joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a3774
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.005a44a0
test byte [ebp + 0xd], 0xc0
jne 0x5a3798
mov eax, dword [0x5f7788]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x5a37a5
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x5a37d2
je 0x5a37e4
sub ecx, 0x100
je 0x5a37f6
sub ecx, 0x100
je 0x5a37ff
sub ecx, 0x100
je 0x5a37ed
jmp 0x5a3808
sub ecx, 0x600
je 0x5a37ff
sub ecx, 0x100
je 0x5a37e4
jmp 0x5a3808
mov dword [ebp - 8], 1
jmp 0x5a380f
mov dword [ebp - 8], 2
jmp 0x5a380f
mov dword [ebp - 8], 4
jmp 0x5a380f
mov dword [ebp - 8], 5
jmp 0x5a380f
mov dword [ebp - 8], 3
test byte [ebp + 0xd], 1
je 0x5a3836
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x5f7200]
test al, 0x80
je 0x5a382f
mov ebx, 0x80
jmp 0x5a3848
mov ebx, 1
jmp 0x5a3848
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x5a3848
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x5a385a
je 0x5a3863
dec eax
je 0x5a386c
jmp 0x5a3875
mov dword [ebp - 4], connect
jmp 0x5a3884
mov dword [ebp - 4], 0x40000000
jmp 0x5a3884
mov dword [ebp - 4], 0xc0000000
jmp 0x5a3884
push 1
call fcn.005a48b8
pop ecx
mov ebx, eax
jmp 0x5a3984
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x5a38a0
sub eax, 0x10
je 0x5a38a4
sub eax, 0x10
je 0x5a38ab
sub eax, 0x10
je 0x5a38b2
jmp 0x5a38b2
xor edi, edi
jmp 0x5a38b7
mov edi, 1
jmp 0x5a38b7
mov edi, 2
jmp 0x5a38b7
mov edi, 3
test byte [ebp + 0xc], 4
je 0x5a38cf
cmp dword [ebp - 4], 0x80000000
jne 0x5a38cd
mov edi, 1
jmp 0x5a38cf
xor edi, edi
mov dword [ebp - 0x14], 0xc
xor eax, eax
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 0xc]
and edx, 0x80
cmp edx, 1
sbb ecx, ecx
neg ecx
mov dword [ebp - 0xc], ecx
push 0
push ebx
mov ecx, dword [ebp - 8]
push ecx
lea eax, [ebp - 0x14]
push eax
push edi
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x5a393d
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x5a3932
test byte [ebp + 0xd], 1
je 0x5a392d
mov ebx, 0x50
jmp 0x5a3932
mov ebx, 2
push ebx
call fcn.005a48b8
pop ecx
mov ebx, eax
jmp 0x5a3984
mov edi, esi
push edi
call fcn.005a36d8
pop ecx
test eax, eax
je 0x5a3951
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x5a395d
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.005a45e0
add esp, 8
mov ebx, eax
inc eax
jne 0x5a3984
push 4
call fcn.005a48b8
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.005a44d4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5a7f2c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0x200
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.KERNEL32.DLL_GetLocaleInfoA
push str._._n
lea ecx, [ebp - 0x200]
push ecx
call fcn.005a22a4
add esp, 8
lea ecx, [ebp - 0x200]
push ecx
call fcn.005a2354
pop ecx
mov edx, 0x200
sub edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.005a2354
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
push 0x5f84b5
lea ecx, [ebp - 0x200]
push ecx
call fcn.005a22a4
add esp, 8
push 0xa
lea ecx, [ebp - 0x200]
push ecx
call fcn.005a2354
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov eax, dword [ebx]
push eax
call fcn.005a9414
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0x5a803d
push esi
call fcn.005a2354
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call fcn.005a2354
pop ecx
add edi, eax
add edi, 3
push edi
call fcn.005a13a0
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0x5a8014
xor eax, eax
jmp 0x5a80c4
push esi
call fcn.005a2354
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call fcn.005a2354
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call fcn.005a21d3
add esp, 0xc
jmp 0x5a807d
mov edi, dword [ebx + 0x24]
push edi
call fcn.005a2354
pop ecx
push eax
push esi
call fcn.005a2354
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.005a2354
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call fcn.005a13c0
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x5a807d
xor eax, eax
jmp 0x5a80c4
push esi
mov edx, dword [ebx + 0x24]
push edx
call fcn.005a22a4
add esp, 8
push 0x5f84b7
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.005a22a4
add esp, 8
lea ecx, [ebp - 0x200]
push ecx
mov eax, dword [ebx + 0x24]
push eax
call fcn.005a22a4
add esp, 8
push 0x5f84b9
mov edx, dword [ebx + 0x24]
push edx
call fcn.005a22a4
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5abcb8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
jne 0x5abce5
jmp 0x5abd1c
call fcn.005abc68
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.005a2354
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.005a2354
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x5abda0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x5f8b78], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x5abe7a
cmp dword [0x5f8b74], 0
jne 0x5abe7a
cmp dword [0x5f8d74], 0
je 0x5abe34
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.005ab770
add esp, 8
mov ebx, eax
test eax, eax
jne 0x5abe1a
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.005ab770
add esp, 8
mov ebx, eax
test eax, eax
jne 0x5abe1a
lea ebx, [ebp - 0x84]
jmp 0x5abe1b
inc ebx
call fcn.005abd58
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x5abeb5
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x5f8b7c
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.005a2354
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x5f8b7f
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x5abeb5
cmp dword [0x5f8b74], 0
je 0x5abe94
cmp dword [0x5f8b74], 0xffffffff
je 0x5abeb5
push esi
call dword [0x5f8b74]
pop ecx
mov eax, dword [0x5f8b78]
test eax, eax
je 0x5abeb5
cmp dword [0x5f8b78], 0xffffffff
je 0x5abeb5
cmp byte [eax], 0
je 0x5abeb5
push esi
push eax
call fcn.005abcb8
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5ad418
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1c]
mov esi, dword [ebp + 0xc]
cmp esi, 0x10
jge 0x5ad43e
test esi, esi
je 0x5ad43e
call fcn.005abd24
mov dword [eax], 0x13
or eax, 0xffffffff
jmp 0x5ad4b0
call fcn.005ad11c
mov ebx, eax
test eax, eax
jne 0x5ad459
call fcn.005abd24
mov dword [eax], 8
or eax, 0xffffffff
jmp 0x5ad4b0
mov edx, dword [ebp + 0x10]
lea eax, [ebp - 4]
mov dword [ebx + 4], edx
mov ecx, dword [ebp + 8]
mov dword [ebx + 0x14], ecx
mov ecx, dword [ebp + 0x20]
mov dword [ebx + 0x58], ecx
push eax
mov edx, dword [ebp + 0x18]
push edx
push ebx
push 0x5ad374
push esi
mov ecx, dword [ebp + 0x14]
push ecx
call sub.KERNEL32.DLL_CreateThread
test eax, eax
jne 0x5ad4a4
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x718
jne 0x5ad49d
push 0x59
call fcn.005a48b8
pop ecx
jmp 0x5ad4b0
call fcn.005a4924
jmp 0x5ad4b0
mov dword [ebx + 8], eax
test edi, edi
je 0x5ad4b0
mov edx, dword [ebp - 4]
mov dword [edi], edx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x53b730
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xde000]
push edi
jmp 0x53b74a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x53b751
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53b740
mov eax, 1
add ebx, ebx
jne 0x53b763
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x53b774
jne 0x53b793
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53b793
dec eax
add ebx, ebx
jne 0x53b780
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x53b758
add ebx, ebx
jne 0x53b78f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x53b7e5
xor ecx, ecx
sub eax, 3
jb 0x53b7ab
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x53b81a
sar eax, 1
mov ebp, eax
jmp 0x53b7b6
add ebx, ebx
jne 0x53b7b6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53b784
inc ecx
add ebx, ebx
jne 0x53b7c4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53b784
add ebx, ebx
jne 0x53b7d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x53b7c6
jne 0x53b7e2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x53b7c6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x53b804
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x53b7f6
jmp 0x53b746
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x53b804
add edi, ecx
jmp 0x53b746
pop esi
mov edi, esi
mov ecx, 0x40f0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x53b822
cmp byte [edi], 0x11
jne 0x53b822
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x53b827
lea edi, [esi + 0x134000]
mov eax, dword [edi]
or eax, eax
je 0x53b89f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x191818]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x191994]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x53b854
mov ecx, edi
jns 0x53b883
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x191998]
or eax, eax
je 0x53b899
mov dword [ebx], eax
add ebx, 4
jmp 0x53b871
call dword [esi + 0x1919a8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x53b8d0
cmp al, 0xef
ja 0x53b8c3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x53b8a5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x53b8b2
mov ebp, dword [esi + 0x19199c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x53b904
sub esp, 0xffffff80
jmp 0x420577
Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40501c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x405028
push 0x405024
push 0x405020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x405028]
push dword [0x405024]
push dword [0x405020]
mov dword [0x405014], esp
call fcn.0040129c
add esp, 0x18
sub ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x404a10
Capabilities:
Get mac address on windows

Disassembly:
push ecx
push esi
push edi
mov edi, dword [sym.imp.MSVCRT.dll_malloc]
push 0x280
call edi
add esp, 4
mov esi, eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x280
push eax
push esi
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
je 0x404a4f
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [esp + 8]
push ecx
call edi
add esp, 4
mov esi, eax
lea edx, [esp + 8]
push edx
push esi
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x404ae6
test esi, esi
je 0x404add
mov edi, dword [esp + 0x10]
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_strstr]
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [esi + 0x10c]
push 0x4084d0
push eax
call ebx
mov eax, dword [esi + 0x1a0]
add esp, 8
cmp eax, 6
jne 0x404ad5
xor ecx, ecx
xor edx, edx
mov cl, byte [esi + 0x199]
mov dl, byte [esi + 0x198]
xor eax, eax
push ecx
mov al, byte [esi + 0x197]
push edx
xor ecx, ecx
push eax
mov cl, byte [esi + 0x196]
xor edx, edx
mov dl, byte [esi + 0x195]
xor eax, eax
mov al, byte [esi + 0x194]
push ecx
push edx
push eax
push str._02X__02X__02X__02X__02X__02X
push edi
call ebp
add esp, 0x20
mov esi, dword [esi]
test esi, esi
jne 0x404a78
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
pop ecx
ret
pop edi
xor eax, eax
pop esi
pop ecx
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
je 0x431072
nop
nop
nop
nop
mov ebx, 0x40915c
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x70da3b6a
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x431060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4310d2
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x1a0e1903
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x4310c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x407601
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x407610
pop dword [ebp - 0x48]
mov eax, 0x83e32c73
sub eax, 0x83a2b663
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x3cc04
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0xab03bd29
sub ecx, 0xab03674f
xor edi, edi
add edi, eax
mov ebx, 0x413bc4
add ebx, dword [ebp - 0x48]
mov edx, 0xb77c6f7f
add edx, 0x89a1998d
add dword [ebp - 0x44], edi
mov esi, dword [ebx]
xor dword [ebp - 0x10], ecx
xor esi, edx
xor dword [ebp - 0x10], 0xc6103634
mov dword [edi], esi
xor dword [ebp - 0x40], 0xa703beb
add edi, 4
add ebx, 0x4285797b
sub ebx, 0x42857977
loop 0x407666
add eax, 0xe73a7b4
add eax, 0xf18da287
xor ebx, ebx
add ebx, eax
add eax, 0x6fd186f9
sub eax, 0x6fd186f4
mov ecx, 0x5f66f553
add ecx, 0xa0d90aad
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x8c2148
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x8c1ea3
add esi, 0x48b2888b
and esi, esi
sub esi, esi
call fcn.008c2174
sub eax, eax
xor dword [edi], edx
sub eax, esi
add eax, eax
inc edi
inc esi
add esi, 1
cmp edi, ecx
jne fcn.008c2148
add esi, esi
ret
Function at 0x401240
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push edi
mov ebx, eax
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 8
push eax
mov dword [esp + 0x18], 4
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov dword [esp + 0x14], edi
call dword [sym.imp.USER32.dll_GetActiveWindow]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov esi, dword [sym.imp.USER32.dll_GetKeyboardType]
push edi
call esi
cmp eax, 7
jne 0x4012ac
push 1
call esi
and eax, 0xff00
cmp eax, 0xd00
je 0x4012a7
cmp eax, 0x400
jne 0x4012ac
mov edi, 1
lea ecx, [esp + 0xc]
push ecx
push ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
je 0x4012ce
mov edx, dword [0x653f84]
push 0x653cb8
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x64f580
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6505e0
push 0x64f570
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
cld
add bh, bh
adc eax, sym.imp.MSVCRT.dll___set_app_type
pop ecx
or dword [0xa54204], 0xffffffff
or dword [0xa54208], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0xa54200]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0xa541fc]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0xa5420c], eax
call fcn.0064f6ff
cmp dword [0x6534a0], ebx
jne 0x64f603
push 0x64f6fc
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.0064f6ea
push 0x65300c
push 0x653008
call sub.MSVCRT.dll__initterm
mov eax, dword [0xa541f8]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x6c]
push eax
push dword [0xa541f4]
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x653004
push section..data
call sub.MSVCRT.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.MSVCRT.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x64f696
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, bl
je 0x64f66a
cmp al, 0x22
jne 0x64f65c
cmp byte [esi], 0x22
jne 0x64f673
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, bl
je 0x64f67d
cmp al, 0x20
jbe 0x64f66f
mov dword [ebp - 0x30], ebx
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x64f6a1
movzx eax, word [ebp - 0x2c]
jmp 0x64f6a4
cmp byte [esi], 0x20
jbe 0x64f673
inc esi
mov dword [ebp - 0x74], esi
jmp 0x64f696
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x78], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x4013c5
Capabilities:
Encode data using xor

Disassembly:
jmp 0x4159d0
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x415b7a
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x76
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x72
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
xor byte [esi + ebx], 0xe2
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x4d
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xfa
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
add esp, 0x44
push eax
call fcn.0040616d
add byte [esi + ebx], 0x32
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xb
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xd7
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xfa
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x58
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x17
add esp, 0x40
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x2f
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
xor byte [esi + ebx], 0x69
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xfa
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xd3
add esp, 0x30
inc esi
cmp esi, edi
jb 0x4159f0
pop ebx
pop edi
pop esi
ret

Function at 0x4035f3
Capabilities:
Terminate process

Disassembly:
jmp 0x453df9
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x453e0a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405948
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40371f
Capabilities:
Query environment variable

Disassembly:
jmp 0x49c842
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49c853
pop esi
ret
push ebx
push edi
push esi
call fcn.0049c729
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fe4
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49c87b
push ebx
push esi
push edi
call fcn.0040572c
add esp, 0xc
push 0
call fcn.004062b2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret