joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45632a
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x456343
or eax, 0xffffffff
jmp 0x4563a4
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x4563a0
push 0x3d
push esi
call fcn.00456dc8
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x4563a0
cmp esi, eax
je 0x4563a0
xor ecx, ecx
cmp byte [eax + 1], bl
mov eax, dword [0x477120]
sete cl
cmp eax, dword [0x477124]
mov dword [ebp - 8], ecx
jne 0x456386
mov edi, eax
call fcn.004562c9
mov dword [0x477120], eax
cmp eax, ebx
jne 0x4563df
cmp dword [ebp + 0xc], ebx
je 0x4563a8
cmp dword [0x477128], ebx
je 0x4563a8
call fcn.00453a44
test eax, eax
je 0x4563df
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 8], ebx
je 0x4563b1
xor eax, eax
jmp 0x4563a3
push 4
call fcn.0044e235
cmp eax, ebx
pop ecx
mov dword [0x477120], eax
je 0x4563a0
mov dword [eax], ebx
cmp dword [0x477128], ebx
jne 0x4563df
push 4
call fcn.0044e235
cmp eax, ebx
pop ecx
mov dword [0x477128], eax
je 0x4563a0
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
sub edi, dword [ebp - 4]
push dword [ebp - 4]
mov esi, dword [0x477120]
call fcn.0045627c
mov edi, eax
cmp edi, ebx
pop ecx
jl 0x456440
cmp dword [esi], ebx
je 0x456440
lea esi, [esi + edi*4]
push dword [esi]
call fcn.0044e3a9
cmp dword [ebp - 8], ebx
pop ecx
jne 0x456423
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x456481
mov eax, dword [esi + 4]
mov dword [esi], eax
inc edi
add esi, 4
cmp dword [esi], ebx
jne 0x45641a
mov eax, edi
shl eax, 2
push eax
push dword [0x477120]
call fcn.0044e247
cmp eax, ebx
pop ecx
pop ecx
je 0x456481
jmp 0x45647c
cmp dword [ebp - 8], ebx
jne 0x4564ec
cmp edi, ebx
jge 0x45644f
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x477120]
call fcn.0044e247
cmp eax, ebx
pop ecx
pop ecx
je 0x4563a0
mov edx, dword [ebp - 4]
lea ecx, [eax + edi*4]
mov dword [ecx], edx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
mov dword [0x477120], eax
cmp dword [ebp + 0xc], ebx
je 0x4564d6
push dword [ebp - 4]
call fcn.0044c220
inc eax
inc eax
push eax
call fcn.0044e235
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x4564d6
push dword [ebp - 4]
push esi
call fcn.0044def0
mov eax, esi
sub eax, dword [ebp - 4]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
mov ecx, dword [ebp - 8]
mov byte [eax], bl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x4564cf
or dword [ebp - 0x10], 0xffffffff
push esi
call fcn.0044e3a9
pop ecx
cmp dword [ebp - 8], ebx
je 0x4564e4
push dword [ebp - 4]
call fcn.0044e3a9
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x4563a3
push dword [ebp - 4]
call fcn.0044e3a9
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], ebx
jmp 0x4563ad
Function at 0x456543
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0044ed20
mov eax, dword [0x473bf0]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp ebx, dword [0x477784]
mov dword [ebp - 4], eax
jae 0x456686
mov eax, ebx
sar eax, 5
mov eax, dword [eax*4 + 0x4777a0]
mov ecx, ebx
and ecx, 0x1f
test byte [eax + ecx*8 + 4], 1
je 0x456686
push 1
push esi
push ebx
call fcn.004553c1
add esp, 0xc
cmp eax, 0xffffffff
mov dword [ebp - 0x1008], eax
je 0x456690
push 2
push esi
push ebx
call fcn.004553c1
add esp, 0xc
cmp eax, 0xffffffff
je 0x456690
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x456630
push 0x1000
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.0044ce90
push 0x8000
push ebx
call fcn.00456e2f
add esp, 0x14
mov dword [ebp + 8], eax
mov eax, 0x1000
cmp edi, eax
jge 0x4565ef
mov eax, edi
push eax
lea eax, [ebp - 0x1004]
push eax
push ebx
call fcn.00450c4f
add esp, 0xc
cmp eax, 0xffffffff
je 0x45660d
sub edi, eax
test edi, edi
jg 0x4565e4
jmp 0x456623
cmp dword [0x4770f8], 5
jne 0x456620
mov dword [0x4770f4], 0xd
or esi, 0xffffffff
push dword [ebp + 8]
push ebx
call fcn.00456e2f
pop ecx
pop ecx
jmp 0x456670
jge 0x456670
push 0
push dword [ebp + 0xc]
push ebx
call fcn.004553c1
push ebx
call fcn.004542fa
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, 0xffffffff
jne 0x456670
mov dword [0x4770f4], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x4770f8], eax
push 0
push dword [ebp - 0x1008]
push ebx
call fcn.004553c1
add esp, 0xc
mov eax, esi
pop edi
jmp 0x456693
mov dword [0x4770f4], 9
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0044fbf6
leave
ret

Function at 0x1000125c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0xc], 0
call sub.KERNEL32.DLL_GetEnvironmentStringsA
mov ebx, eax
mov dword [ebp - 0x10], ebx
jmp 0x10001299
cmp byte [ebx], 0x3d
je 0x10001285
inc dword [ebp - 0xc]
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
lea ebx, [ebx + edi]
cmp byte [ebx], 0
jne 0x10001278
mov edi, dword [ebp - 0xc]
inc edi
lea edi, [edi*4]
mov dword [ebp - 0x14], edi
push dword [ebp - 0x14]
call sub.CRTDLL.DLL_malloc
pop ecx
mov dword [ebp - 8], eax
mov dword [0x10003010], eax
cmp dword [ebp - 8], 0
jne 0x100012cc
xor eax, eax
jmp 0x10001342
mov ebx, dword [ebp - 0x10]
jmp 0x10001325
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
mov dword [ebp - 4], edi
cmp byte [ebx], 0x3d
je 0x1000131f
push dword [ebp - 4]
call sub.CRTDLL.DLL_malloc
pop ecx
mov esi, dword [ebp - 8]
mov dword [esi], eax
or eax, eax
jne 0x10001308
jmp 0x10001342
push ebx
mov edi, dword [ebp - 8]
push dword [edi]
call sub.CRTDLL.DLL_strcpy
add esp, 8
add dword [ebp - 8], 4
mov edx, dword [ebp - 4]
lea ebx, [ebx + edx]
cmp byte [ebx], 0
jne 0x100012d1
mov edx, dword [ebp - 8]
mov dword [edx], 0
mov eax, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404340
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esp, ebp
pop ebp
ret

Function at 0x404360
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov esp, ebp
pop ebp
ret

Function at 0x407968
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x40798c
cmp dword [edi + 0x54], 0
jne 0x40798c
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.004058d3
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00407929
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x40cf75
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x40cfbc
call fcn.004058d3
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40cfbc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x40cfd8
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0040caed
mov esi, eax
test edi, edi
je 0x40cfd6
test ebx, ebx
je 0x40cfd6
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40d753
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x4381a0
call fcn.0042341d
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x40d778
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x40d7be
lea ecx, [ebp - 0x10]
call fcn.00402540
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040464a
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00402670
mov eax, esi
call fcn.004234f5
ret 8
Function at 0x40f33f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x40f387
call fcn.004058d3
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40f387
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x40f3ca
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x40f3b3
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x40f3b3
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x40f3c7
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x421f8e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44b680]
jne 0x421f98
repz ret
jmp fcn.00427a62

Function at 0x42e99d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004273c6
and dword [ebp - 4], 0
cmp dword [0x44fad4], 0
mov ebx, eax
jne 0x42ea4e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x42eaff
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x42eaff
push eax
call fcn.00427354
mov dword [esp], 0x43e5e0
push edi
mov dword [0x44fad4], eax
call esi
push eax
call fcn.00427354
mov dword [esp], 0x43e5cc
push edi
mov dword [0x44fad8], eax
call esi
push eax
call fcn.00427354
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44fadc], eax
call esi
push eax
call fcn.00427354
pop ecx
mov dword [0x44fae4], eax
test eax, eax
je 0x42ea4e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00427354
pop ecx
mov dword [0x44fae0], eax
mov eax, dword [0x44fae0]
cmp eax, ebx
je 0x42eaa6
cmp dword [0x44fae4], ebx
je 0x42eaa6
push eax
call fcn.004273cf
push dword [0x44fae4]
mov esi, eax
call fcn.004273cf
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42eaa6
test edi, edi
je 0x42eaa6
call esi
test eax, eax
je 0x42ea9d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42ea9d
test byte [ebp - 0xc], 1
jne 0x42eaa6
or dword [ebp + 0x10], 0x200000
jmp 0x42eadf
mov eax, dword [0x44fad8]
cmp eax, ebx
je 0x42eadf
push eax
call fcn.004273cf
pop ecx
test eax, eax
je 0x42eadf
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42eadf
mov eax, dword [0x44fadc]
cmp eax, ebx
je 0x42eadf
push eax
call fcn.004273cf
pop ecx
test eax, eax
je 0x42eadf
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44fad4]
call fcn.004273cf
pop ecx
test eax, eax
je 0x42eaff
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42eb01
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x436110
Capabilities:
Check os version
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439649
mov eax, dword fs:[0]
push eax
sub esp, 0x178
mov eax, dword [0x44b680]
xor eax, ebp
mov dword [ebp - 0x58], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x184], ecx
mov dword [ebp - 4], 1
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0xd]
call fcn.004020c0
mov byte [ebp - 4], 2
push 0x11c
push 0
lea eax, [ebp - 0x17c]
push eax
call fcn.004226a0
add esp, 0xc
mov dword [ebp - 0x17c], 0x11c
lea ecx, [ebp - 0x17c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], 0
push 0x38
push 0
lea edx, [ebp - 0x4c]
push edx
call fcn.004226a0
add esp, 0xc
mov dword [ebp - 0x50], 0x3c
mov dword [ebp - 0x48], 0
cmp dword [ebp - 0x178], 6
jb 0x4361c8
cmp dword [ebp + 0x18], 1
jne 0x4361c8
mov dword [ebp - 0x44], str.runas
jmp 0x4361cf
mov dword [ebp - 0x44], str.open
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x4c], 0x40
push 0
lea ecx, [ebp + 8]
call fcn.00402940
mov dword [ebp - 0x40], eax
push 0
lea ecx, [ebp + 0xc]
call fcn.00402940
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x43620b
cmp dword [ebp - 0x30], 0x20
jg 0x436214
mov dword [ebp - 0x14], 0xffffffff
jmp 0x43626d
cmp dword [ebp + 0x14], 0
jne 0x436223
mov dword [ebp + 0x10], 0
jmp 0x43626d
cmp dword [ebp - 0x18], 0
je 0x43626d
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0x103
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0x103
jne 0x43625c
push 0x1f4
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
jmp 0x436232
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x180], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd]
call fcn.00401f30
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.004024a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.004024a0
mov eax, dword [ebp - 0x180]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x58]
xor ecx, ebp
call fcn.00421f8e
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4379c0
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4394b9
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x44b680]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.CLangControl.0
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.00402540
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 8
call fcn.00402540
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00406c6b
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx ecx, ax
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x20], ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00402a40
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x437a60
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439532
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x44b680]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], 0
lea ecx, [ebp - 0x18]
call fcn.00402540
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov word [ebp - 0x1c], ax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 0x20], eax
mov ax, word [ebp - 0x1c]
mov word [ebp - 0x14], ax
lea ecx, [ebp - 0x10]
call fcn.00402540
mov byte [ebp - 4], 1
movzx ecx, word [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
call fcn.00401c90
lea ecx, [ebp - 0x10]
call fcn.00401430
movzx edx, al
test edx, edx
je 0x437b19
movzx eax, word [ebp - 0x14]
and eax, 0x3ff
mov dword [ebp - 0x24], eax
movzx ecx, word [ebp - 0x14]
and ecx, 0x3ff
push ecx
lea ecx, [ebp - 0x10]
call fcn.00401c90
lea ecx, [ebp - 0x10]
call fcn.00401430
movzx edx, al
test edx, edx
je 0x437b19
push 9
lea ecx, [ebp - 0x10]
call fcn.00401c90
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
call fcn.00402120
mov ecx, dword [ebp - 0x28]
or ecx, 1
mov dword [ebp - 0x28], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004024a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.004024a0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4617e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x461805
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x461878
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x46183a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x46186d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x46186b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x461831
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x4617fc
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x1002aadf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x1002aaee
pop dword [ebp - 0x48]
mov eax, 0x21ce66a0
sub eax, 0x11cbbbb2
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x26b298d9
sub dword [ebp - 0x58], 0xd860538e
mov dword [ebp - 0x54], 0x52037f6e
add dword [ebp - 0x54], 0xe02fccd7
mov dword [ebp - 0x50], 0xd1ce0650
add dword [ebp - 0x50], 0x7a7e3dde
mov dword [ebp - 0x4c], 0xc28febac
sub dword [ebp - 0x4c], 0xc28febac
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x3969b743
sub dword [ebp - 0x58], 0xc4f74ded
mov dword [ebp - 0x54], 0xa91f5392
sub dword [ebp - 0x54], 0x67b2f21d
mov dword [ebp - 0x50], 0xb7882e57
sub dword [ebp - 0x50], 0x5418c1eb
mov dword [ebp - 0x4c], 0x32cd7de
sub dword [ebp - 0x4c], 0x32cd7de
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x36f48
push 0
call eax
mov ecx, 0x306d134
add ecx, 0xfcf978bf
xor edi, edi
add edi, eax
mov ebx, 0x10039600
add ebx, dword [ebp - 0x48]
mov edx, 0x9f2df514
mov dword [ebp - 0x38], 0x3bce54b9
mov esi, dword [ebx]
add dword [ebp - 4], 0x2bbfc191
xor esi, edx
mov dword [edi], esi
add dword [ebp - 0xc], esi
add edi, 4
add ebx, 4
loop 0x1002abfc
add eax, 0x11a9f
mov ebx, eax
add eax, 0x9bfd9dfe
add eax, 0x64026207
mov ecx, 0x1b786eca
add ecx, 0xf4879136
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x401cf0
Capabilities:
Hide graphical window

Disassembly:
test eax, eax
jne 0x401c9b
mov eax, dword [0x404387]
jmp 0x401cd6
push eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop eax
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, edi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x50], eax
push 0
push 0
push 0
push dword [ebp - 0x50]
call dword [sym.imp.USER32.dll_GetMessageW]
and eax, eax
je 0x401cd3
push dword [ebp - 0x50]
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x401cb5
mov eax, dword [ebp - 0x14]
call fcn.00401810
pop ebx
pop edi
pop esi
leave
ret 0x10
push ebp
mov ebp, esp
sub esp, 0x4c
mov ebx, str.dewjts
mov eax, dword [ebp + 8]
mov dword [0x4042d7], eax
push str.Troots
mov edi, dword [0x4042d7]
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], eax
push 0x7f02
mov dword [ebp - 0x38], edi
push edi
call dword [sym.imp.USER32.dll_LoadIconW]
mov eax, 0
mov dword [ebp - 0x34], eax
mov eax, 3
mov dword [ebp - 0x48], eax
push 0x7f02
push edi
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x24], ebx
lea ecx, [ebp - 0x4c]
push ecx
mov dword [ebp - 0x4c], 0x30
mov eax, 0x4018c0
mov dword [ebp - 0x44], eax
mov eax, 0xe
mov dword [ebp - 0x2c], eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
xor eax, eax
mov dword [0x4042db], ebp
mov edi, eax
inc eax
push edi
push dword [0x4042d7]
dec eax
push edi
push edi
push eax
push ebx
push edi
push edi
push 0x80ca0000
push str.Troots
push str.dewjts
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
cmp eax, 0
jne 0x401c90
leave
ret 0x10
Function at 0x10017f30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x10017f3f
pop dword [ebp - 0x38]
mov eax, 0x7792db56
sub eax, 0x67915c17
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xa9aec901
sub dword [ebp - 0x48], 0x5b5c83b6
mov dword [ebp - 0x44], 0x6f6820b9
add dword [ebp - 0x44], 0xc2cb2b8c
mov dword [ebp - 0x40], 0x2a24b251
add dword [ebp - 0x40], 0x222791dd
mov dword [ebp - 0x3c], 0x56524919
sub dword [ebp - 0x3c], 0x56524919
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x9ad0ac5a
sub dword [ebp - 0x48], 0x265e4304
mov dword [ebp - 0x44], 0xf25eeb63
add dword [ebp - 0x44], 0x4f0d7612
mov dword [ebp - 0x40], 0xfbdf9bff
add dword [ebp - 0x40], 0x678fd06d
mov dword [ebp - 0x3c], 0x6b948b8
add dword [ebp - 0x3c], 0xf946b748
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x5c522cc3
sub eax, 0x4c4fdc47
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x39681
push 0
call eax
mov ecx, 0x66651abb
add ecx, 0x999b255e
xor ebx, ebx
add ebx, eax
mov esi, 0xb9e07048
sub esi, 0xa9dd6448
add esi, dword [ebp - 0x38]
mov edi, 0x7fdd8685
add edi, 0x728630e2
sub dword [ebp - 0x20], 0xe68ebf61
mov edx, dword [esi]
sub dword [ebp - 8], ecx
xor edx, edi
xor dword [ebp - 0x34], eax
mov dword [ebx], edx
xor dword [ebp - 4], edx
add ebx, 0xc2f4eac5
sub ebx, 0xc2f4eac1
add esi, 4
loop 0x1001805e
add eax, 0xbd9123f8
sub eax, 0xbd9030c1
xor ebx, ebx
add ebx, eax
add eax, 0x7ad40ae8
add eax, 0x852bf51d
mov ecx, 0x10000000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x1001c940
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x1001c9db
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x1001c992
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x1001c992
cmp esi, ebx
jge 0x1001c992
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x1001c9d5
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x1001c9d5
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100252e4]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100252e4]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1001c9ed
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc