joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41368a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
push 9
call sub.USER32.dll_GetKeyState
mov edi, eax
movsx edi, di
test di, 0x80
je 0x413723
push 0x11
call sub.USER32.dll_GetKeyState
mov edi, eax
movsx edi, di
test di, 0x80
jne 0x413723
push 0x10
call sub.USER32.dll_GetKeyState
mov edi, eax
movsx edi, di
test di, 0x80
jne 0x413723
push 0x12
call sub.USER32.dll_GetKeyState
mov edi, eax
movsx edi, di
test di, 0x80
jne 0x413723
call sub.USER32.dll_GetFocus
push 5
lea edi, [ebp - 0xd]
push edi
push eax
call sub.USER32.dll_GetClassNameA
push 4
push str.Rich
lea eax, [ebp - 0xd]
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0xc
or eax, eax
jne 0x413723
call sub.USER32.dll_GetFocus
push 0
push 0
push 0x44e
push eax
call sub.USER32.dll_SendMessageA
test ax, 0x800
jne 0x413723
xor eax, eax
jmp 0x41374e
push str.PB_WindowID
push dword [ebp + 8]
call sub.USER32.dll_GetPropA
mov dword [ebp - 4], eax
or eax, eax
je 0x41374c
dec eax
push eax
push dword [0x42e150]
call fcn.00413e62
mov dword [ebp - 8], eax
mov eax, dword [eax + 0xc]
jmp 0x41374e
xor eax, eax
pop edi
leave
ret 4

Function at 0x4137f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
and dword [ebp - 4], 0
cmp dword [edi + 0x14], 0
jne 0x41381f
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [edi + 8]
sub eax, dword [edi + 0xc]
push eax
push dword [edi + 4]
push dword [edi]
call sub.KERNEL32.dll_WriteFile
mov eax, dword [edi + 8]
mov dword [edi + 0xc], eax
mov eax, dword [ebp - 4]
pop edi
leave
ret 4
Function at 0x413ae0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, 0x1000
push dword [ebp + 0xc]
push 0x1000
call fcn.00414310
mov esi, eax
mov edi, esi
push dword [ebp + 8]
push dword [0x42e160]
call fcn.00413e62
mov dword [ebp - 8], eax
or eax, eax
je 0x413bff
mov byte [ebp - 1], 0
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
je 0x413b38
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 8]
call fcn.00413cf0
mov dword [ebp - 0xc], eax
jmp 0x413b4e
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [ebp - 8]
push dword [eax]
call sub.KERNEL32.dll_ReadFile
cmp byte [ebp - 1], 0
je 0x413b5a
mov al, byte [ebp - 1]
mov byte [edi], al
inc edi
mov eax, edi
sub eax, esi
cmp eax, ebx
jl 0x413b81
add ebx, 0x1000
mov eax, edi
sub eax, esi
mov dword [ebp - 0x10], eax
push dword [ebp + 0xc]
push ebx
call fcn.00414310
mov esi, eax
mov eax, dword [ebp - 0x10]
mov edi, eax
add edi, esi
movsx eax, byte [ebp - 1]
or eax, eax
je 0x413b9d
cmp dword [ebp - 0xc], 0
je 0x413b9d
cmp eax, 0xd
je 0x413b9d
cmp eax, 0xa
jne 0x413b18
cmp byte [ebp - 1], 0
je 0x413bff
dec edi
cmp byte [ebp - 1], 0xd
jne 0x413bff
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
je 0x413bc3
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 8]
call fcn.00413cf0
jmp 0x413bd9
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [ebp - 8]
push dword [eax]
call sub.KERNEL32.dll_ReadFile
cmp byte [ebp - 1], 0xa
je 0x413bff
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
je 0x413bef
add eax, 0xc
inc dword [eax]
jmp 0x413bff
push 1
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
push dword [eax]
call sub.KERNEL32.dll_SetFilePointer
mov byte [edi], 0
mov eax, edi
sub eax, esi
mov edx, ebx
sub edx, eax
push edx
call fcn.004143f0
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x413c20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
and dword [ebp - 4], 0
cmp dword [edi + 0x14], 1
jne 0x413c43
and dword [edi + 0x14], 0
mov eax, dword [edi + 8]
mov dword [edi + 0xc], eax
cmp dword [edi + 0xc], esi
jle 0x413ca4
mov eax, dword [edi + 8]
sub eax, dword [edi + 0xc]
add eax, dword [edi + 4]
mov dword [ebp - 8], eax
mov eax, esi
cmp eax, 1
je 0x413c67
cmp eax, 2
je 0x413c73
cmp eax, 4
je 0x413c81
jmp 0x413c8d
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov dl, byte [edx]
mov byte [eax], dl
jmp 0x413c9c
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov dx, word [edx]
mov word [eax], dx
jmp 0x413c9c
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
mov dword [eax], edx
jmp 0x413c9c
push esi
push dword [ebp + 0xc]
push dword [ebp - 8]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [edi + 0xc], esi
mov dword [ebp - 4], esi
jmp 0x413cde
push edi
call fcn.004137f0
cmp esi, dword [edi + 8]
jl 0x413cc2
push 0
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 0xc]
push dword [edi]
call sub.KERNEL32.dll_WriteFile
jmp 0x413cde
push esi
push dword [ebp + 0xc]
mov eax, dword [edi + 8]
sub eax, dword [edi + 0xc]
add eax, dword [edi + 4]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [edi + 0xc], esi
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x413cf0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
cmp dword [edi + 0x14], 0
jne 0x413d15
push edi
call fcn.004137f0
mov dword [edi + 0x14], 1
and dword [edi + 0xc], 0
cmp dword [edi + 0xc], esi
jl 0x413d6a
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
mov ebx, eax
add ebx, dword [edi + 4]
mov eax, esi
cmp eax, 1
je 0x413d38
cmp eax, 2
je 0x413d41
cmp eax, 4
je 0x413d4c
jmp 0x413d55
mov eax, dword [ebp + 0xc]
mov dl, byte [ebx]
mov byte [eax], dl
jmp 0x413d62
mov eax, dword [ebp + 0xc]
mov dx, word [ebx]
mov word [eax], dx
jmp 0x413d62
mov eax, dword [ebp + 0xc]
mov edx, dword [ebx]
mov dword [eax], edx
jmp 0x413d62
push esi
push ebx
push dword [ebp + 0xc]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [edi + 0xc], esi
mov dword [ebp - 4], esi
jmp 0x413de9
mov ebx, dword [edi + 0xc]
push ebx
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
add eax, dword [edi + 4]
push eax
push dword [ebp + 0xc]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, ebx
add eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
sub esi, ebx
cmp esi, dword [edi + 8]
jl 0x413da9
push 0
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 0xc]
push dword [edi]
call sub.KERNEL32.dll_ReadFile
and dword [edi + 0xc], 0
jmp 0x413de9
push 0
lea eax, [ebp - 4]
push eax
push dword [edi + 8]
push dword [edi + 4]
push dword [edi]
call sub.KERNEL32.dll_ReadFile
mov eax, dword [ebp - 4]
mov dword [edi + 0xc], eax
mov eax, dword [ebp - 4]
mov dword [edi + 0x10], eax
cmp esi, dword [edi + 0xc]
jle 0x413dd0
mov esi, dword [edi + 0xc]
push esi
push dword [edi + 4]
push dword [ebp + 0xc]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [edi + 0xc], esi
mov eax, ebx
add eax, esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x405160
Capabilities:
Write clipboard data

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x18], ebx
jne 0x405184
push esi
call fcn.00405430
test eax, eax
jne 0x405184
push str.Cant_open_clipboard_for_writing.
call fcn.00405260
pop esi
pop ebx
pop ecx
ret
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x4051bd
cmp dword [esi + 0x18], ebx
je 0x4051af
cmp dword [esi + 8], ebx
je 0x4051a4
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
push 0x4afe04
call fcn.00405260
pop esi
pop ebx
pop ecx
ret
mov eax, dword [esi + 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp eax, ebx
je 0x4051f6
mov ecx, dword [esi + 0xc]
cmp ecx, ebx
je 0x40521d
cmp word [ecx], bx
push eax
sete byte [esp + 0x13]
call edi
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
cmp byte [esp + 0xf], bl
je 0x40521d
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 4], eax
cmp dword [esi + 0x18], ebx
je 0x405213
cmp dword [esi + 8], ebx
je 0x405208
mov ecx, dword [esi]
push ecx
call edi
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
mov edx, dword [esi + 4]
push edx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x405232
mov dword [esi + 4], ebx
jmp 0x4051f6
cmp dword [esi + 0x18], ebx
je 0x40524f
cmp dword [esi + 8], ebx
je 0x405244
mov eax, dword [esi]
push eax
call edi
mov dword [esi + 8], ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], ebx
mov dword [esi], ebx
push 0x4afe24
call fcn.00405260
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x405330
Capabilities:
Read clipboard data

Disassembly:
sub esp, 0x20c
test esi, esi
je 0x405340
mov dword [esi], 0
lea eax, [edi - 0xc000]
cmp eax, 0x3fff
ja 0x40540f
push 0x104
lea ecx, [esp + 4]
push ecx
push edi
call dword [sym.imp.USER32.dll_GetClipboardFormatNameW]
push 0xb
lea edx, [esp + 4]
push str.Link_Source
push edx
call fcn.0049a3aa
add esp, 0xc
test eax, eax
je 0x405406
lea eax, [esp]
push str.ObjectLink
push eax
call fcn.00499c29
add esp, 8
test eax, eax
je 0x405406
lea ecx, [esp]
push str.OwnerLink
push ecx
call fcn.00499c29
add esp, 8
test eax, eax
je 0x405406
lea edx, [esp]
push 0x4afe8c
push edx
call fcn.00499c29
add esp, 8
test eax, eax
je 0x405406
lea eax, [esp]
push str.Embed_Source
push eax
call fcn.00499c29
add esp, 8
test eax, eax
je 0x405406
lea ecx, [esp]
push str.MSDEVColumnSelect
push ecx
call fcn.00499c29
add esp, 8
test eax, eax
je 0x4053fc
lea edx, [esp]
push str.MSDEVLineSelect
push edx
call fcn.00499c29
add esp, 8
test eax, eax
jne 0x405415
test esi, esi
je 0x405406
mov dword [esi], 1
xor eax, eax
add esp, 0x20c
ret
xor eax, eax
mov word [esp], ax
push edi
call dword [sym.imp.USER32.dll_GetClipboardData]
add esp, 0x20c
ret
Function at 0x47c220
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x30008
call fcn.004a7dd0
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x47c23a
cmp word [esi], 0
jne 0x47c23f
mov esi, 0x4b98e8
xor eax, eax
lea edx, [esp + 0xc]
push edx
mov word [esp + 0x10014], ax
xor ecx, ecx
lea eax, [esp + 0x14]
push eax
mov word [esp + 0x10], cx
mov ecx, dword [esp + 0x3001c]
push 0x8000
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp word [ebx], 0
je 0x47c2bd
cmp word [edi], 0
jne 0x47c27d
lea edi, [esp + 8]
lea edx, [esp + 0x10]
push edx
push 0xffff
lea eax, [esp + 0x10018]
push eax
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, dword [0x4d9648]
push 1
push 0
push 0xffffffffffffffff
lea eax, [esp + 0x1001c]
push eax
push ecx
call fcn.00483320
pop edi
pop esi
add esp, 0x30008
ret 4
cmp word [edi], 0
je 0x47c2de
lea ecx, [esp + 0x10]
push ecx
push 0xffff
lea edx, [esp + 0x10018]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
jmp 0x47c2f6
lea eax, [esp + 0x10]
push eax
push 0xffff
lea ecx, [esp + 0x10018]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
test eax, eax
je 0x47c298
lea eax, [esp + 0x10010]
cmp word [eax], 0
jne 0x47c316
cmp word [eax + 2], 0
je 0x47c298
mov edx, 0xa
mov word [eax], dx
add eax, 2
jmp 0x47c301

Function at 0x47c320
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
sub esp, 0x258
push ebx
push ebp
push esi
mov esi, eax
mov ebp, 1
push edi
mov dword [esp + 0x10], ebp
test esi, esi
je 0x47c39c
cmp word [esi], 0
je 0x47c39c
push 4
push 0x4ce7c8
push esi
call fcn.0049c305
add esp, 0xc
test eax, eax
mov eax, esi
jne 0x47c358
lea eax, [esi + 8]
mov ebx, 0x4bc1c0
call fcn.0040558a
test eax, eax
je 0x47c38b
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x47c39c
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x258
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
test al, al
jne 0x47c37e
push 0
push 0
push 1
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x47c37e
mov edx, dword [esp + 0x26c]
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x47c3c5
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
sub eax, esi
sar eax, 1
mov esi, eax
mov ecx, 0x5d
push 0
mov word [edx + esi*2], cx
lea edx, [esp + 0x18]
push edx
push 4
push 0x4ce5f4
push edi
lea ebx, [esi + esi + 2]
call ebp
test eax, eax
je 0x47c422
cmp dword [esp + 0x14], 4
jne 0x47c422
mov ecx, dword [esp + 0x26c]
push 0
lea eax, [esp + 0x18]
push eax
push ebx
push ecx
push edi
call ebp
test eax, eax
je 0x47c422
cmp dword [esp + 0x14], ebx
je 0x47c42a
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x47c439
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x26c]
pop edi
xor edx, edx
mov word [eax + esi*2], dx
mov eax, dword [esp + 0xc]
pop esi
pop ebp
pop ebx
add esp, 0x258
ret
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x47a58f1
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..text_1
nop
mov ebx, 0x42f314
mov ecx, 0x456b1611
nop
nop
nop
nop
nop
test eax, eax
je 0x432084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x406de0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x419610
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x11000]
push edi
or ebp, 0xffffffff
jmp 0x419632
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419639
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419628
mov eax, 1
add ebx, ebx
jne 0x41964b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419640
jne 0x41965c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419640
xor ecx, ecx
sub eax, 3
jb 0x419670
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4196e2
mov ebp, eax
add ebx, ebx
jne 0x41967b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419688
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4196ac
inc ecx
add ebx, ebx
jne 0x419698
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41968d
jne 0x4196a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41968d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4196cc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4196bd
jmp 0x41962e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4196cc
add edi, ecx
jmp 0x41962e
pop esi
mov edi, esi
mov ecx, 0x5ce
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4196ea
cmp byte [edi], 0
jne 0x4196ea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x4196ef
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x41975e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x191e8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1924c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41971c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19250]
or eax, eax
je 0x419758
mov dword [ebx], eax
add ebx, 4
jmp 0x419739
call dword [esi + 0x19254]
popal
jmp 0x40e274
Function at 0x401e50
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push edi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
lea ecx, [esp + 0x14]
mov edx, dword [esp + 0x5c]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push edx
mov dword [esp + 0x3c], 0x44
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
pop edi
add esp, 0x54
ret

Function at 0x402000
Capabilities:
Read file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov eax, dword [esp + 8]
ret 8

Function at 0x402030
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
ret 8

Function at 0x4ca265
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push 0x4c9fca
pop esi
push 0xf6bd7fd3
mov ebx, dword [esp]
add esp, 4
inc ebx
call fcn.004ca2ac
push 0x727552b0
pop ebx
or ebx, edi
and ebx, edi
xor dword [edx], esi
and ebx, ebx
push ebx
pop ebx
mov edi, 0x509487a9
inc edx
mov edi, edi
and ebx, edi
sub edi, 0x9d378b61
cmp edx, ecx
jne fcn.004ca265
mov ebx, edi
ret
Function at 0x4063c6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x4063eb
mov eax, dword [0x40a8a0]
cmp eax, 0xffffffff
je 0x4063e2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x40a8a0], 0xffffffff
jmp 0x40645e
cmp dword [0x440a60], ebx
je 0x40645e
cmp byte [0x440660], bl
je 0x40642a
cmp dword [0x40a8a0], 0xffffffff
jne 0x406433
push 4
push 0x40000000
push 0x440660
call fcn.00405d7a
cmp eax, 0xffffffff
mov dword [0x40a8a0], eax
je 0x40645e
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x40a8a0], 0xffffffff
je 0x40645e
push esi
mov esi, 0x444a80
push 0x40aae8
push esi
call fcn.004060c8
lea eax, [ebp + 8]
push ebx
push eax
push esi
call fcn.004060bb
push eax
push esi
push dword [0x40a8a0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebx
pop ebp
ret 4

Function at 0x406610
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x440254], esi
push edi
jne 0x40664a
mov ecx, 0x440250
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x406626
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x440650
jl 0x406621
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x40667f
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x440250]
xor eax, esi
inc ecx
dec edx
jne 0x406662
pop edi
pop esi
not eax
ret 0xc
Function at 0x402d89
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
lea ebx, [ecx + 4]
push edi
mov edi, edx
test ebx, ebx
je 0x402dbf
lea esi, [edi + 4]
test esi, esi
je 0x402dbf
call fcn.00402ceb
test al, al
je 0x402dbf
mov ecx, edi
call fcn.00402ceb
test al, al
je 0x402dbf
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne al
jmp 0x402dc1
xor al, al
pop edi
pop esi
pop ebx
ret

Function at 0x4052f2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x405301
pop dword [ebp - 0x48]
mov eax, 0x406d41dc
add eax, 0xbfd31125
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x3da81
push 0
mov eax, 0x60926288
sub eax, 0x60509074
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0x82a36f48
sub ecx, 0x82a32629
xor edi, edi
add edi, eax
mov ebx, 0xb4589e37
sub ebx, 0xb4153e37
add ebx, dword [ebp - 0x48]
mov esi, 0x5a982b0
add esi, 0x769b7366
sub dword [ebp - 0xc], 0xf8d801f
mov edx, dword [ebx]
sub dword [ebp - 4], 0xf178c537
xor edx, esi
sub dword [ebp - 0x2c], 0x6fd1a6f3
mov dword [edi], edx
sub dword [ebp - 0x40], ebx
add edi, 0xdfb5298d
add edi, 0x204ad677
add ebx, 4
loop 0x405362
add eax, 0xb0fc9a3e
sub eax, 0xb0fb82ef
mov ebx, eax
add eax, 0x9138cd5b
add eax, 0x6ec732aa
mov ecx, 0xcb8b9608
sub ecx, 0xcb4b9608
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x40612f
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
jne 0x4061b0
mov byte [esi + 8], 1
call main
cmp dword [esi + 0x10], 0
je 0x4061b0
test al, al
je 0x40614f
mov byte [esi + 0xa], 1
mov ecx, esi
call fcn.00406749
test al, al
jne 0x406176
push dword [esi + 0xc]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_acquire_logging_mutex__s_n
call fcn.00406e12
add esp, 0xc
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
pop esi
ret
mov ecx, esi
call main
cmp dword [esi + 0x18], 0
jne 0x40619d
push dword [esi + 0x14]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_create_logging_file__s_n
call fcn.00406e12
add esp, 0xc
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
cmp dword [esi + 0x10], 0
mov byte [esi + 9], 1
je 0x4061b0
push dword [esi + 0x10]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
pop esi
ret

Function at 0x406749
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
jne 0x406756
xor al, al
pop esi
ret
push 0x1f4
push dword [esi + 0x10]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
test eax, eax
je 0x40678f
cmp eax, 0x80
je 0x40678f
push dword [esi + 0xc]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_acquire_logging_mutex__s_n
call fcn.00406e12
add esp, 0xc
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov byte [esi + 9], 0
jmp 0x406752
mov al, 1
pop esi
ret