joyce8/EMBER2024-capa huggingface dataset:
Function at 0x78b54926
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x40], 0
mov eax, dword [esi]
push edi
mov edi, ecx
mov ecx, esi
jne 0x78b580e2
call dword [eax + 4]
lea ecx, [edi + 0x28]
push eax
push esi
call fcn.78b548b8
pop edi
pop esi
pop ebp
ret 4

Function at 0x78b556a8
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x78b759f8]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push edi
xor ebx, ebx
xor edi, edi
cmp eax, ebx
jne 0x78b55751
call esi
mov edi, eax
cmp edi, ebx
je 0x78b5963d
mov dword [0x78b759f8], 1
cmp edi, ebx
je 0x78b5965f
cmp word [edi], bx
mov eax, edi
je 0x78b556fd
inc eax
inc eax
cmp word [eax], bx
jne 0x78b556ef
inc eax
inc eax
cmp word [eax], bx
jne 0x78b556ef
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
sub eax, edi
push ebx
sar eax, 1
inc eax
push eax
push edi
push ebx
push ebx
mov dword [ebp - 0xc], eax
call esi
mov ecx, eax
cmp ecx, ebx
mov dword [ebp - 8], ecx
je 0x78b55743
call fcn.78b559da
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x78b55743
push ebx
push ebx
push dword [ebp - 8]
push eax
push dword [ebp - 0xc]
push edi
push ebx
push ebx
call esi
test eax, eax
je 0x78b5966d
mov ebx, dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
cmp eax, 1
je 0x78b556e0
jmp 0x78b5967e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x78b59655
push 2
pop eax
mov dword [0x78b759f8], eax
jmp 0x78b55751
mov eax, dword [0x78b759f8]
jmp 0x78b55751
call esi
mov edi, eax
cmp edi, ebx
jne 0x78b556e8
jmp 0x78b59687
push dword [ebp - 4]
call fcn.78b55a6b
pop ecx
mov dword [ebp - 4], ebx
jmp 0x78b55740
cmp eax, 2
je 0x78b5968e
cmp eax, ebx
je 0x78b5968e
xor eax, eax
jmp 0x78b5574c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov esi, eax
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x78b59687
cmp byte [esi], bl
je 0x78b596ab
inc eax
cmp byte [eax], bl
jne 0x78b596a1
inc eax
cmp byte [eax], bl
jne 0x78b596a1
sub eax, esi
inc eax
mov edi, eax
mov ecx, edi
call fcn.78b559da
cmp eax, ebx
je 0x78b596d2
mov ecx, edi
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 4]
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
jmp 0x78b5574a
Function at 0x78b56676
Capabilities:
Accept command line arguments
Check os version
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor ecx, ecx
inc ecx
cmp eax, ecx
push esi
push edi
jne 0x78b56786
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x94
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x78b570c3
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
push esi
push 0
je 0x78b59185
mov eax, dword [esi + 0x10]
mov dword [0x78b758bc], eax
mov eax, dword [esi + 4]
mov dword [0x78b758c8], eax
mov eax, dword [esi + 8]
mov dword [0x78b758cc], eax
mov eax, dword [esi + 0xc]
and eax, 0x7fff
mov dword [0x78b758c0], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [0x78b758bc], 2
jne 0x78b59193
mov eax, dword [0x78b758c8]
shl eax, 8
add eax, dword [0x78b758cc]
push 1
mov dword [0x78b758c4], eax
call fcn.78b56ee4
test eax, eax
pop ecx
je 0x78b570c3
call fcn.78b567ef
test eax, eax
je 0x78b5919f
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x78b75ef0], eax
call fcn.78b556a8
mov dword [0x78b758b8], eax
call fcn.78b5575b
test eax, eax
jl fcn.78b591a9
call fcn.78b565d2
test eax, eax
jl 0x78b570b9
call fcn.78b56db7
test eax, eax
jl 0x78b570b9
call fcn.78b56d0d
test eax, eax
jne 0x78b570b9
inc dword [0x78b758b4]
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret 0xc
xor edi, edi
cmp eax, edi
je 0x78b591b0
cmp eax, 2
jne 0x78b570ca
mov edx, 0x8c
call fcn.78b564f4
mov esi, eax
cmp esi, edi
je 0x78b570c3
push esi
push dword [0x78b7422c]
call dword [0x78b758e8]
test eax, eax
push esi
je 0x78b591e2
call fcn.78b567d7
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
jmp 0x78b5677d
call fcn.78b59555
jmp fcn.78b591a9
xor eax, eax
jmp 0x78b56780
cmp eax, 3
je 0x78b591ed
jmp 0x40b677d
stc
invalid
invalid
invalid
push ebx
stc
invalid
Function at 0x78b56adb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x78b74224]
jne 0x78b70dac
test ecx, 0xffff0000
jne 0x78b70dac
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x320
push edi
mov dword [0x78b76c58], eax
mov dword [0x78b76c54], ecx
mov dword [0x78b76c50], edx
mov dword [0x78b76c4c], ebx
mov dword [0x78b76c48], esi
mov dword [0x78b76c44], edi
mov word [0x78b76c70], ss
mov word [0x78b76c64], cs
mov word [0x78b76c40], ds
mov word [0x78b76c3c], es
mov word [0x78b76c38], fs
mov word [0x78b76c34], gs
pushfd
pop dword [0x78b76c68]
mov eax, dword [ebp + 4]
lea ecx, [ebp + 4]
add ecx, 4
mov dword [0x78b76c6c], ecx
mov dword [0x78b76c60], eax
mov dword [0x78b76ba8], 0x10001
lea ecx, [ebp + 4]
mov ecx, dword [ecx - 4]
mov dword [0x78b76b64], eax
mov eax, dword [0x78b74224]
mov dword [ebp - 4], eax
mov eax, dword [0x78b75760]
xor edi, edi
inc edi
mov dword [ebp - 4], eax
push 0
mov dword [0x78b76c5c], ecx
mov dword [0x78b76b58], 0xc0000409
mov dword [0x78b76b5c], edi
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x78b70e8c
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push 0xc0000409
mov dword [ebp - 0x320], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop edi
leave
ret

Function at 0x78b57368
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc edi
adc al, 0x8d
je 0x78b573a5
sbb byte [ecx - 0x1017438b], cl
std
invalid
dec esi
or al, 0xf
mov bh, 0xd0
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x78b573b9
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x78b573aa
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.78b57165
pushal
dec ebp
sub bl, byte [esi + 0x50a8458d]
call fcn.78b57175
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.78b5712a
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x78b57453
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
invalid
Function at 0x78b5750a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
idiv dword [edi - 0x39c18]
call dword [eax + 0x56]
push dword [ebp + 8]
call fcn.78b5712a
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.78b57175
push eax
push esi
push dword [ebp + 8]
call fcn.78b5712a
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
invalid
Function at 0x78b64372
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, dword [edi]
mov eax, dword [edi + 4]
mov esi, ecx
sub ebx, dword [esi + 0x48]
sbb eax, dword [esi + 0x4c]
mov dword [ebp - 4], eax
js 0x78b643b7
jg 0x78b64398
test ebx, ebx
jb 0x78b643b7
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x24]
sub eax, ecx
cdq
cmp dword [ebp - 4], edx
mov dword [ebp - 0x10], eax
jl 0x78b644a1
jg 0x78b643b7
cmp ebx, eax
jbe 0x78b644a1
mov ecx, dword [edi + 0x10]
sub ecx, dword [esi + 0x80]
mov edx, dword [edi + 0x14]
sbb edx, dword [esi + 0x84]
mov ebx, dword [esi + 0x74]
mov eax, dword [esi + 0x7c]
sub eax, ebx
add eax, dword [esi + 0x78]
test edx, edx
mov dword [ebp - 4], edx
jl 0x78b643fa
jg 0x78b643e1
test ecx, ecx
jb 0x78b643fa
xor edx, edx
cmp dword [ebp - 4], edx
jg 0x78b643fa
jl 0x78b643ee
cmp ecx, eax
ja 0x78b643fa
add ebx, ecx
sub eax, ecx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], eax
jmp 0x78b64446
mov edx, dword [edi + 0x14]
mov eax, dword [edi + 0x10]
mov ecx, dword [esi + 0x6c]
mov ebx, dword [ecx]
push 0
push 0
push edx
push eax
call dword [ebx + 0x24]
test eax, eax
jge 0x78b64418
push eax
jmp 0x78b644cf
mov ecx, dword [esi + 0x6c]
mov edx, dword [ecx]
lea eax, [esi + 0x7c]
push eax
push dword [esi + 0x70]
push dword [esi + 0x74]
call dword [edx + 0x1c]
test eax, eax
jl 0x78b64412
mov eax, dword [esi + 0x74]
mov dword [esi + 0x78], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x80], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x84], eax
mov ebx, dword [edi + 0x18]
xor eax, eax
cmp eax, eax
mov dword [ebp - 4], eax
mov dword [ebp + 8], eax
jl 0x78b64486
jle 0x78b64482
lea ecx, [ebp + 8]
push ecx
push dword [esi + 0x10]
sub ebx, eax
push dword [esi + 0x18]
mov eax, dword [esi]
sbb dword [ebp - 4], 0
mov ecx, esi
call dword [eax + 0x60]
test eax, eax
jl 0x78b64412
mov eax, dword [ebp + 8]
test eax, eax
je 0x78b644ca
xor ecx, ecx
cmp dword [ebp - 4], ecx
jg 0x78b64457
jl 0x78b64486
cmp ebx, eax
ja 0x78b64457
mov ecx, dword [esi + 0x18]
add eax, ecx
mov dword [esi + 0x24], eax
mov dword [esi + 0x2c], ecx
mov eax, dword [edi]
mov edx, dword [edi + 4]
sub eax, ebx
sbb edx, dword [ebp - 4]
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], edx
lea eax, [ecx + ebx]
mov dword [esi + 0x3c], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x1c], eax
mov ecx, dword [edi + 8]
mov dword [esi + 0x38], ecx
mov ecx, dword [edi + 0xc]
pop edi
mov dword [esi + 0x40], ecx
mov dword [esi + 0x20], eax
mov dword [esi + 0x30], 1
pop esi
pop ebx
leave
ret 4
push 0x80004005
call fcn.78b69c60

Function at 0x78b6b893
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0x78b6b8d8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x78b6b8bc
push 0x78b6b8c8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x78b6b8bc
push dword [ebp + 8]
call eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x78b6bc05
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 4], esi
cmp ecx, dword [esi*8 + 0x78b75fd8]
je 0x78b6bc27
inc esi
cmp esi, 0x13
mov dword [ebp - 4], esi
jb 0x78b6bc15
cmp esi, 0x13
je 0x78b6bd63
mov eax, dword [0x78b76788]
cmp eax, 1
push ebx
je 0x78b6bd32
test eax, eax
jne 0x78b6bc50
cmp dword [0x78b7678c], 1
je 0x78b6bd32
cmp ecx, 0xfc
je 0x78b6bd62
push edi
push 6
pop ecx
mov esi, 0x78b6bdb0
mov edi, 0x78b767a0
rep movsd dword es:[edi], dword [esi]
push 0x104
mov ebx, 0x78b767ba
push ebx
movsw word es:[edi], word [esi]
push 0
mov byte [0x78b768be], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x78b6bc9e
push 5
pop ecx
mov esi, 0x78b6bd98
mov edi, 0x78b767ba
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x78b6bca3
sub eax, edx
inc eax
cmp eax, 0x3c
jbe 0x78b6bcd6
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x78b6bcb7
sub eax, edx
push 3
lea eax, [eax + 0x78b7677f]
push 0x78b6bd94
push eax
call fcn.78b57368
add esp, 0xc
mov edx, 0x78b767a0
mov edi, edx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x78b6bcde
mov eax, dword [ebp - 4]
mov eax, dword [eax*8 + 0x78b75fdc]
mov esi, 0x78b6bd90
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x78b6bcfa
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x78b6bd06
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x12010
mov ecx, eax
and ecx, 3
push 0x78b6bd68
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.78b6e189
add esp, 0xc
pop edi
jmp 0x78b6bd62
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x78b6bd62
mov edx, dword [esi*8 + 0x78b75fdc]
mov ecx, edx
lea esi, [ecx + 1]
mov bl, byte [ecx]
inc ecx
test bl, bl
jne 0x78b6bd4a
push 0
sub ecx, esi
lea esi, [ebp - 8]
push esi
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebx
pop esi
leave
ret
Function at 0x78b6e189
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x78b76b04], ebx
push esi
push edi
jne 0x78b6e20b
push 0x78b6e2e8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x78b6e246
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x78b6e2dc
push edi
call esi
test eax, eax
mov dword [0x78b76b04], eax
je 0x78b6e246
push 0x78b6e2cc
push edi
call esi
push 0x78b6e2b8
push edi
mov dword [0x78b76b08], eax
call esi
cmp dword [0x78b758bc], 2
mov dword [0x78b76b0c], eax
jne 0x78b6e20b
push 0x78b6e29c
push edi
call esi
test eax, eax
mov dword [0x78b76b14], eax
je 0x78b6e20b
push 0x78b6e284
push edi
call esi
mov dword [0x78b76b10], eax
mov eax, dword [0x78b76b10]
test eax, eax
je 0x78b6e250
call eax
test eax, eax
je 0x78b6e237
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x78b76b14]
test eax, eax
je 0x78b6e237
test byte [ebp - 8], 1
jne 0x78b6e250
cmp dword [0x78b758c8], 4
jb 0x78b6e24a
or byte [ebp + 0x12], 0x20
jmp 0x78b6e26f
xor eax, eax
jmp 0x78b6e27f
or byte [ebp + 0x12], 4
jmp 0x78b6e26f
mov eax, dword [0x78b76b08]
test eax, eax
je 0x78b6e26f
call eax
mov ebx, eax
test ebx, ebx
je 0x78b6e26f
mov eax, dword [0x78b76b0c]
test eax, eax
je 0x78b6e26f
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x78b76b04]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x78b6ec0c
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x78b74224]
xor ecx, ecx
cmp dword [ebp + 0x10], ecx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 0x420], edi
mov dword [ebp - 0x418], ecx
mov dword [ebp - 0x41c], ecx
jne 0x78b6ec43
xor eax, eax
jmp 0x78b6edf4
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x78b75de0]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x78b6ec78
push 2
push ecx
push ecx
push dword [ebp + 8]
call fcn.78b70083
add esp, 0x10
xor ecx, ecx
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x78b6ed44
cmp dword [ebp + 0x10], ecx
mov dword [ebp - 0x414], edi
mov dword [ebp - 0x40c], ecx
ja 0x78b6ec9e
jmp 0x78b6edc2
xor ecx, ecx
mov dword [ebp - 0x410], ecx
mov ecx, dword [ebp - 0x414]
sub ecx, dword [ebp - 0x420]
lea eax, [ebp - 0x408]
cmp ecx, dword [ebp + 0x10]
jae 0x78b6ecf4
mov edx, dword [ebp - 0x414]
inc dword [ebp - 0x414]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x78b6ecdf
inc dword [ebp - 0x41c]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x410]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x410]
cmp dword [ebp - 0x410], 0x400
jl 0x78b6ecb6
mov edi, eax
lea eax, [ebp - 0x408]
sub edi, eax
push 0
lea eax, [ebp - 0x424]
push eax
push edi
lea eax, [ebp - 0x408]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x78b6ed71
mov eax, dword [ebp - 0x424]
add dword [ebp - 0x418], eax
cmp eax, edi
jl 0x78b6ed7d
mov eax, dword [ebp - 0x414]
sub eax, dword [ebp - 0x420]
cmp eax, dword [ebp + 0x10]
jae 0x78b6ed7d
jmp 0x78b6ec9c
push ecx
lea ecx, [ebp - 0x424]
push ecx
push dword [ebp + 0x10]
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x78b6ed71
mov eax, dword [ebp - 0x424]
and dword [ebp - 0x40c], 0
mov dword [ebp - 0x418], eax
jmp 0x78b6ed7d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0x418]
test eax, eax
jne 0x78b6edec
cmp dword [ebp - 0x40c], eax
je 0x78b6edbc
push 5
pop esi
cmp dword [ebp - 0x40c], esi
jne 0x78b6edae
call fcn.78b6f172
mov dword [eax], 9
call fcn.78b6f185
mov dword [eax], esi
jmp 0x78b6ede7
push dword [ebp - 0x40c]
call fcn.78b6f198
pop ecx
jmp 0x78b6ede7
mov edi, dword [ebp - 0x420]
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x78b6edd4
cmp byte [edi], 0x1a
jne 0x78b6edd4
xor eax, eax
jmp 0x78b6edf2
call fcn.78b6f172
mov dword [eax], 0x1c
call fcn.78b6f185
and dword [eax], 0
or eax, 0xffffffff
jmp 0x78b6edf2
sub eax, dword [ebp - 0x41c]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
call fcn.78b56adb
leave
ret
Function at 0x78b70354
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
push 4
pop eax
call fcn.78b5601c
mov dword [ebp - 8], esp
push 0x1c
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x78b70450
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [ebp - 0x4c]
xor esi, esi
cmp dword [0x78b758bc], 2
jne 0x78b703d5
push 0x78b55978
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, esi
je 0x78b703d5
push 0x78b7045c
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
je 0x78b703d5
lea ecx, [ebp - 4]
push ecx
mov dword [ebp - 4], esi
call eax
cmp eax, 1
pop ecx
jne 0x78b703d5
cmp dword [ebp - 4], esi
jbe 0x78b703d5
mov esi, dword [ebp - 4]
mov edx, dword [0x78b758bc]
mov ebx, edx
dec ebx
neg ebx
sbb ebx, ebx
and ebx, 0x103
lea ecx, [edi - 1]
lea eax, [esi + edi - 1]
not ecx
inc ebx
and eax, ecx
mov dword [ebp - 4], eax
je 0x78b703fe
add eax, edi
mov dword [ebp - 4], eax
lea ecx, [edi + edi]
cmp eax, ecx
jae 0x78b7040a
mov dword [ebp - 4], ecx
mov eax, ecx
lea esi, [edi - 1]
not esi
and esi, dword [ebp - 8]
sub esi, eax
cmp edx, 1
jne 0x78b7041c
push 0x11
pop edi
mov ecx, dword [ebp - 0xc]
add edi, ecx
cmp esi, edi
jb 0x78b70450
push 4
push 0x1000
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x78b70450
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x78b70450
xor eax, eax
inc eax
jmp 0x78b70452
xor eax, eax
lea esp, [ebp - 0x5c]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401000
Capabilities:
Execute command
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.hello_world
push esi
call fcn.00401070
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
call esi
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call esi
push 0
push str.asdsadsadsad
push str.sadsadsad
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push str.pause
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
add esp, 4
mov edx, str.Hello_World
call fcn.00401070
push 0
push 0
call esi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401b4f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401b8e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401b8e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401b8e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401b8e
cmp dword [ecx + 0x74], 0xe
jbe 0x401b8e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40db80
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x4143d8], 0
jne 0x40dc01
cmp dword [0x4143f8], 0
jne 0x40dbb0
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x4143f8], eax
test eax, eax
jne 0x40dbb0
push str.GetEnvironmentStrings_failed
call fcn.0040cbf0
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x4143f8]
jmp 0x40dbc4
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.00406b08
pop ecx
mov edi, eax
test eax, eax
jne 0x40dbbc
lea edi, [ebp + 1]
push edi
call fcn.00405c3c
pop ecx
mov ebx, eax
mov dword [0x4143dc], ebx
test ebx, ebx
jne 0x40dbee
xor eax, eax
jmp 0x40dcc4
push edi
mov edx, dword [0x4143f8]
push edx
push ebx
call fcn.004069b8
add esp, 0xc
jmp 0x40dc21
xor esi, esi
mov ebx, dword [0x4143d8]
jmp 0x40dc1b
push eax
call fcn.00406b08
pop ecx
test eax, eax
jne 0x40dc17
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40dc0b
lea ebx, [esi + 4]
push 4
mov dword [0x4143e0], ebx
inc ebx
push ebx
call fcn.00405a3c
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x40dc44
xor eax, eax
jmp 0x40dcc4
cmp dword [0x4143d8], 0
jne 0x40dc75
xor esi, esi
mov ebx, dword [0x4143dc]
mov eax, dword [esp]
mov ebp, eax
jmp 0x40dc66
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.00406b08
pop ecx
mov edi, eax
test eax, eax
jne 0x40dc5c
jmp 0x40dca6
xor esi, esi
mov ebx, dword [0x4143d8]
mov eax, dword [esp]
mov edi, eax
jmp 0x40dca0
push eax
call fcn.00406b08
pop ecx
test eax, eax
je 0x40dc95
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x40dc99
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40dc84
mov eax, dword [0x4143d8]
test eax, eax
je 0x40dcb6
push eax
call fcn.00405c4c
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x4143d8], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x405b80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x405b80
lcall 0x5de5, 0x8b10c483
jmp loc.00a4b220