joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bff9b
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [0x541178]
mov esi, ecx
test eax, eax
je 0x4c006e
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x4bffcc
cmp dword [eax + 4], 0
mov ebx, eax
je 0x4bffcc
add ebx, 8
jmp 0x4c0067
mov eax, dword [0x541178]
test eax, eax
je 0x4c007d
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
je 0x4c0041
mov edi, eax
test eax, eax
jne 0x4c0027
mov al, byte [0x5c91e8]
mov ecx, 0x10
mov edx, 4
call fcn.0041aa20
test eax, eax
je 0x4c0098
mov dword [eax], 0x541178
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x541178]
test eax, eax
je 0x4c008c
dec eax
push edi
push eax
call sub.kernel32.dll_TlsSetValue
test esi, esi
je 0x4c0045
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
mov edx, eax
je 0x4c0049
mov eax, dword [esi + 4]
mov edx, dword [esi + 8]
jmp 0x4c0049
xor ebx, ebx
jmp 0x4c0067
xor eax, eax
xor edx, edx
mov ecx, dword [edi + 0xc]
cmp dword [edi + 4], 0
lea ebx, [edi + 8]
mov dword [edi + 4], 1
mov dword [edi + 8], eax
mov dword [edi + 0xc], edx
je 0x4c0067
call fcn.004bff7a
mov eax, ebx
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x541178
call fcn.004832d0
jmp 0x4bffb1
mov ecx, 0x541178
call fcn.004832d0
jmp 0x4bffda
mov ecx, 0x541178
call fcn.004832d0
jmp 0x4c0020
mov ecx, 4
mov edx, 0x10
call fcn.0041b1c0
ud2
Function at 0x4c44d4
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [0x541198]
mov esi, ecx
test eax, eax
je 0x4c45a7
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x4c4505
cmp dword [eax + 4], 0
mov ebx, eax
je 0x4c4505
add ebx, 8
jmp 0x4c45a0
mov eax, dword [0x541198]
test eax, eax
je 0x4c45b6
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
je 0x4c457a
mov edi, eax
test eax, eax
jne 0x4c4560
mov al, byte [0x5c91e8]
mov ecx, 0x10
mov edx, 4
call fcn.0041aa20
test eax, eax
je 0x4c45d1
mov dword [eax], 0x541198
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x541198]
test eax, eax
je 0x4c45c5
dec eax
push edi
push eax
call sub.kernel32.dll_TlsSetValue
test esi, esi
je 0x4c457e
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
mov edx, eax
je 0x4c4582
mov eax, dword [esi + 4]
mov edx, dword [esi + 8]
jmp 0x4c4582
xor ebx, ebx
jmp 0x4c45a0
xor eax, eax
xor edx, edx
mov ecx, dword [edi + 0xc]
cmp dword [edi + 4], 0
lea ebx, [edi + 8]
mov dword [edi + 4], 1
mov dword [edi + 8], eax
mov dword [edi + 0xc], edx
je 0x4c45a0
call fcn.004bff7a
mov eax, ebx
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x541198
call fcn.004832d0
jmp 0x4c44ea
mov ecx, 0x541198
call fcn.004832d0
jmp 0x4c4513
mov ecx, 0x541198
call fcn.004832d0
jmp 0x4c4559
mov ecx, 4
mov edx, 0x10
call fcn.0041b1c0
ud2
Function at 0x4c45e2
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x541188]
mov esi, ecx
test eax, eax
je 0x4c46ea
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x4c4612
cmp dword [eax + 4], 0
mov edi, eax
jne 0x4c46d9
mov eax, dword [0x541188]
test eax, eax
je 0x4c46f9
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
je 0x4c46de
mov edi, eax
test eax, eax
jne 0x4c4675
mov al, byte [0x5c91e8]
mov ecx, 0x18
mov edx, 4
call fcn.0041aa20
test eax, eax
je 0x4c4717
mov dword [eax], 0x541188
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x541188]
test eax, eax
je 0x4c4708
dec eax
push edi
push eax
call sub.kernel32.dll_TlsSetValue
xor eax, eax
lea ecx, [edi + 4]
test esi, esi
je 0x4c469a
cmp dword [esi], 0
mov dword [esi], 0
je 0x4c469a
mov edx, dword [esi + 4]
mov eax, dword [esi + 8]
mov ebx, dword [esi + 0x10]
mov esi, dword [esi + 0xc]
mov dword [ebp - 0x10], esi
jmp 0x4c469c
xor edx, edx
mov esi, dword [ecx + 0x10]
mov dword [ebp - 0x14], esi
movsd xmm0, qword [ecx]
movsd xmm1, qword [ecx + 8]
mov ecx, dword [ebp - 0x10]
movsd qword [ebp - 0x1c], xmm1
movsd qword [ebp - 0x24], xmm0
mov dword [edi + 4], 1
mov dword [edi + 8], edx
mov dword [edi + 0xc], eax
mov dword [edi + 0x14], ebx
mov dword [edi + 0x10], ecx
cmp dword [ebp - 0x24], 0
je 0x4c46d9
lea ecx, [ebp - 0x1c]
call fcn.004c44b1
add edi, 8
jmp 0x4c46e0
xor edi, edi
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x541188
call fcn.004832d0
jmp 0x4c45fb
mov ecx, 0x541188
call fcn.004832d0
jmp 0x4c4620
mov ecx, 0x541188
call fcn.004832d0
jmp 0x4c466e
mov ecx, 4
mov edx, 0x18
call fcn.0041b1c0
ud2
Function at 0x4d072c
Capabilities:
Decrypt data via sspi

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x40
mov ebx, ecx
mov edi, edx
mov ecx, dword [edx + 0x48]
mov edx, dword [edx + 0x58]
cmp edx, ecx
jb 0x4d0892
mov esi, dword [edi + 0x50]
xor eax, eax
lea edx, [ebp - 0x40]
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [edx + 0x2c], eax
mov dword [edx], ecx
lea ecx, [ebp - 0x4c]
mov dword [edx + 4], 1
mov dword [ecx], eax
mov dword [ecx + 4], 4
mov dword [ecx + 8], edx
mov dword [edx + 8], esi
mov dword [edx + 0x10], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x1c], eax
lea edx, [edi + 0x78]
push eax
push eax
push ecx
push edx
call sub.secur32.dll_DecryptMessage
cmp eax, 0x90316
jg 0x4d0823
cmp eax, 0x80090318
je 0x4d086a
test eax, eax
jne 0x4d085f
mov ecx, dword [ebp - 0x2c]
mov edx, dword [edi + 0x50]
mov esi, dword [ebp - 0x34]
mov eax, dword [edi + 0x58]
mov dword [ebp - 0x10], ebx
mov dword [edi + 0x40], 0
sub ecx, edx
mov ebx, ecx
add ebx, esi
jb 0x4d08a1
cmp eax, ebx
jb 0x4d08af
add edx, ecx
lea eax, [edi + 0x38]
add esi, edx
mov ecx, eax
push esi
call fcn.004ba2b7
add esp, 4
xor eax, eax
cmp dword [ebp - 0x18], 5
mov dword [edi + 0x34], eax
mov dword [edi + 0x30], eax
mov edx, dword [edi + 0x48]
jne 0x4d07ff
mov eax, dword [ebp - 0x1c]
sub edx, eax
mov ecx, edi
call fcn.004d06af
mov eax, dword [edi + 0x48]
xor ecx, ecx
or eax, dword [edi + 0x4c]
mov eax, dword [ebp - 0x10]
sete cl
mov word [eax], 4
mov dword [edi + 0x98], ecx
jmp 0x4d088a
cmp eax, 0x90317
je 0x4d0875
cmp eax, 0x90321
jne 0x4d085f
mov dword [edi + 8], 0x10000
mov byte [edi + 0xc], 0
xor eax, eax
cmp dword [ebp - 0x18], 5
mov edx, dword [edi + 0x48]
jne 0x4d084a
mov eax, dword [ebp - 0x1c]
sub edx, eax
mov ecx, edi
call fcn.004d06af
mov dword [edi + 0x98], 0
jmp 0x4d0885
mov dword [ebx + 4], eax
mov dword [ebx], 0
jmp 0x4d088a
cmp dword [ebp - 0x30], 4
jne 0x4d087c
mov eax, dword [ebp - 0x34]
jmp 0x4d087f
mov word [ebx], 0x104
jmp 0x4d088a
xor eax, eax
inc eax
mov dword [edi + 0x98], eax
mov word [ebx], 4
add esp, 0x40
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x5a3eb4
call fcn.00445020
add esp, 4
ud2
mov edx, ebx
push 0x5a3ec4
call fcn.00446290
jmp 0x4d089c
mov ecx, ebx
mov edx, eax
push 0x5a3ec4
jmp 0x4d0897
Function at 0x52cd0a
Capabilities:
Decrypt data via sspi

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x40
mov ebx, ecx
mov edi, edx
mov ecx, dword [edx + 0x68]
mov edx, dword [edx + 0x78]
cmp edx, ecx
jb 0x52ce73
mov esi, dword [edi + 0x70]
xor eax, eax
lea edx, [ebp - 0x40]
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [edx + 0x2c], eax
mov dword [edx], ecx
lea ecx, [ebp - 0x4c]
mov dword [edx + 4], 1
mov dword [ecx], eax
mov dword [ecx + 4], 4
mov dword [ecx + 8], edx
mov dword [edx + 8], esi
mov dword [edx + 0x10], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x1c], eax
lea edx, [edi + 0x98]
push eax
push eax
push ecx
push edx
call sub.secur32.dll_DecryptMessage
cmp eax, 0x90316
jg 0x52ce04
cmp eax, 0x80090318
je 0x52ce4b
test eax, eax
jne 0x52ce40
mov ecx, dword [ebp - 0x2c]
mov edx, dword [edi + 0x70]
mov esi, dword [ebp - 0x34]
mov eax, dword [edi + 0x78]
mov dword [ebp - 0x10], ebx
mov dword [edi + 0x60], 0
sub ecx, edx
mov ebx, ecx
add ebx, esi
jb 0x52ce82
cmp eax, ebx
jb 0x52ce90
add edx, ecx
lea eax, [edi + 0x58]
add esi, edx
mov ecx, eax
push esi
call fcn.004ba2b7
add esp, 4
xor eax, eax
cmp dword [ebp - 0x18], 5
mov dword [edi + 0x54], eax
mov dword [edi + 0x50], eax
mov edx, dword [edi + 0x68]
jne 0x52cde0
mov eax, dword [ebp - 0x1c]
sub edx, eax
mov ecx, edi
call fcn.0052cf99
mov eax, dword [edi + 0x68]
xor ecx, ecx
or eax, dword [edi + 0x6c]
mov eax, dword [ebp - 0x10]
sete cl
mov word [eax], 4
mov dword [edi + 0xb8], ecx
jmp 0x52ce6b
cmp eax, 0x90317
je 0x52ce56
cmp eax, 0x90321
jne 0x52ce40
mov dword [edi + 0x38], 0x10000
mov byte [edi + 0x3c], 0
xor eax, eax
cmp dword [ebp - 0x18], 5
mov edx, dword [edi + 0x68]
jne 0x52ce2b
mov eax, dword [ebp - 0x1c]
sub edx, eax
mov ecx, edi
call fcn.0052cf99
mov dword [edi + 0xb8], 0
jmp 0x52ce66
mov dword [ebx + 4], eax
mov dword [ebx], 0
jmp 0x52ce6b
cmp dword [ebp - 0x30], 4
jne 0x52ce5d
mov eax, dword [ebp - 0x34]
jmp 0x52ce60
mov word [ebx], 0x104
jmp 0x52ce6b
xor eax, eax
inc eax
mov dword [edi + 0xb8], eax
mov word [ebx], 4
add esp, 0x40
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x5a3eb4
call fcn.00445020
add esp, 4
ud2
mov edx, ebx
push 0x5a3ec4
call fcn.00446290
jmp 0x52ce7d
mov ecx, ebx
mov edx, eax
push 0x5a3ec4
jmp 0x52ce78
Function at 0x5305d1
Capabilities:
Encrypt data via sspi

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
lea ebx, [ebp - 0x48]
mov esi, ecx
mov edi, edx
mov ecx, ebx
call fcn.0052c1fe
mov eax, dword [ebx]
cmp eax, 2
jne 0x5305fa
mov ebx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
jmp 0x530768
test eax, eax
je 0x53075c
mov ebx, dword [edi + 0x90]
mov eax, dword [edi + 0x80]
xor eax, ebx
or eax, dword [edi + 0x84]
jne 0x530735
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x44]
cmp eax, ecx
mov dword [ebp - 0x10], edx
cmovb ecx, eax
lea eax, [ecx + edx]
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x14], ecx
add edx, eax
sub edx, ebx
jbe 0x530654
lea ecx, [edi + 0x88]
mov ebx, eax
call fcn.00461408
mov eax, ebx
mov ecx, dword [ebp - 0x14]
mov ebx, dword [edi + 0x90]
cmp eax, dword [ebp - 0x10]
jb 0x530775
cmp ebx, eax
mov dword [ebp - 0x18], eax
jb 0x530786
mov eax, dword [edi + 0x88]
add eax, dword [ebp - 0x10]
push ecx
push dword [ebp + 8]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
cmp ebx, dword [ebp - 0x10]
jb 0x530792
mov edx, dword [edi + 0x90]
mov eax, dword [ebp - 0x18]
mov ecx, edx
sub ecx, eax
mov dword [ebp - 0x4c], ecx
jb 0x53079e
mov edx, dword [edi + 0x88]
mov ecx, dword [ebp - 0x10]
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], 7
add ecx, edx
add eax, edx
mov dword [ebp - 0x40], edx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], 6
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x48]
mov dword [eax], ebx
mov dword [eax + 4], 4
mov dword [eax + 8], ecx
lea ecx, [edi + 0x98]
push ebx
push eax
push ebx
push ecx
call sub.secur32.dll_EncryptMessage
test eax, eax
jne 0x530768
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x30]
cmp dword [edi + 0x90], eax
jb 0x53071e
mov dword [edi + 0x90], eax
mov ecx, dword [ebp - 0x14]
xor eax, eax
mov dword [edi + 0x84], eax
mov dword [edi + 0x80], eax
mov dword [edi + 0xbc], ecx
lea ebx, [ebp - 0x48]
mov edx, edi
mov ecx, ebx
call fcn.0052d05c
cmp byte [ebx], 4
je 0x53074e
mov ebx, dword [ebp - 0x48]
cmp bl, 4
jne 0x530765
mov eax, dword [edi + 0xbc]
mov dword [esi + 4], eax
mov byte [esi], 4
jmp 0x53076d
mov eax, 0x80090317
xor ebx, ebx
jmp 0x530768
mov eax, dword [ebp - 0x44]
mov dword [esi], ebx
mov dword [esi + 4], eax
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp - 0x10]
mov edx, eax
push 0x5a3ed4
call fcn.00446290
jmp 0x5307aa
mov ecx, dword [ebp - 0x18]
mov edx, ebx
push 0x5a3ed4
jmp 0x5307a5
mov ecx, dword [ebp - 0x10]
mov edx, ebx
push 0x5a3ee4
jmp 0x5307a5
mov ecx, eax
push 0x5a3ef4
call fcn.00445020
add esp, 4
ud2
Function at 0x53df20
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.0053eca0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.0053eca0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x53df80
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x5c9254]
test esi, esi
jle 0x53e0a0
mov eax, dword [0x5c9258]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x53dfb4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x53e037
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x53dfa0
mov dword [esp], ebx
call fcn.0053e970
mov edi, eax
test eax, eax
je 0x53e0c7
mov eax, dword [0x5c9258]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.0053eab0
mov edx, dword [0x5c9258]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x53e0a7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x53e030
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x53e040
add dword [0x5c9254], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x5c9258]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x53e030
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.0053df20
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x53dfbe
mov eax, dword [0x5c9258]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.0053df20
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.0053df20
lea esi, [esi]
nop
Function at 0x53e5e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x5c9270
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x5c9268]
sub esp, 4
test ebx, ebx
je 0x53e635
mov ebp, dword [sym.imp.kernel32.dll_TlsGetValue]
mov edi, dword [sym.imp.kernel32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x53e62e
test esi, esi
je 0x53e62e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x53e610
mov dword [esp], 0x5c9270
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x53e970
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x53e995
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x53e9a0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x53e995
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x53e9e8
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x53e9de
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x53e9ea
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x53e9d0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x40ef98
Capabilities:
Create pipe

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x84], edi
jne 0x40f035
push edi
xor ebx, ebx
mov dword [esi + 0x84], 2
inc ebx
push ebx
push edi
call dword [sym.imp.kernel32.dll_CreateMutexW]
mov dword [esi + 0x44], eax
test eax, eax
je 0x40f035
push edi
push edi
push ebx
push edi
call dword [sym.imp.kernel32.dll_CreateEventW]
mov dword [esi + 0x9c], eax
test eax, eax
je 0x40f035
push 4
push 0xffffffffffffffff
push esi
push 0x40f74f
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.kernel32.dll_RegisterWaitForSingleObject]
test eax, eax
je 0x40f035
lea eax, [esi + 0x20]
cmp dword [eax + 0x14], 8
jb 0x40f000
mov eax, dword [eax]
push dword [esi + 0x38]
push edi
push 0x40
push 0x40
push ebx
push 6
push 0x40080003
push eax
call dword [sym.imp.kernel32.dll_CreateNamedPipeW]
mov dword [esi + 0x3c], eax
cmp eax, 0xffffffff
je 0x40f035
push dword [esi + 0x9c]
call dword [sym.imp.kernel32.dll_SetEvent]
test eax, eax
jne 0x40f03b
mov dword [esi + 0x84], ebx
xor al, al
pop edi
pop esi
pop ebx
ret
mov al, bl
jmp 0x40f037

Function at 0x413985
Capabilities:
Identify system language via api

Disassembly:
push ebx
mov ebx, ecx
push esi
test dl, dl
je 0x413995
call dword [sym.imp.kernel32.dll_GetSystemDefaultLangID]
jmp 0x41399b
call dword [sym.imp.kernel32.dll_GetUserDefaultLangID]
xor edx, edx
movzx esi, ax
mov ecx, 0x409
push edi
mov edi, edx
mov eax, ecx
cmp si, ax
je 0x4139c3
inc edi
imul eax, edi, 0x1a
movzx eax, word [eax + 0x438830]
test ax, ax
jne 0x4139aa
mov esi, ecx
jmp 0x4139c6
movzx esi, si
pop edi
cmp cx, si
je 0x4139e3
inc edx
imul eax, edx, 0x1a
movzx ecx, word [eax + 0x438830]
test cx, cx
jne 0x4139c7
mov eax, 0x437348
jmp 0x4139eb
imul eax, edx, 0x1a
add eax, 0x438832
push eax
mov ecx, ebx
call main
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x4161ce
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x4161dd
pop dword [ebp - 0x3c]
mov eax, 0x4161dd
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x43506
push 0
mov eax, 0x7ec83e82
add eax, 0x817a8476
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0xa5b161af
add ecx, 0x5a4ee877
mov edi, eax
mov ebx, 0x449800
add ebx, dword [ebp - 0x3c]
mov edx, 0x80c55b8f
xor dword [ebp - 4], ecx
mov esi, dword [ebx]
xor esi, edx
xor dword [ebp - 8], ebx
mov dword [edi], esi
sub dword [ebp - 0x18], eax
add edi, 4
add ebx, 4
loop 0x41622b
add eax, 0x71d2c9be
add eax, 0x8e2e51ad
mov ebx, eax
add eax, 0x44447e8c
sub eax, 0x44447e87
mov ecx, 0x4325b817
add ecx, 0xbd1a47e9
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x402520
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x40c018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
mov edi, dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, ecx
push esi
push 0
push 0
push 0x258
push 0x258
push 0
push bind
push 0xa0000
push 0x40fdd0
push 0x40fd68
push 0
mov dword [0x40fdcc], esi
call edi
mov dword [0x40fd64], eax
test eax, eax
jne 0x402584
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407180
mov esp, ebp
pop ebp
ret
push 0
push esi
push 0x6a
push eax
push 0
push 0
push 0
push 0
push 0x50000000
push 0
push str.msctls_statusbar32
push 0
call edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
mov esi, eax
push 0
push esi
call edi
lea eax, [ebp - 0x10]
push eax
push 3
push 0x404
push esi
mov dword [ebp - 0x10], 0x6e
mov dword [ebp - 0xc], 0xe6
mov dword [ebp - 8], 0xffffffff
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp + 8]
mov edx, dword [0x40fd64]
push ecx
push edx
call edi
mov eax, dword [0x40fd64]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.00407180
mov esp, ebp
pop ebp
ret

Function at 0x403550
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x40c018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x40c818]
push ebx
push esi
push edi
test eax, eax
js 0x403659
cmp eax, 3
jge 0x403659
mov esi, eax
imul esi, esi, 0x214
push ecx
add esi, 0x40c1dc
inc eax
lea edi, [esi + 4]
push pe_nt_image_headers32
mov dword [0x40c818], eax
push edi
mov dword [esi], 1
call dword [sym.imp.MSVCR100.dll_strcpy_s]
add esp, 0xc
cmp dword [esi], 0
je 0x403659
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0xe]
movzx ecx, word [ebp - 0x12]
movzx edx, word [ebp - 0x14]
push eax
push ecx
push edx
push edi
lea ebx, [esi + 0x110]
push str.._s_04d__02d__02d.txt
push ebx
mov dword [esi + 0x104], eax
mov dword [esi + 0x108], ecx
mov dword [esi + 0x10c], edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x210], eax
cmp eax, 0xffffffff
jne 0x403634
mov dword [esi], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407180
mov esp, ebp
pop ebp
ret
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x403659
mov ecx, dword [esi + 0x210]
push ecx
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407180
mov esp, ebp
pop ebp
ret
Function at 0x403670
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x81c
mov eax, dword [0x40c018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
test eax, eax
js 0x403867
cmp eax, dword [ecx + 0x640]
jge 0x403867
imul eax, eax, 0x214
cmp dword [eax + ecx + 4], 0
lea esi, [eax + ecx + 4]
je 0x403867
lea eax, [ebp - 0x818]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0x812]
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
cmp ecx, dword [esi + 0x104]
jne 0x4036f6
movzx edx, word [ebp - 0x816]
cmp edx, dword [esi + 0x108]
jne 0x4036f6
movzx eax, word [ebp - 0x818]
cmp eax, dword [esi + 0x10c]
je 0x4037b3
mov ecx, dword [esi + 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, word [ebp - 0x812]
movzx ecx, word [ebp - 0x816]
movzx edx, word [ebp - 0x818]
push eax
push ecx
push edx
mov dword [esi + 0x10c], edx
lea edx, [esi + 4]
push edx
lea edi, [esi + 0x110]
push str.._s_04d__02d__02d.txt
push edi
mov dword [esi + 0x104], eax
mov dword [esi + 0x108], ecx
call ebx
add esp, 0x18
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x210], eax
cmp eax, 0xffffffff
jne 0x40377d
mov dword [esi], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407180
mov esp, ebp
pop ebp
ret
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4037b3
mov eax, dword [esi + 0x210]
push eax
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407180
mov esp, ebp
pop ebp
ret
push 0x3ff
lea ecx, [ebp - 0x807]
push 0
push ecx
mov byte [ebp - 0x808], 0
call sub.MSVCR100.dll_memset
mov eax, dword [ebp + 0xc]
lea edx, [ebp + 0x10]
push edx
push eax
lea ecx, [ebp - 0x808]
push 0x400
push ecx
call dword [sym.imp.MSVCR100.dll_vsprintf_s]
push 0x3ff
lea edx, [ebp - 0x407]
push 0
push edx
mov byte [ebp - 0x408], 0
call sub.MSVCR100.dll_memset
movzx ecx, word [ebp - 0x80c]
movzx edx, word [ebp - 0x80e]
lea eax, [ebp - 0x808]
push eax
movzx eax, word [ebp - 0x810]
push ecx
push edx
push eax
lea ecx, [ebp - 0x408]
push str._02d:_02d:_02d__s_r_n
push ecx
call ebx
lea eax, [ebp - 0x408]
add esp, 0x40
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403840
mov ecx, dword [esi + 0x210]
sub eax, edx
push 0
lea edx, [ebp - 0x81c]
push edx
push eax
lea eax, [ebp - 0x408]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407180
mov esp, ebp
pop ebp
ret