joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4012b0
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push 0
push 0
push eax
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret 8

Function at 0x402540
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, 0xfe
and eax, 0xff
push esi
cdq
idiv ecx
mov esi, dword [esp + 0xc]
inc dl
test esi, esi
jbe 0x40256c
mov eax, dword [esp + 8]
mov cl, byte [eax]
sub cl, dl
xor cl, dl
mov byte [eax], cl
inc eax
dec esi
jne 0x402560
pop esi
ret

Function at 0x402570
Capabilities:
Contain obfuscated stackstrings
Get common file path
Move file

Disassembly:
sub esp, 0x21c
mov al, 0x65
push esi
mov byte [esp + 5], al
mov byte [esp + 0xc], al
mov byte [esp + 0x10], al
mov byte [esp + 0x14], al
lea eax, [esp + 4]
push edi
mov cl, 0x6c
push eax
push str.kernel32.dll
mov byte [esp + 0x10], 0x47
mov byte [esp + 0x12], 0x74
mov byte [esp + 0x13], 0x4d
mov byte [esp + 0x14], 0x6f
mov byte [esp + 0x15], 0x64
mov byte [esp + 0x16], 0x75
mov byte [esp + 0x17], cl
mov byte [esp + 0x19], 0x46
mov byte [esp + 0x1a], 0x69
mov byte [esp + 0x1b], cl
mov byte [esp + 0x1d], 0x4e
mov byte [esp + 0x1e], 0x61
mov byte [esp + 0x1f], 0x6d
mov byte [esp + 0x21], 0x41
mov byte [esp + 0x22], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, eax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x20]
push ecx
push 0
stosb byte es:[edi], al
call edx
lea edx, [esp + 0x120]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [esp + 0x120]
push str.SOFTWARE.LOG
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea ecx, [esp + 0x120]
push 3
lea edx, [esp + 0x20]
push ecx
push edx
call esi
test eax, eax
je 0x402660
push 5
lea eax, [esp + 0x124]
push 0
push eax
call esi
pop edi
pop esi
add esp, 0x21c
ret
Function at 0x402760
Capabilities:
Check if file exists
Get file attributes
Get file size
Read file on windows

Disassembly:
sub esp, 0x110
lea eax, [esp + 0xc]
push ebx
push esi
push edi
push str.SYSTEMCurrentControlSetServices_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x18]
push str.Distribudgp
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push 0xf003f
push 0
push eax
push 0x80000002
call dword [0x408d90]
test eax, eax
je 0x4027b5
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0x104
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x20]
push str.ImagePath
push eax
call dword [0x408d94]
test eax, eax
je 0x402801
mov ecx, dword [esp + 0x10]
push ecx
call dword [0x408d98]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
mov edx, dword [esp + 0x10]
push edx
call dword [0x408d98]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x402828
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
push 0
push 0
push 3
push 0
push 1
lea ecx, [esp + 0x2c]
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x402855
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
mov dword [esp + 0xc], eax
jne 0x402879
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x40289b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
mov eax, dword [esp + 0xc]
lea edx, [esp + 0xc]
push 0
push edx
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4028cd
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x120]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
mov esi, eax
test esi, esi
jne 0x4028fd
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
mov edx, dword [esp + 0xc]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_UpdateResourceA]
push edx
push ebx
push 0
push 0x66
push 0xa
push esi
call ebp
mov edi, eax
test edi, edi
je 0x402936
push str.Distribudgp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push str.Distribudgp
push 0
push 0x65
push 0xa
push esi
call ebp
mov edi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
pop ebp
test eax, eax
push ebx
jne 0x402957
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x110
ret
Function at 0x403f00
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp]
push str.Program_FilesInternet_Exploreriexplore.exe
push ecx
mov byte [esp + 0xa], 0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [esp + 0x108]
lea edx, [esp]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, 1
add esp, 0x104
ret

Function at 0x412ab4
Capabilities:
Encode data using xor

Disassembly:
push 0xfabaead7
sub ah, al
mov esi, 0x5aa0bcb
call fcn.0041293e
xchg edx, ecx
mov dword [ebp - 0x20f], esi
push 0x6732c513
jmp 0x412c74
call fcn.0041293e
lea eax, [esp + 0x28]
mov dword [esp + 0x4c], esi
not cl
and dl, 0x3a
not ch
not ecx
xchg esi, eax
push 0x20
mov edi, dword [esp + 0x4c]
push 8
push esp
call edi
call dword [esp + 0x50]
xor edx, 0x6e
dec byte [esp]
jne 0x412c91
mov dh, 0x4e
and cl, cl
pop eax
push 1
call fcn.00412a9f
mov dword [esi + 0x14], 0xc
pop dword [esi + 0x1c]
lea eax, [ebp + 0x249]
push eax
mov dword [esi + 0x18], esi
sub byte [esi + 2], 0xfc
push 4
push 3
lea esi, [esi + 0x14]
cmp edx, 0x3d
push esi
add dword [ebp + 0x1ef], ebp
add dh, dl
adc cl, 0x12
call dword [0xfffffdf1]
lea edx, [ebx + 0x1d]
sub dword [ebp + 0x1ef], ebp
xor ch, 0xeb
ret

Function at 0x405c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x405c57
lcall 0x5de5, 0x8b10c483
jmp loc.007e3f1c
Function at 0x10005914
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x10005923
pop dword [ebp - 0x10]
mov eax, 0x10005923
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xa7cd030a
add dword [ebp - 0x20], 0xa6854241
mov dword [ebp - 0x1c], 0xb6b64281
sub dword [ebp - 0x1c], 0x8482f63c
mov dword [ebp - 0x18], 0xb8b5c8b
add dword [ebp - 0x18], 0x40c0e7a3
mov dword [ebp - 0x14], 0xf0cb2b3e
sub dword [ebp - 0x14], 0xf0cb2b3e
lea eax, [ebp - 0x20]
push eax
mov eax, 0x4b521212
add eax, 0xc4adfe4a
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xb6db183d
add dword [ebp - 0x20], 0xbd975119
mov dword [ebp - 0x1c], 0xefddeead
sub dword [ebp - 0x1c], 0xae718d38
mov dword [ebp - 0x18], 0x36245bef
add dword [ebp - 0x18], 0x2d4b107d
mov dword [ebp - 0x14], 0xd31c81cf
sub dword [ebp - 0x14], 0xd31c81cf
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xa082a79
sub eax, 0xfa081a21
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3c084
push 0
call eax
mov ecx, 0x7dc4028f
sub ecx, 0x7dc3aaf4
xor esi, esi
add esi, eax
mov edi, 0xec4bbdad
sub edi, 0xdc4a8dad
add edi, dword [ebp - 0x10]
mov ebx, 0xf91e0c4
add ebx, 0x7c44d3bb
xor dword [ebp - 4], 0xe3c41185
mov edx, dword [edi]
sub dword [ebp - 8], 0xc39b6335
sub edx, ebx
xor dword [ebp - 8], edi
mov dword [esi], edx
sub dword [ebp - 8], 0x535b837c
add esi, 0xdeb5d86a
sub esi, 0xdeb5d866
add edi, 4
loop 0x10005a42
add eax, 0x89a8d711
add eax, 0x76587a2e
xor ebx, ebx
add ebx, eax
add eax, 0x6acd491f
sub eax, 0x6acd491a
mov ecx, 0x5c920ef8
add ecx, 0xb36df108
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x10008277
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x1000c383
call fcn.1000b72f
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x428], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test edi, edi
je 0x1000844b
push edi
call dword [sym.imp.kernel32.dll_lstrlenW]
inc eax
push 2
push eax
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x41c]
push eax
call fcn.10005914
add esp, 0xc
test eax, eax
js 0x10008445
mov esi, dword [ebp - 0x41c]
cmp esi, 0x400
jg 0x10008313
push esi
call fcn.10004bbf
pop ecx
test al, al
je 0x10008313
mov eax, esi
call fcn.1000ba01
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x1000831f
push esi
lea ecx, [ebp - 0x428]
call fcn.10005914
push 3
push esi
push edi
push eax
call fcn.10005914
test eax, eax
je 0x10008445
push 2
push ebx
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov edi, eax
mov dword [ebp - 0x41c], edi
test edi, edi
jne 0x10008353
call fcn.10004ded
mov esi, eax
jmp 0x1000842a
push dword [ebp - 0x424]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x10008376
call fcn.10004ded
jmp 0x10008421
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x424], eax
test eax, eax
je 0x1000836c
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
mov dword [ebp - 0x420], esi
cmp eax, esi
jae 0x100083a6
mov esi, 0x8007000e
jmp 0x10008423
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.10005914
mov dword [ebp - 4], 1
jmp 0x100083e5
cmp dword [ebp - 0x418], 0
je 0x1000839f
push esi
push dword [ebp - 0x424]
push esi
push dword [ebp - 0x418]
call fcn.10005914
mov eax, dword [ebp - 0x418]
add esp, 0x10
push dword [ebp + 0x14]
mov byte [eax + esi], bl
push dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
call fcn.10005914
mov esi, eax
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10008465
lea ecx, [ebp - 0x418]
call fcn.100084ce
jmp 0x10008465
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x10008460
lea ecx, [ebp - 0x418]
call fcn.100084ce
mov esi, 0x8007000e
lea ecx, [ebp - 0x428]
call fcn.10004d27
mov eax, esi
lea esp, [ebp - 0x444]
call fcn.1000b788
ret 0x10
Function at 0x1000a997
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10001fc0]
jne 0x1000b8a4
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x1000ee40], eax
mov dword [0x1000ee3c], ecx
mov dword [0x1000ee38], edx
mov dword [0x1000ee34], ebx
mov dword [0x1000ee30], esi
mov dword [0x1000ee2c], edi
mov word [0x1000ee58], ss
mov word [0x1000ee4c], cs
mov word [0x1000ee28], ds
mov word [0x1000ee24], es
mov word [0x1000ee20], fs
mov word [0x1000ee1c], gs
pushfd
pop dword [0x1000ee50]
mov eax, dword [ebp]
mov dword [0x1000ee44], eax
mov eax, dword [ebp + 4]
mov dword [0x1000ee48], eax
lea eax, [ebp + 8]
mov dword [0x1000ee54], eax
mov eax, dword [ebp - 0x320]
mov dword [0x1000ed90], 0x10001
mov eax, dword [0x1000ee48]
mov dword [0x1000ed44], eax
mov dword [0x1000ed38], 0xc0000409
mov dword [0x1000ed3c], 1
mov eax, dword [0x10001fc0]
mov dword [ebp - 0x328], eax
mov eax, dword [0x1000ea64]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x1000ed88], eax
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x100021c0
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x1000ed88], 0
jne 0x1000b990
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x401350
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
je 0x4013ce
lea eax, [edi + 1]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 8], eax
test eax, eax
je 0x4013e6
push 0
lea eax, [ebp - 4]
push eax
push edi
mov eax, dword [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4013e6
mov eax, dword [ebp - 8]
push eax
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4013e6
push 0x40
push str.Eureur_
push str.Impossible_de_charger_le_fichier
mov eax, dword [0x40480c]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x401400
Capabilities:
Get graphical window text
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x401488
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov edi, eax
test edi, edi
je 0x4014a0
lea eax, [edi + 1]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 8], eax
test eax, eax
je 0x4014a0
push edi
mov eax, dword [ebp - 8]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x4014a0
push 0
lea eax, [ebp - 4]
push eax
push edi
mov eax, dword [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4014a0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4014a0
push 0x40
push str.Eureur_
push str.Impossible_de_Sauvegarder_le_fichier
mov eax, dword [0x40480c]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4014b0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4030d4
push 0x4015d8
push dword fs:[0]
mov dword fs:[0], esp
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x2000000
call fcn.00402080
pop ecx
mov dword [0x404584], eax
call fcn.00401870
test eax, eax
jne 0x4014f7
push 1
call fcn.00401960
pop ecx
mov dword [ebp - 4], 0
call fcn.00401970
call fcn.004019e0
call fcn.00401a30
call fcn.00401e10
call fcn.00401eb0
mov ebx, 0x403138
jmp 0x401523
call dword [ebx]
add ebx, 4
cmp ebx, 0x403138
jb 0x40151e
mov dword [ebp - 0x34], 0
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
call fcn.00401f70
test byte [ebp - 0x34], 1
je 0x401557
movzx edx, word [ebp - 0x30]
jmp 0x40155c
mov edx, 0xa
push edx
push eax
push 0
push ebx
call section..text
mov ebx, eax
mov esi, 0x403138
jmp 0x401574
call dword [esi]
add esi, 4
cmp esi, 0x403138
jb 0x40156f
push ebx
call fcn.00401fb0
pop ecx
jmp 0x4015ad
or dword [ebp - 4], 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x401e10
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebx, eax
cmp byte [ebx], 0
jne 0x401e42
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ebx, [ebp - 0x10c]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push ebx
call fcn.00401c80
add esp, 0x14
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
lea eax, [edx + eax*4]
push eax
call fcn.00402650
pop ecx
mov esi, eax
test esi, esi
jne 0x401e75
push 1
call fcn.00401960
pop ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
lea eax, [esi + eax*4]
push eax
push esi
push ebx
call fcn.00401c80
add esp, 0x14
mov eax, dword [ebp - 4]
dec eax
mov dword [0x40456c], eax
mov dword [0x404570], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401eb0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test eax, eax
jne 0x401ecb
mov ebx, dword [0x404640]
mov esi, ebx
xor ecx, ecx
jmp 0x401eee
mov edx, esi
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x401ed6
inc eax
mov dword [ebp - 4], eax
cmp byte [esi], 0x3d
je 0x401ee9
add ecx, dword [ebp - 4]
mov eax, dword [ebp - 4]
add esi, eax
cmp byte [esi], 0
jne 0x401ed1
lea eax, [ecx + 1]
push eax
call fcn.00402650
pop ecx
mov edi, eax
mov dword [0x404578], eax
cmp dword [0x404578], 0
jne 0x401f15
push 1
call fcn.00401960
pop ecx
mov esi, ebx
jmp 0x401f4a
mov edx, esi
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x401f1e
inc eax
mov dword [ebp - 4], eax
cmp byte [esi], 0x3d
je 0x401f45
mov ecx, edi
mov edx, esi
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x401f35
pop eax
mov eax, dword [ebp - 4]
add edi, eax
mov eax, dword [ebp - 4]
add esi, eax
cmp byte [esi], 0
jne 0x401f19
mov byte [edi], 0
cmp ebx, dword [0x404640]
je 0x401f61
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5003972
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov eax, esi
shr eax, 2
push edi
mov edi, eax
dec eax
test edi, edi
jle 0x50039b2
lea edi, [eax + 1]
movzx eax, byte [ecx]
inc ecx
xor ebx, ebx
mov bh, byte [ecx]
or eax, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or eax, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or eax, ebx
inc ecx
xor edx, eax
dec edi
jne 0x5003990
and esi, 3
xor eax, eax
dec esi
je 0x50039ce
dec esi
je 0x50039c7
dec esi
jne 0x50039d3
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor ebx, ebx
mov bh, byte [ecx]
or eax, ebx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
pop edi
pop esi
xor eax, edx
pop ebx
ret 0xc

Function at 0x408a9b
Capabilities:
Encode data using xor

Disassembly:
imul eax, dword [edi], 0x3e0ebd5e
mov ah, 0x33
push ds
popfd
mov ebp, 0x7962db28
mov ah, 0xd0
jbe 0x408a50
dec ecx
lds esi, [ecx]
mov cl, 0xd7
pop es
fiadd word [edx - 0x606f9986]
jle 0x408a54
lds esi, [0xd0831e74]
cmpsd dword [si], dword es:[di]
pop edx
cdq
push edi
add bh, ah
test eax, 0xba61d0a8
invalid
imul esp, dword [edi], 0x81d53dbd
fcom dword [edx + 0x73]
sbb eax, 0x7dd07352
imul eax, dword [ecx + esi*8 - 0x62c06c2a], 0x80b49330
cmp ebp, eax
sar byte [ebp + 0x69], 1
test cl, dh
salc
xchg ebx, eax
aas
popfd
xor byte [ebx - 0x3ac67f4c], dl
xor al, 0x82
fimul dword [edi]
push edx
cmp byte [edi - 0x3879199], ah
cld
sub ah, byte [ebx]
leave
inc byte [esi - 0x15868f7e]
jp 0x408a4b
jp 0x408a00
mov edx, 0xff6c7492
add byte [edx], ch
inc ebx
add byte [ecx], 0x3e
cdq
out 0xa2, al
das
pushfd
out 0xd7, eax
movsd dword es:[edi], dword [esi]
add al, 0xb6
xor byte [esi + esi*8 + 0x72c15e14], bh
inc edx
jp 0x408a8d
salc
xchg ebx, eax
js 0x408a6d
dec edx
dec eax
and byte [edx + 0x7d90c261], bl
ljmp 0xe71f

Function at 0x44d204
Capabilities:
Encode data using xor

Disassembly:
lcall 0x29c6, 0x83e23a30
inc esi
xor dword [ecx + 0x51fafb9c], edx
ja 0x44d276
inc ebx
add dword [esi - 0x14df3a8d], ecx
iretd
jecxz 0x44d28c
or al, 0xe
push es
cmp dword [edi - 0x61e3368c], esp
ret 0x808c
in eax, 0x60
aas
add ecx, dword [ebx - 0x64]
pushfd
arpl word [esi + 0x73408a31], cx
xchg ebx, eax
invalid
Function at 0x1000a8c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1006d080]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push ecx
push dword [ebp + 8]
mov ecx, 0x10095fa8
call fcn.10009d70
push 0x10095fa8
push 0x10065938
push 1
push 0x10095910
call fcn.100170a0
add esp, 0x1c
lea eax, [ebp - 8]
push eax
call dword [sym.imp.SHELL32.dll_SHQueryUserNotificationState]
mov eax, dword [ebp - 8]
cmp eax, 2
je 0x1000a93c
cmp eax, 3
je 0x1000a93c
cmp eax, 4
je 0x1000a93c
push 0x41010
push str.CLEO_error
push 0x10095fa8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100321a8
mov esp, ebp
pop ebp
ret
push 0
push 0xf020
push 0x112
push 0
call dword [sym.imp.USER32.dll_PostMessageA]
push 6
push 0
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x41010
push str.CLEO_error
push 0x10095fa8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0xf120
push 0x112
push 0
call dword [sym.imp.USER32.dll_PostMessageA]
push 9
push 0
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100321a8
mov esp, ebp
pop ebp
ret

Function at 0x1000b8d0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1006d080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
cmp byte [eax], 0
jne 0x1000b9f3
push ebx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
mov ecx, dword [esi + 0x3c]
add ecx, esi
movzx ebx, word [ecx + 0x14]
movzx eax, word [ecx + 6]
add ebx, 0x18
add ebx, ecx
mov dword [ebp - 0xc], eax
test eax, eax
je 0x1000b9eb
push edi
nop dword [eax + eax]
mov ecx, str..text
mov eax, ebx
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1000b947
test dl, dl
je 0x1000b943
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1000b947
add eax, 2
add ecx, 2
test dl, dl
jne 0x1000b927
xor eax, eax
jmp 0x1000b94c
sbb eax, eax
or eax, 1
test eax, eax
je 0x1000b980
mov eax, 0x10064540
mov ecx, ebx
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x1000b977
test dl, dl
je 0x1000b973
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x1000b977
add ecx, 2
add eax, 2
test dl, dl
jne 0x1000b957
xor eax, eax
jmp 0x1000b97c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1000b9d8
mov edi, dword [ebx + 8]
add edi, 0xfff
and edi, 0xfffff000
push edi
push dword [ebx + 0xc]
push ebx
push str.Unprotecting_memory_region__s:_0x_08X__size:_0x_08X_
push 3
call fcn.1000a880
mov eax, dword [ebx + 0x24]
lea ecx, [ebp - 8]
and eax, 0x20000000
add esp, 0x14
neg eax
sbb eax, eax
and eax, 0x3c
add eax, 4
push ecx
push eax
mov eax, dword [ebx + 0xc]
push edi
add eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1000b9d8
push str.Virtual_protect_error
call fcn.1000a8c0
add esp, 4
mov edx, dword [ebp - 0xc]
add ebx, 0x28
dec edx
mov dword [ebp - 0xc], edx
test edx, edx
jne 0x1000b920
pop edi
mov eax, dword [ebp - 0x10]
pop esi
pop ebx
mov byte [eax], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100321a8
mov esp, ebp
pop ebp
ret