joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f340
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov esi, dword [edi + 0xc]
test esi, esi
je 0x40f3d2
mov eax, dword [0x4506d0]
test eax, eax
je 0x40f3c6
mov ebx, dword [eax + 0x30]
test ebx, ebx
js 0x40f441
mov ecx, dword [eax + 0x30]
test ecx, ecx
jne 0x40f3e7
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, edi
call fcn.0040ef90
cmp eax, 7
jne 0x40f45f
mov eax, dword [0x4506d0]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x40f432
mov edx, dword [eax + 0x30]
test edx, edx
js 0x40f450
mov edi, dword [eax + 0x30]
test edi, edi
jne 0x40f413
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call fcn.0040e7d0
mov eax, dword [0x4506d0]
jmp 0x40f362
mov dword [esp], edi
call fcn.0040ee00
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x40f377
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x40f3b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40f3b5
call fcn.0040e7d0
mov eax, dword [0x4506d0]
jmp 0x40f3a0
call fcn.0040ea70
mov eax, dword [0x4506d0]
jmp 0x40f36d
call fcn.0040ea70
mov eax, dword [0x4506d0]
jmp 0x40f3ab
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]

Function at 0x40f640
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov edx, eax
je 0x40f670
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov eax, dword [ebp + 0xc]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.0040e6c0
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
leave
ret
Function at 0x41260c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov eax, dword [0x446170]
test eax, eax
je 0x412716
movzx eax, byte [0x446188]
test al, al
jne 0x412707
mov eax, dword [0x446178]
mov esi, dword [0x446174]
cmp esi, eax
jbe 0x41265d
mov ecx, dword [0x44618c]
lea esi, [esi]
add eax, eax
lea edx, [ecx + 1]
cmp esi, eax
mov ecx, edx
ja 0x41264c
mov dword [0x44618c], edx
lea eax, [esi + esi + 2]
xor edi, edi
mov dword [esp], eax
call fcn.0040bec0
movzx ebx, word [0x446178]
mov dword [0x4461b0], eax
mov edx, eax
mov esi, dword [0x446174]
xor ecx, ecx
lea esi, [esi]
lea edi, [edi]
cmp cx, bx
jbe 0x41269d
lea eax, [ebx + ebx]
movzx ebx, ax
lea eax, [edi + 1]
movzx edi, ax
mov word [edx], di
lea eax, [ecx + 1]
movzx ecx, ax
add edx, 2
cmp ecx, esi
jbe 0x41268c
mov eax, dword [0x44618c]
shl eax, 4
mov dword [esp], eax
call fcn.0040bec0
mov dword [0x4461a0], eax
mov ecx, dword [0x450680]
test ecx, ecx
jne 0x412770
xor esi, esi
cmp esi, dword [0x44618c]
jae 0x412707
mov esi, esi
mov dword [esp], 4
mov eax, dword [0x4461a0]
mov ebx, esi
shl ebx, 4
inc esi
add ebx, eax
call fcn.0040bec0
mov dword [ebx], eax
mov eax, dword [ebx]
mov dword [eax], 0
cmp esi, dword [0x44618c]
jb 0x4126dc
mov byte [0x4461a4], 1
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.GLIBCXX_FORCE_NEW
mov eax, 8
mov edi, 0xff0
mov dword [0x446170], eax
mov eax, pe_nt_image_headers32
mov esi, 0x1000
mov dword [0x446174], eax
mov ebx, 0xa
mov eax, 8
mov dword [0x446178], eax
mov dword [0x44617c], edi
mov dword [0x446180], esi
mov dword [0x446184], ebx
call sub.msvcrt.dll_getenv
test eax, eax
setne al
mov byte [0x446188], al
jmp 0x412629
mov eax, dword [0x446180]
mov ebx, 1
shl eax, 3
mov dword [esp], eax
call fcn.0040bec0
cmp dword [0x446180], 1
mov dword [0x446194], eax
jmp 0x4127b8
mov edx, dword [0x446194]
lea eax, [ebx*8]
mov ecx, dword [0x446194]
lea edx, [eax + edx]
add eax, ecx
mov dword [edx - 4], ebx
inc ebx
cmp dword [0x446180], ebx
mov dword [edx - 8], eax
ja 0x412793
mov eax, dword [0x446194]
xor edx, edx
mov dword [eax + ebx*8 - 8], edx
mov eax, dword [0x446194]
mov dword [eax + ebx*8 - 4], ebx
mov dword [esp], 0x446198
call fcn.0040f730
mov dword [esp], 0x446190
mov eax, 0x4129ec
mov dword [esp + 4], eax
call fcn.0040f640
mov dword [ebp - 0x10], 0
mov esi, dword [0x446180]
xor eax, eax
inc esi
cmp eax, dword [0x44618c]
jae 0x412707
lea edi, [esi*4]
lea esi, [esi]
lea edi, [edi]
mov dword [esp], edi
mov edx, dword [ebp - 0x10]
mov eax, dword [0x4461a0]
shl edx, 4
lea ebx, [edx + eax]
call fcn.0040bec0
mov dword [ebx], eax
mov dword [esp], edi
call fcn.0040bec0
mov dword [ebx + 4], eax
mov dword [esp], edi
call fcn.0040bec0
mov dword [ebx + 8], eax
mov dword [esp], 8
call fcn.0040bec0
mov dword [ebx + 0xc], eax
mov dword [esp], eax
call fcn.0040f730
xor edx, edx
jmp 0x41288a
mov eax, dword [ebx]
mov dword [eax + edx*4], 0
mov eax, dword [ebx + 4]
mov dword [eax + edx*4], 0
mov eax, dword [ebx + 8]
mov dword [eax + edx*4], 0
inc edx
cmp edx, esi
jb 0x41286c
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [0x44618c]
jb 0x41281c
jmp 0x412707
Function at 0x412f8c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov eax, dword [0x4461b4]
test eax, eax
je 0x413096
movzx eax, byte [0x4461cc]
test al, al
jne 0x413087
mov eax, dword [0x4461bc]
mov esi, dword [0x4461b8]
cmp esi, eax
jbe 0x412fdd
mov ecx, dword [0x4461d0]
lea esi, [esi]
add eax, eax
lea edx, [ecx + 1]
cmp esi, eax
mov ecx, edx
ja 0x412fcc
mov dword [0x4461d0], edx
lea eax, [esi + esi + 2]
xor edi, edi
mov dword [esp], eax
call fcn.0040bec0
movzx ebx, word [0x4461bc]
mov dword [0x4461f4], eax
mov edx, eax
mov esi, dword [0x4461b8]
xor ecx, ecx
lea esi, [esi]
lea edi, [edi]
cmp cx, bx
jbe 0x41301d
lea eax, [ebx + ebx]
movzx ebx, ax
lea eax, [edi + 1]
movzx edi, ax
mov word [edx], di
lea eax, [ecx + 1]
movzx ecx, ax
add edx, 2
cmp ecx, esi
jbe 0x41300c
mov eax, dword [0x4461d0]
shl eax, 4
mov dword [esp], eax
call fcn.0040bec0
mov dword [0x4461e4], eax
mov ebx, dword [0x450680]
test ebx, ebx
jne 0x4130ef
xor esi, esi
cmp esi, dword [0x4461d0]
jae 0x413087
mov esi, esi
mov dword [esp], 4
mov eax, dword [0x4461e4]
mov ebx, esi
shl ebx, 4
inc esi
add ebx, eax
call fcn.0040bec0
mov dword [ebx], eax
mov eax, dword [ebx]
mov dword [eax], 0
cmp esi, dword [0x4461d0]
jb 0x41305c
mov byte [0x4461e8], 1
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.GLIBCXX_FORCE_NEW
mov eax, 8
mov edi, 0x1000
mov dword [0x4461b4], eax
mov eax, pe_nt_image_headers32
mov esi, 0xa
mov dword [0x4461b8], eax
mov eax, 8
mov dword [0x4461bc], eax
mov eax, 0xff0
mov dword [0x4461c0], eax
mov dword [0x4461c4], edi
mov dword [0x4461c8], esi
call sub.msvcrt.dll_getenv
test eax, eax
setne al
mov byte [0x4461cc], al
jmp 0x412fa9
mov eax, dword [0x4461c4]
mov ebx, 1
shl eax, 3
mov dword [esp], eax
call fcn.0040bec0
cmp dword [0x4461c4], 1
mov dword [0x4461d8], eax
jmp 0x413137
mov edx, dword [0x4461d8]
lea eax, [ebx*8]
mov ecx, dword [0x4461d8]
lea edx, [eax + edx]
add eax, ecx
mov dword [edx - 4], ebx
inc ebx
cmp dword [0x4461c4], ebx
mov dword [edx - 8], eax
ja 0x413112
mov eax, dword [0x4461d8]
xor ecx, ecx
mov dword [eax + ebx*8 - 8], ecx
mov eax, dword [0x4461d8]
mov dword [eax + ebx*8 - 4], ebx
mov dword [esp], 0x4461dc
call fcn.0040f730
mov dword [esp], 0x4461d4
mov edx, 0x41336c
mov dword [esp + 4], edx
call fcn.0040f640
mov dword [ebp - 0x10], 0
mov esi, dword [0x4461c4]
xor eax, eax
inc esi
cmp eax, dword [0x4461d0]
jae 0x413087
lea edi, [esi*4]
lea esi, [esi]
lea edi, [edi]
mov dword [esp], edi
mov edx, dword [ebp - 0x10]
mov eax, dword [0x4461e4]
shl edx, 4
lea ebx, [edx + eax]
call fcn.0040bec0
mov dword [ebx], eax
mov dword [esp], edi
call fcn.0040bec0
mov dword [ebx + 4], eax
mov dword [esp], edi
call fcn.0040bec0
mov dword [ebx + 8], eax
mov dword [esp], 8
call fcn.0040bec0
mov dword [ebx + 0xc], eax
mov dword [esp], eax
call fcn.0040f730
xor edx, edx
jmp 0x41320a
mov eax, dword [ebx]
mov dword [eax + edx*4], 0
mov eax, dword [ebx + 4]
mov dword [eax + edx*4], 0
mov eax, dword [ebx + 8]
mov dword [eax + edx*4], 0
inc edx
cmp edx, esi
jb 0x4131ec
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [0x4461d0]
jb 0x41319c
jmp 0x413087
Function at 0x402c00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x4a13a4]
dec dword [0x4a0b94]
sub dword [0x49d3c8], 0xd8
push 1
push 0
push 0xffffffffffffffff
lea edx, [esp + 0xcc]
push edx
call fcn.00466cb0
push 0
mov eax, 0x4a2c18
call fcn.00414a20
cmp dword [ebp + 0xc], 0
je 0x40185b
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x6c]
mov esi, dword [ebp + 8]
push eax
push ecx
call fcn.00402de0
add esp, 8
test eax, eax
je 0x40185b
mov byte [esp + 0x1a], 1
mov byte [esp + 0x58], 1
jmp 0x40185b

Function at 0x404470
Capabilities:
Encrypt data using speck

Disassembly:
mov eax, dword [eax + 4]
cmp byte [eax], 0xc3
jne 0x40449d
cmp byte [eax + 1], 0
je 0x404497
jbe 0x40447f
mov edx, dword [eax + 8]
mov cl, byte [edx]
test cl, cl
jne 0x404475
mov edx, dword [edx + 8]
test edx, edx
je 0x40447f
cmp dword [edx], 0
jmp 0x40447d
cmp cl, 1
sete cl
test cl, cl
jne 0x404497
mov ecx, dword [eax + 8]
mov eax, dword [ecx + 4]
push 0x49118c
push eax
call fcn.004770b6
add esp, 8
test eax, eax
je 0x40449d
mov eax, 1
ret
xor eax, eax
ret
Function at 0x41db10
Capabilities:
Encode data using xor

Disassembly:
inc ebp
add byte [eax + eax*8 - 0x17ee88c], al
std
add byte [eax], al
add byte [ebx + 0x17], dh
cmp esi, 0xfd
jae 0x41d9b5
inc ebp
mov byte [esi + 0x4a3c00], al
mov al, byte [ebp]
inc esi
test al, al
jne 0x41d996
cmp esi, 0xfd
jb 0x41d9bb
cmp byte [ebp], 0
jne 0x41d9dc
xor eax, eax
cmp esi, eax
jne 0x41da1c
mov edx, dword [edi + 4]
push edx
push eax
push 0x492e60
call fcn.00429ad0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
mov edx, dword [edi + 4]
push edx
push 0
push 0x492dd8
call fcn.00429ad0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
test byte [0x4a3bf8], 1
mov byte [esi + 0x4a3c00], al
jne 0x41da5a
or dword [0x4a3bf8], 1
mov dword [0x4a3be4], 0x4a2ba4
mov dword [0x4a3be8], eax
mov dword [0x4a3bf4], 0x4a3c00
mov dword [0x4a3bf0], 0x1000000
mov dword [0x4a3bec], eax
cmp byte [esp + 0x24], al
jne 0x41dabd
movzx eax, byte [0x4a30e4]
push 1
push eax
mov ecx, 0x4a3c00
call fcn.00467610
add esp, 8
test eax, eax
je 0x41db33
push 0
push 0
push 3
push 0
push esi
push 0x4a3c00
mov ecx, 0x4a2c18
call fcn.0041db90
test eax, eax
jne 0x41db35
mov eax, 0x4a3c00
call fcn.0041e490
cmp eax, 1
jne 0x41dabd
mov eax, 0x4a3bdc
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp byte [0x4a3c00], 0
je 0x41db33
lea ecx, [esp + 0x24]
push ecx
push 0
push 3
lea edx, [esp + 0x2c]
push edx
push esi
push 0x4a3c00
mov ecx, 0x4a2c18
call fcn.0041db90
test eax, eax
jne 0x41db07
movzx eax, byte [esp + 0x24]
mov ecx, dword [esp + 0x20]
push eax
push ecx
push esi
push 0x4a3c00
mov ecx, 0x4a2c18
call fcn.0041df10
test eax, eax
je 0x41db33
cmp byte [edi], 2
jne 0x41db35
mov cl, byte [eax + 0x17]
test cl, cl
jne 0x41db19
mov edx, dword [eax + 0xc]
mov cl, byte [edx + 0x17]
cmp cl, 2
jbe 0x41db35
mov ecx, dword [esp + 0x1c]
push 0x4a3c00
push 0
push 0x492858
call fcn.00429ad0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x42b2b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test esi, esi
je 0x42b3de
cmp byte [esi], 0
je 0x42b3de
push 0x494660
push esi
call fcn.004770b6
add esp, 8
test eax, eax
je 0x42b3d8
push 0x494668
push esi
call fcn.004770b6
add esp, 8
test eax, eax
je 0x42b3d8
push 0x494674
push esi
call fcn.004770b6
add esp, 8
test eax, eax
jne 0x42b2e5
mov eax, 2
ret
push 0x494680
push esi
call fcn.004770b6
add esp, 8
test eax, eax
je 0x42b3d2
push 0x49468c
push esi
call fcn.004770b6
add esp, 8
test eax, eax
je 0x42b3d2
push 0x494694
push esi
call fcn.004770b6
add esp, 8
test eax, eax
jne 0x42b329
mov eax, 4
ret
push 0x49469c
push esi
call fcn.004770b6
add esp, 8
test eax, eax
jne 0x42b341
mov eax, 5
ret
push 0x4945d4
push esi
call fcn.004770b6
add esp, 8
test eax, eax
jne 0x42b359
mov eax, 6
ret
push 0x4945dc
push esi
call fcn.004770b6
add esp, 8
test eax, eax
jne 0x42b371
mov eax, 7
ret
push 0x4946a0
push esi
call fcn.004770b6
add esp, 8
test eax, eax
jne 0x42b389
mov eax, 8
ret
push 0x494584
push esi
call fcn.004770b6
add esp, 8
test eax, eax
jne 0x42b3a1
mov eax, 9
ret
push 0x49458c
push esi
call fcn.004770b6
add esp, 8
test eax, eax
jne 0x42b3b9
mov eax, 0xa
ret
push 0x4946a8
push esi
call fcn.004770b6
add esp, 8
neg eax
sbb eax, eax
and eax, 0xfffffff5
add eax, 0xb
ret
mov eax, 3
ret
mov eax, 1
ret
xor eax, eax
ret
Function at 0x4759ff
Capabilities:
Read file on windows

Disassembly:
je 0x475a42
movzx edx, word [eax + 0x1a]
mov dword [esp + 0x10], edx
mov eax, esi
cmp edi, 0x50435245
je 0x475a24
lea eax, [esp + 0x94]
push eax
xor ebx, ebx
lea eax, [esp + 0x1c]
mov edx, esi
call fcn.00475ad0
add esp, 4
test eax, eax
je 0x475a42
movzx esi, word [eax + 0x18]
add esi, eax
mov dword [esp + 0x14], esi
xor ebx, ebx
jmp 0x475a56
mov eax, 0xfffffffc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xb0
ret
mov esi, dword [esp + 0x14]
lea eax, [ebx + ebp]
cdq
sub eax, edx
mov edx, dword [esp + 0xc4]
mov edi, eax
sar edi, 1
mov ecx, edi
imul ecx, dword [esp + 0x10]
add ecx, esi
lea esi, [ecx + 2]
mov al, byte [edx]
cmp al, byte [esi]
jne 0x475a93
test al, al
je 0x475a8f
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x475a93
add edx, 2
add esi, 2
test al, al
jne 0x475a73
xor eax, eax
jmp 0x475a98
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x475ab9
jle 0x475aa3
lea ebx, [edi + 1]
jmp 0x475aa5
mov ebp, edi
cmp ebp, ebx
jg 0x475a52
mov eax, 0xfffffff9
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xb0
ret
movzx eax, byte [ecx]
movzx ecx, byte [ecx + 1]
pop edi
pop esi
shl eax, 8
pop ebp
add eax, ecx
pop ebx
add esp, 0xb0
ret
Function at 0x475c20
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov ecx, dword [edx]
push ebp
mov ebp, dword [esp + 8]
push esi
push edi
mov esi, ecx
and esi, 0xff0000
mov edi, ecx
shr edi, 0x10
or esi, edi
mov edi, ecx
and edi, 0xff00
shl ecx, 0x10
or edi, ecx
shr esi, 8
shl edi, 8
or esi, edi
cmp esi, 0x50435245
je 0x475b0b
pop edi
pop esi
xor eax, eax
pop ebp
ret
mov ecx, 0xa
mov esi, edx
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [edx + 4]
mov esi, ecx
and esi, 0xff0000
mov edi, ecx
shr edi, 0x10
or esi, edi
shr esi, 8
mov edi, ecx
shl ecx, 0x10
and edi, 0xff00
or edi, ecx
shl edi, 8
or esi, edi
mov dword [eax + 4], esi
mov ecx, dword [edx + 8]
mov esi, ecx
and esi, 0xff0000
mov edi, ecx
shr edi, 0x10
or esi, edi
shr esi, 8
mov edi, ecx
shl ecx, 0x10
and edi, 0xff00
or edi, ecx
shl edi, 8
or esi, edi
mov dword [eax + 8], esi
movzx ecx, word [edx + 0xc]
mov esi, ecx
shr esi, 8
and esi, 0xff
shl ecx, 8
or esi, ecx
mov word [eax + 0xc], si
movzx ecx, word [edx + 0x10]
mov esi, ecx
shr esi, 8
and esi, 0xff
shl ecx, 8
or esi, ecx
mov word [eax + 0x10], si
movzx ecx, word [edx + 0x12]
mov esi, ecx
shr esi, 8
and esi, 0xff
shl ecx, 8
or esi, ecx
mov word [eax + 0x12], si
movzx ecx, word [edx + 0x14]
mov esi, ecx
shr esi, 8
and esi, 0xff
shl ecx, 8
or esi, ecx
mov word [eax + 0x14], si
movzx ecx, word [edx + 0x16]
mov esi, ecx
shr esi, 8
and esi, 0xff
shl ecx, 8
or esi, ecx
mov word [eax + 0x16], si
movzx ecx, word [edx + 0x18]
mov esi, ecx
shr esi, 8
and esi, 0xff
shl ecx, 8
or esi, ecx
mov word [eax + 0x18], si
movzx ecx, word [edx + 0x1a]
mov esi, ecx
shr esi, 8
and esi, 0xff
shl ecx, 8
or esi, ecx
mov word [eax + 0x1a], si
movzx ecx, word [edx + 0x1c]
mov edx, ecx
shr edx, 8
and edx, 0xff
shl ecx, 8
or edx, ecx
mov word [eax + 0x1c], dx
test ebx, ebx
je 0x475cba
mov ecx, 0xb
mov esi, ebx
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebx]
mov edx, ecx
and edx, 0xff0000
mov esi, ecx
shr esi, 0x10
or edx, esi
mov esi, ecx
shl esi, 0x10
shr edx, 8
and ecx, 0xff00
or esi, ecx
shl esi, 8
or edx, esi
mov dword [ebp], edx
mov ecx, dword [ebx + 4]
mov edx, ecx
and edx, 0xff0000
mov esi, ecx
shr esi, 0x10
or edx, esi
mov esi, ecx
shl esi, 0x10
and ecx, 0xff00
or esi, ecx
shl esi, 8
shr edx, 8
or edx, esi
mov dword [ebp + 4], edx
mov ecx, dword [ebx + 0x28]
mov edx, ecx
mov esi, ecx
shr esi, 0x10
and edx, 0xff0000
or edx, esi
mov esi, ecx
shl esi, 0x10
and ecx, 0xff00
or esi, ecx
shr edx, 8
shl esi, 8
or edx, esi
mov dword [ebp + 0x28], edx
pop edi
pop esi
pop ebp
ret
Function at 0x475f02
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x540
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x540]
call fcn.0047648e
lea eax, [ebp - 0x13c]
push 0x104
push eax
push 0
call dword [0x48d290]
lea eax, [ebp - 0x13c]
push 0x49c010
push eax
call fcn.0047a7c6
pop ecx
mov dword [esi], eax
test eax, eax
pop ecx
jne 0x475e4d
push 1
pop eax
jmp 0x475fdd
xor eax, eax
mov cl, byte [eax + 0x49c008]
mov byte [ebp + eax - 0x24], cl
mov cl, byte [eax + section..data]
mov byte [ebp + eax - 0x1c], cl
inc eax
cmp eax, 8
jl 0x475e4f
mov edi, dword [ebp + 0xc]
push edi
call fcn.0047b750
and dword [esi + 0x110], 0
pop ecx
lea ecx, [esi + 0x110]
xor edx, edx
test eax, eax
jle 0x475e91
movsx ebx, byte [edx + edi]
add dword [ecx], ebx
inc edx
cmp edx, eax
jl 0x475e86
push 2
push 0xfffffffffffffff8
push dword [esi]
call fcn.0047b6c8
push dword [esi]
lea edi, [esi + 4]
push 1
pop ebx
push ebx
push 4
push edi
call fcn.0047b621
push dword [esi]
call fcn.0047b372
push dword [esi]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push ebx
push 4
push eax
call fcn.0047b621
push 0
push 0
push dword [esi]
call fcn.0047b6c8
and dword [ebp + 0xc], 0
add esp, 0x3c
cmp dword [ebp - 8], 0
mov eax, dword [ebp + 0xc]
jle 0x475f10
mov ecx, dword [esi]
test byte [ecx + 0xc], 0x10
jne 0x475f10
push ecx
push ebx
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.0047b621
add esp, 0x10
lea ecx, [ebp - 0x540]
push dword [ebp - 0x14]
call fcn.004764cd
inc dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 8]
jl 0x475ee0
xor eax, 0xaaaaaaaa
cmp dword [ebp - 0x10], eax
jne 0x475f51
push 0
push dword [edi]
push dword [esi]
call fcn.0047b6c8
push dword [esi]
lea eax, [ebp - 0x34]
push ebx
push 0x10
push eax
call fcn.0047b621
add esp, 0x1c
test eax, eax
je 0x475f51
xor eax, eax
mov cl, byte [ebp + eax - 0x34]
cmp cl, byte [ebp + eax - 0x24]
jne 0x475f4c
inc eax
cmp eax, 0x10
jl 0x475f3c
cmp eax, 0x10
je 0x475f55
push 3
jmp 0x475f6d
push dword [esi]
lea eax, [ebp - 1]
push ebx
push ebx
push eax
call fcn.0047b621
add esp, 0x10
cmp byte [ebp - 1], 3
je 0x475f7a
push 4
pop edi
push dword [esi]
call fcn.0047aa1b
pop ecx
mov eax, edi
jmp 0x475fdd
push dword [esi]
lea eax, [ebp - 0xc]
push ebx
push 4
push eax
call fcn.0047b621
mov edi, dword [ebp - 0xc]
push dword [esi]
xor edi, 0xfac1
lea ebx, [esi + 0xc]
push edi
push 1
push ebx
call fcn.0047b621
add esp, 0x20
lea eax, [edi + 0xc3d2]
mov ecx, esi
push eax
push edi
push ebx
call fcn.00475ff2
and byte [edi + esi + 0xc], 0
lea eax, [esi + 0x110]
xor ecx, ecx
cmp edi, ecx
mov dword [eax], ecx
jle 0x475fd0
movsx edx, byte [ebx + ecx]
add dword [eax], edx
inc ecx
cmp ecx, edi
jl 0x475fc5
push dword [esi]
call fcn.0047b372
mov dword [esi + 8], eax
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x401750
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov es, word [ebp + 8]
mov ecx, dword [0x2dc0ff]
push eax
add ecx, 0x40
push 0x40d274
push ecx
call [edi]
rol dword [bx + si], 0xa1
lodsb al, byte [esi]
add cl, byte [eax + eax]
add esp, 0xc
xchg ecx, eax
sal byte [edi + ecx + 0x50], 0x68
push esp
rol byte [eax], cl
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 8
push 1
call dword [sym.imp.MSVCRT.dll_exit]
nop
mov dh, 0x25
in al, dx
cli
in al, dx
mov eax, 0xa1000000
js 0x40179e
inc ecx
add byte [ebp + 0x404ca1c0], al
inc ecx
add byte [esp + edx + 0x68], dh
inc eax
cmp al, 0x41
add byte [eax + 0x5e], dl
test eax, eax
mov eax, dword [0x41404c]
je 0x4017bb
push 0x413c40
push eax
pop esi
sahf
inc eax
add byte [ebp + 0x740d8b66], bh
add al, byte [ecx]
jmp 0x4017cf
mov edx, dword [0x6c411800]
push edx
push eax
mov cs, word [eax + 0x66000040]
mov ecx, dword [0x4117f4]
mov dword [0x411808], eax
invalid

Function at 0x40a3d0
Capabilities:
Terminate process

Disassembly:
lodsd eax, dword [esi]
mov ebp, esp
mov edx, dword [ebx - 0x4cbf74f8]
test eax, eax
pushal
xor ecx, dword [ebx + 0x50510c4d]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x40a40a
push esi
mov esi, dword [0x408198]
invalid
cli
rcr byte [ebp - 0x21], 8
add byte [esi + 0x714e3b], bl
pop ebp
ret 8

Function at 0x40ac48
Capabilities:
Encode data using xor

Disassembly:
pop esi
push esi
xor dword [esi], ebx
lodsd eax, dword [esi]
add ebx, eax
test eax, eax
jne 0x40ac4a
ret
Function at 0xdb5370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0xdb538e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0xdde074
push ecx
mov edi, eax
call fcn.00dc9198
mov esi, eax
add esp, 8
test esi, esi
jne 0xdb53cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.00dc902e
push esi
call fcn.00dc8fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0xdb8850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0xdb88ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0xde3720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xdb88ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.00dc91e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0xdb88ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0xde3720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xdb892a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.00dca082
xor esi, esi
add esp, 8
cmp eax, esi
je 0xdb8957
mov word [eax], si
add eax, 2
push eax
call fcn.00dca030
add esp, 4
jmp 0xdb8959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0xdb88ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0xdb88b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0xdb8ff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret