joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002d220
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1003b040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x1002d250
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002db20
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x1002d28c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x1002d28c
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002db20
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x1002d363
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x1002d2b4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1002d2c0
movsx eax, bl
jmp 0x1002d2f8
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x1002d322
sub eax, 1
je 0x1002d322
sub eax, 2
jne 0x1002d363
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002db20
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1002d340
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1002d363
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002db20
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002db20
mov esp, ebp
pop ebp
ret 4
Function at 0x1002d580
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1003b040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1002d63c
cmp byte [esi + 0x3d], 0
je 0x1002d63c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1002d62a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1002d5f1
sub eax, 1
je 0x1002d5f5
sub eax, 2
jne 0x1002d62a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002db20
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1002d613
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1002d62a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002db20
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002db20
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.1002db20
mov esp, ebp
pop ebp
ret
Function at 0x403d60
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
test ecx, ecx
jne 0x403d82
push edx
push str._s__none__s
push dword [0x4ebe14]
call fcn.00401240
add esp, 0x10
pop esi
pop ebp
ret
test ecx, 0x80000
mov esi, 0x4df5a4
mov eax, str._utf
cmove eax, esi
test ecx, 0x800000
push eax
mov eax, str._use_offset_limit
cmove eax, esi
test ecx, 0x40000
push eax
mov eax, str._ungreedy
cmove eax, esi
test ecx, 0x20000
push eax
mov eax, str._ucp
cmove eax, esi
test ecx, 0x10000
push eax
mov eax, str._no_start_optimize
cmove eax, esi
test ecx, 0x40000000
push eax
mov eax, str._no_utf_check
cmove eax, esi
test ecx, 0x8000
push eax
mov eax, str._no_dotstar_anchor
cmove eax, esi
test ecx, 0x4000
push eax
mov eax, str._no_auto_possess
cmove eax, esi
test ecx, 0x2000
push eax
mov eax, str._no_auto_capture
cmove eax, esi
test ecx, 0x1000
push eax
mov eax, str._never_utf
cmove eax, esi
test ecx, 0x800
push eax
mov eax, str._never_ucp
cmove eax, esi
test ecx, 0x100000
push eax
mov eax, str._never_backslash_c
cmove eax, esi
test ecx, 0x400
push eax
mov eax, str._multiline
cmove eax, esi
test ecx, 0x200
push eax
mov eax, str._match_unset_backref
cmove eax, esi
test ecx, 0x4000000
push eax
mov eax, str._match_invalid_utf
cmove eax, esi
test ecx, 0x2000000
push eax
mov eax, str._literal
cmove eax, esi
test ecx, 0x100
push eax
mov eax, str._firstline
cmove eax, esi
test ecx, 0x1000000
push eax
mov eax, str._extended_more
cmove eax, esi
test cl, 0x80
push eax
mov eax, str._extended
cmove eax, esi
test ecx, 0x20000000
push eax
mov eax, str._endanchored
cmove eax, esi
push eax
test cl, 0x40
mov eax, str._dupnames
cmove eax, esi
test cl, 0x20
push eax
mov eax, str._dotall
cmove eax, esi
test cl, 0x10
push eax
mov eax, str._dollar_endonly
cmove eax, esi
test cl, 8
push eax
mov eax, str._caseless
cmove eax, esi
test cl, 4
push eax
mov eax, str._auto_callout
cmove eax, esi
test ecx, ecx
push eax
mov eax, str._anchored
cmovns eax, esi
test cl, 1
push eax
mov eax, str._allow_empty_class
cmove eax, esi
test ecx, 0x400000
push eax
mov eax, str._alt_verbnames
cmove eax, esi
test ecx, 0x200000
push eax
mov eax, str._alt_circumflex
cmove eax, esi
test cl, 2
push eax
mov eax, str._alt_bsux
cmove eax, esi
push eax
push edx
push str._s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s
push dword [0x4ebe14]
call fcn.00401240
add esp, 0x88
pop esi
pop ebp
ret
Function at 0x41d3d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push ebx
mov edi, ecx
call fcn.00418ad0
mov esi, dword [edi + 0xf0]
test esi, esi
je 0x41d543
cmp dword [edi + 0xe8], 0
je 0x41d543
mov eax, dword [ebp + 8]
mov ecx, dword [esi + eax*4]
mov esi, dword [esi + eax*4 + 4]
sub esi, ecx
mov dword [ebp + 0xc], ecx
cmp esi, 0x4000
jae 0x41d543
lea eax, [esi - 1]
push eax
push ebx
call fcn.00418a90
test eax, eax
jne 0x41d545
mov eax, dword [edi + 0xe8]
xor edi, edi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebx + 8]
lea ecx, [eax + ecx*2]
test esi, esi
je 0x41d543
cmp esi, 0x10
jb 0x41d515
lea eax, [ecx - 2]
lea eax, [eax + esi*2]
lea ebx, [edx - 2]
lea ebx, [ebx + esi*2]
cmp edx, eax
ja 0x41d463
cmp ebx, ecx
jae 0x41d515
movaps xmm5, xmmword [str._________]
mov eax, esi
movaps xmm6, xmmword [0x4e27c0]
and eax, 0xfffffff0
movaps xmm4, xmmword [0x4b37d0]
movaps xmm7, xmmword [0x4b37e0]
movups xmm0, xmmword [ecx]
add edi, 0x10
movaps xmm3, xmm5
pcmpeqw xmm3, xmm0
movaps xmm2, xmm3
pandn xmm2, xmm0
movaps xmm0, xmm3
pand xmm0, xmm4
pxor xmm3, xmm6
por xmm2, xmm0
movaps xmm1, xmm2
pcmpeqw xmm1, xmm4
pand xmm1, xmm3
movaps xmm3, xmm5
movaps xmm0, xmm1
pand xmm1, xmm7
pandn xmm0, xmm2
por xmm0, xmm1
movups xmmword [edx], xmm0
movups xmm0, xmmword [ecx + 0x10]
add ecx, 0x20
pcmpeqw xmm3, xmm0
movaps xmm2, xmm3
pandn xmm2, xmm0
movaps xmm0, xmm3
pand xmm0, xmm4
pxor xmm3, xmm6
por xmm2, xmm0
movaps xmm1, xmm2
pcmpeqw xmm1, xmm4
pand xmm1, xmm3
movaps xmm0, xmm1
pand xmm1, xmm7
pandn xmm0, xmm2
por xmm0, xmm1
movups xmmword [edx + 0x10], xmm0
add edx, 0x20
cmp edi, eax
jb 0x41d484
cmp edi, esi
jae 0x41d543
sub esi, edi
mov edi, 0xf05c
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
cmp eax, 0x2f
jne 0x41d532
mov eax, 0x5c
jmp 0x41d538
cmp eax, 0x5c
cmove eax, edi
mov word [edx], ax
add edx, 2
sub esi, 1
jne 0x41d520
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x48b06c
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4d7eb4
push 0x4d7eac
push str.FlsAlloc
push 0x1e
call fcn.0048aef6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x48b0a0
push dword [ebp + 8]
mov ecx, esi
call dword [0x4b32b0]
call esi
jmp 0x48b0a6
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x48b0ea
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4d7ec4
push 0x4d7ebc
push str.FlsGetValue
push 0x20
call fcn.0048aef6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x48b121
push dword [ebp + 8]
mov ecx, esi
call dword [0x4b32b0]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x4b1940
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x4e7544]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
mov dword [ebp - 0x84], 0x420041
xor edx, edx
mov dword [ebp - 0x80], 0x440043
mov dword [ebp - 0x7c], 0x460045
mov dword [ebp - 0x78], 0x480047
mov dword [ebp - 0x74], 0x4a0049
mov dword [ebp - 0x70], 0x4c004b
mov dword [ebp - 0x6c], 0x4e004d
mov dword [ebp - 0x68], 0x50004f
mov dword [ebp - 0x64], 0x520051
mov dword [ebp - 0x60], 0x540053
mov dword [ebp - 0x5c], 0x560055
mov dword [ebp - 0x58], 0x580057
mov dword [ebp - 0x54], 0x5a0059
mov dword [ebp - 0x50], 0x620061
mov dword [ebp - 0x4c], 0x640063
mov dword [ebp - 0x48], 0x660065
mov dword [ebp - 0x44], 0x680067
mov dword [ebp - 0x40], 0x6a0069
mov dword [ebp - 0x3c], 0x6c006b
mov dword [ebp - 0x38], 0x6e006d
mov dword [ebp - 0x34], 0x70006f
mov dword [ebp - 0x30], 0x720071
mov dword [ebp - 0x2c], 0x740073
mov dword [ebp - 0x28], 0x760075
mov dword [ebp - 0x24], 0x780077
mov dword [ebp - 0x20], 0x7a0079
mov dword [ebp - 0x1c], 0x310030
mov dword [ebp - 0x18], 0x330032
mov dword [ebp - 0x14], 0x350034
mov dword [ebp - 0x10], 0x370036
mov dword [ebp - 0xc], 0x390038
mov dword [ebp - 8], 0x2f002b
test esi, esi
jle 0x4b1a7f
nop word [eax + eax]
movzx ecx, word [edi + edx*2]
xor eax, eax
cmp word [ebp + eax*2 - 0x84], cx
je 0x4b1a7a
inc eax
cmp eax, 0x40
jb 0x4b1a56
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047be9b
mov esp, ebp
pop ebp
ret 4
inc edx
cmp edx, esi
jl 0x4b1a50
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.0047be9b
mov esp, ebp
pop ebp
ret 4
Function at 0x4b1e20
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4e7544]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0x208
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0047d540
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4b1f07
push ebx
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4b1ebf
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4b1ebf
mov ecx, dword [edi]
jmp 0x4b1ed1
mov eax, dword [ebp - 0x210]
xor ecx, ecx
add ecx, ebx
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
push ecx
mov dword [ebp - 0x218], 0
call fcn.0047c0d3
mov ecx, dword [ebp - 0x214]
add esp, 4
push 0
mov dword [ecx], eax
lea ecx, [ebp - 0x218]
push ecx
push dword [edi]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0047be9b
mov esp, ebp
pop ebp
ret 8
Function at 0x433006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..reloc
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x16b10201
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..text
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x3813422b
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x401037
Capabilities:
Delete file
Extract resource via kernel32 functions
Get common file path

Disassembly:
call 0x401037
push 0
call sub.kernel32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffbf4
push esi
push edi
push ebx
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x403030], eax
mov dword [ebp - 8], 0
push 0xa
push section..data
push 0
call sub.kernel32.dll_FindResourceA
or eax, eax
je 0x401089
mov dword [ebp - 4], eax
push dword [ebp - 4]
push 0
call sub.kernel32.dll_SizeofResource
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
push 0
call sub.kernel32.dll_LoadResource
or eax, eax
je 0x401089
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4010c1
push 4
push 0x1000
push dword [ebp - 0xc]
push 0
call sub.kernel32.dll_VirtualAlloc
mov edi, eax
push dword [ebp - 0xc]
push dword [ebp - 8]
push edi
call sub.kernel32.dll_RtlMoveMemory
mov dword [ebp - 8], edi
push 0xdeadbeef
push dword [ebp - 0xc]
push dword [ebp - 8]
call section..text
cmp dword [ebp - 8], 0
je 0x4010fb
lea eax, [ebp - 0x40c]
push eax
push 0x400
call sub.kernel32.dll_GetTempPathA
push str.dup2patcher.dll
lea eax, [ebp - 0x40c]
push eax
call sub.kernel32.dll_lstrcatA
push dword [ebp - 0xc]
push dword [ebp - 8]
lea eax, [ebp - 0x40c]
push eax
call fcn.00401184
lea eax, [ebp - 0x40c]
push eax
call sub.kernel32.dll_LoadLibraryA
or eax, eax
je 0x401130
mov ebx, eax
push str.load_patcher
push ebx
call sub.kernel32.dll_GetProcAddress
or eax, eax
je 0x40111e
call eax
push ebx
call sub.kernel32.dll_FreeLibrary
lea eax, [ebp - 0x40c]
push eax
call sub.kernel32.dll_DeleteFileA
pop ebx
pop edi
pop esi
leave
ret

Function at 0x401184
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x4011af
xor eax, eax
leave
ret 0xc
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
push dword [ebp - 4]
call sub.kernel32.dll_FlushFileBuffers
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 8]
leave
ret 0xc
Function at 0x407180
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4071be
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4071b6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4071c0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4071a6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4072a0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4072b6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x4072d1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x100032ba
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
push 0x40
push 0x3000
push dword [ebp + 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.KERNEL32.dll_VirtualAllocExNuma
push dword [ebp + 0xc]
mov ecx, dword [0x1004d070]
mov esi, eax
push dword [ebp + 8]
xor eax, eax
test esi, esi
push esi
cmovne ecx, eax
mov dword [0x1004d070], ecx
call fcn.100053f0
add esp, 0xc
mov eax, esi
pop esi
pop ebp
ret

Function at 0x10003508
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 0xc], 0
cmp dword [ebp + 0xc], 0
push ebx
push edi
mov edi, dword [ebp + 0x10]
mov bh, byte [edi]
mov al, byte [edi + 1]
jle 0x100035d3
mov edi, dword [ebp - 0xc]
push esi
push 0x76
movzx eax, al
pop esi
movzx ecx, bh
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], esi
xor edx, edx
lea eax, [ecx + 1]
div esi
mov ecx, dword [0x1004daf8]
mov bh, dl
xor edx, edx
movzx eax, bh
mov dword [ebp - 0xc], eax
lea esi, [eax + ecx]
movzx eax, byte [esi]
add eax, dword [ebp - 8]
div dword [ebp - 0x10]
mov al, dl
mov byte [ebp - 1], al
movzx eax, al
mov dword [ebp - 8], eax
add eax, ecx
push eax
push esi
call fcn.100035dc
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
pop ecx
pop ecx
mov ecx, dword [0x1004daf8]
push 0x76
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
movzx eax, byte [eax + ecx]
movzx ecx, byte [edx + ecx]
xor edx, edx
add eax, ecx
pop ecx
div ecx
push 0
push 0
mov bl, dl
call esi
push 0
push 0
call esi
mov eax, dword [0x1004daf8]
mov esi, edi
sub esi, dword [0x1004d070]
movzx ecx, bl
push 0x76
mov al, byte [ecx + eax]
mov ecx, dword [ebp + 8]
xor byte [esi + ecx], al
inc edi
mov ecx, dword [ebp - 0xc]
pop esi
cmp edi, dword [ebp + 0xc]
jl 0x10003539
mov edi, dword [ebp + 0x10]
mov al, byte [ebp - 1]
pop esi
mov byte [edi], bh
mov byte [edi + 1], al
pop edi
pop ebx
leave
ret
Function at 0x1002a3fd
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10029dbb

Function at 0x1003c7b9
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1003c68d
Function at 0x10003190
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
mov eax, dword [0x10049398]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [str..wad]
mov dword [0x1004aea8], eax
mov ax, word [0x1003e168]
push 0x80
mov word [0x1004aeac], ax
lea eax, [ebp - 0x84]
push eax
push 0x66
push dword [0x10702288]
call dword [sym.imp.USER32.dll_LoadStringA]
mov cl, byte [ebp + eax - 0x85]
xor eax, eax
cmp byte [ebp - 0x84], al
je 0x1000320b
cmp byte [ebp + eax - 0x84], cl
jne 0x10003200
cmp eax, 0x80
jae 0x1000336c
mov byte [ebp + eax - 0x84], 0
inc eax
cmp byte [ebp + eax - 0x84], 0
jne 0x100031e4
push 0x58
lea eax, [ebp - 0xe0]
push 0
push eax
call fcn.1000fed0
mov eax, dword [0x1004aa44]
mov dword [ebp - 0xdc], eax
lea eax, [ebp - 0x84]
add esp, 0xc
mov dword [ebp - 0xd4], eax
lea eax, [ebp - 0xe0]
push eax
mov dword [ebp - 0xe0], 0x58
mov dword [ebp - 0xc8], 1
mov dword [ebp - 0xc4], 0x1004aea8
mov dword [ebp - 0xc0], 0x80
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb4], str.DOOM
mov dword [ebp - 0xac], 2
mov dword [ebp - 0xb0], str.New_WAD_File
mov dword [ebp - 0xa4], 0x1003e184
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameA]
test eax, eax
je 0x1000335e
mov ecx, dword [ebp - 0xc4]
mov edx, 0x10702310
sub edx, ecx
jmp 0x100032c0
mov al, byte [ecx]
mov byte [edx + ecx], al
lea ecx, [ecx + 1]
test al, al
jne 0x100032c0
push esi
push edi
push 0
push 0x80000020
push 1
push 0
push 1
push 0x40000000
push 0x10702310
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0
mov edi, eax
push 0
push edi
mov dword [ebp - 0x88], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push 0x1004aa54
push 4
push str.PWAD
push edi
call esi
push 0
push 0x1004aa54
push 4
lea eax, [ebp - 0x88]
push eax
push edi
call esi
push 0
push 0x1004aa54
push 4
lea eax, [ebp - 0x88]
push eax
push edi
mov dword [ebp - 0x88], 0xc
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov dword [0x1004aa70], 0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f362
mov esp, ebp
pop ebp
ret
call fcn.1000e5f4
int3