm0, xmmword [ebp - 0x1c]
push 1
mov dword [esi + 0x10], 0
movups xmmword [esi], xmm0
mov dword [esi + 0x14], 0
xorps xmm0, xmm0
movups xmmword [ecx], xmm0
push 0x100667c4
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.10009af0
xorps xmm0, xmm0
mov eax, esi
movups xmmword [esi + 0x30], xmm0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0xf
mov byte [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10005520
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x1000554c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x10005574
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x1000557a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x100055e2
jg 0x10005591
test esi, esi
je 0x100055e2
test ecx, ecx
jl 0x100055dd
jg 0x1000559b
test eax, eax
je 0x100055dd
cmp edi, ecx
jg 0x100055af
jl 0x100055a5
cmp esi, eax
jae 0x100055af
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x100055e5
mov ecx, dword [ebp + 8]
jmp 0x100055ef
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x10005609
jg 0x100055ef
test esi, esi
je 0x10005609
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x10005609
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10005620
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test eax, eax
jg 0x1000564c
jl 0x10005640
test ecx, ecx
jne 0x1000564c
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10005665
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x100056ad
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 0xc], edx
mov eax, dword [eax]
test eax, eax
je 0x100056b3
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push dword [ebp - 4]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [ebp - 4], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp - 4]
jmp 0x100056b3
lea eax, [ebx + 0x2c]
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x4c], 0
je 0x10005726
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x100056dc
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x10005714
nop dword [eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x10005726
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x100056f0
test edi, edi
je 0x10005726
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc