joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402030
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x41e014]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00404e70
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x210]
add esp, 0xc
sub edx, ecx
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x402064
push esi
lea esi, [ebp - 0x210]
lea ecx, [esi + 2]
nop
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x402080
sub esi, ecx
sar esi, 1
cmp esi, 0x103
jbe 0x4020b0
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403bfd
mov esp, ebp
pop ebp
ret
movzx eax, word [ebp + esi*2 - 0x212]
push ebx
mov ebx, 0x5c
cmp eax, ebx
je 0x4020d0
cmp eax, 0x2f
je 0x4020d0
mov word [ebp + esi*2 - 0x210], bx
inc esi
push edi
xor edi, edi
test esi, esi
je 0x402138
nop word [eax + eax]
movzx eax, word [ebp + edi*2 - 0x210]
cmp eax, 0x5c
je 0x4020f2
cmp eax, 0x2f
jne 0x402133
cmp edi, 0x105
jae 0x402161
xor eax, eax
push eax
mov word [ebp + edi*2 - 0x210], ax
lea eax, [ebp - 0x210]
push eax
call fcn.00408ba4
add esp, 8
test eax, eax
je 0x40212b
lea eax, [ebp - 0x210]
push eax
call fcn.00408b7a
add esp, 4
test eax, eax
jne 0x40214e
mov word [ebp + edi*2 - 0x210], bx
inc edi
cmp edi, esi
jb 0x4020e0
pop edi
pop ebx
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403bfd
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop ebx
xor ecx, ebp
pop esi
call fcn.00403bfd
mov esp, ebp
pop ebp
ret
call fcn.00403d5d
int3
Function at 0x402950
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x415c40
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x41e014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, eax
mov dword [ebp - 0x240], ecx
test ecx, ecx
je 0x4029bf
mov eax, dword [ebp - 0x234]
dec eax
mov dword [ebp - 0x234], eax
cmp eax, 1
jge 0x4029c6
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
jmp 0x402b30
lea eax, [ecx + 4]
xor edi, edi
mov dword [ebp - 0x238], eax
mov eax, dword [eax]
mov edx, eax
lea esi, [edx + 2]
nop dword [eax + eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x4029e0
sub edx, esi
sar edx, 1
je 0x402a12
lea edx, [ebp - 0x218]
sub edx, eax
nop dword [eax]
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [edx + eax - 2], cx
test cx, cx
jne 0x402a00
jmp 0x402a1b
xor eax, eax
mov word [ebp - 0x218], ax
xor eax, eax
mov dword [ebp - 0x230], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 7
lea edx, [ecx + 2]
mov word [ebp - 0x230], ax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402a50
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x230]
call fcn.00402c00
mov ecx, dword [ebp - 0x23c]
mov dword [ebp - 4], 0
mov eax, dword [ecx + 4]
cmp eax, dword [ecx + 8]
je 0x402ab2
movups xmm0, xmmword [ebp - 0x230]
mov edx, 7
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x220]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [ecx + 4], 0x18
mov word [ebp - 0x230], ax
jmp 0x402ac5
lea edx, [ebp - 0x230]
push edx
push eax
call fcn.004021e0
mov edx, dword [ebp - 0x21c]
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x402b02
mov ecx, dword [ebp - 0x230]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x402af8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402b4b
push edx
push ecx
call fcn.00403e68
add esp, 8
mov eax, dword [ebp - 0x238]
inc edi
add eax, 4
mov dword [ebp - 0x238], eax
cmp edi, dword [ebp - 0x234]
jl 0x4029d1
push dword [ebp - 0x240]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x234]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00403bfd
mov esp, ebp
pop ebp
ret
call fcn.00408e87
int3
Function at 0x40e760
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0040e420
Function at 0x44212d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x44215b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x442179
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00442097
jmp 0x442179
mov eax, dword [esi + 0x14]
test eax, eax
je 0x442179
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00442097
test edi, edi
mov eax, edi
jne 0x442163
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x56c32c]
test ecx, ecx
je 0x44222c
jmp 0x44212c
ret 8

Function at 0x430002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
jmp fcn.00401219

Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
push 0x3c
lea eax, [ebp - 0x3c]
push 0
push eax
call sub.MSVCR80.dll_memset
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x500
mov dword [ebp - 0x30], str.open
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
call dword [sym.imp.ole32.dll_OleUninitialize]
leave
ret 0x10
Function at 0x401ec0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x403228
push 0x4020c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
add esp, 4
mov dword [0x404164], 0xffffffff
mov dword [0x404168], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x404160]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov edx, dword [0x40415c]
mov dword [eax], edx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov ecx, dword [eax]
mov dword [0x40416c], ecx
call fcn.004020b0
mov eax, dword [0x40411c]
test eax, eax
jne 0x401f51
push 0x4020a0
call dword [sym.imp.MSVCRT.dll___setusermatherr]
add esp, 4
call fcn.00402080
push 0x40400c
push 0x404008
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [0x404158]
mov dword [ebp - 0x6c], edx
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [0x404154]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.MSVCRT.dll___getmainargs]
add esp, 0x14
push 0x404004
push section..data
call sub.MSVCRT.dll__initterm
add esp, 8
call dword [sym.imp.MSVCRT.dll___p__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x40205f
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x401fc5
cmp al, 0x22
jne 0x401fb7
cmp byte [esi], 0x22
jne 0x401fce
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x401fde
cmp al, 0x20
ja 0x401fde
inc esi
mov dword [ebp - 0x74], esi
jmp 0x401fce
mov dword [ebp - 0x30], 0
lea edx, [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x401fff
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x402004
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x402044
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x401fce
inc esi
mov dword [ebp - 0x74], esi
jmp 0x40205f

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x432001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43200c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..rsrc
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x4ae9572a
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f314
nop
mov ecx, 0x410d0179
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43101e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219

Function at 0x414de5
Capabilities:
Encode data using xor

Disassembly:
xor dword [ebx], eax
or ecx, esi
add ecx, esi
add ebx, 4
inc esi
sub edx, ecx
or edx, esi
cmp ebx, edi
jne fcn.00414de5
dec esi
ret
Function at 0x1004e9af
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x1004e9be
pop dword [ebp - 0x48]
mov eax, 0x1004e9be
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xdf911385
sub dword [ebp - 0x58], 0x913ece3a
mov dword [ebp - 0x54], 0xba5f8c6b
sub dword [ebp - 0x54], 0x882c4026
mov dword [ebp - 0x50], 0x9768fdf0
add dword [ebp - 0x50], 0xb4e3463e
mov dword [ebp - 0x4c], 0x359b7d95
add dword [ebp - 0x4c], 0xca64826b
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x1c499433
sub dword [ebp - 0x58], 0xa7d72add
mov dword [ebp - 0x54], 0x4b0d375d
add dword [ebp - 0x54], 0xf65f2a18
mov dword [ebp - 0x50], 0x5dba56bd
add dword [ebp - 0x50], 0x5b515af
mov dword [ebp - 0x4c], 0x27305e01
add dword [ebp - 0x4c], 0xd8cfa1ff
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x7bdd7ed8
sub eax, 0x6bd50eb4
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x40b47
push 0
call eax
mov ecx, 0x21b1d02
sub ecx, 0x21ac7a9
xor ebx, ebx
add ebx, eax
mov edi, 0x5c987892
sub edi, 0x4c8ce892
add edi, dword [ebp - 0x48]
mov edx, 0x41bbbdb0
add edx, 0x9c46e3da
sub dword [ebp - 0x3c], 0x2360ec22
mov esi, dword [edi]
xor dword [ebp - 0x20], ebx
add esi, edx
xor dword [ebp - 0x1c], 0x1cfeca3b
mov dword [ebx], esi
mov dword [ebp - 0x34], 0xa10ca5e
add ebx, 0xac8e3d53
sub ebx, 0xac8e3d4f
add edi, 0xa661a498
sub edi, 0xa661a494
loop 0x1004ead8
add eax, 0x14837
mov ebx, eax
add eax, 5
mov ecx, 0x7420dc4d
sub ecx, 0x6420dc4d
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x1005c80
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x10042c0]
mov edx, dword [0x10042c8]
mov ecx, dword [0x10042c4]
push ebx
push esi
mov dword [ebp - 0x28], eax
mov eax, dword [0x10042cc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x20], edx
mov edx, dword [0x10042d4]
mov dword [ebp - 0x24], ecx
mov ecx, dword [0x10042d0]
mov dword [ebp - 0x1c], eax
mov eax, edi
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], ecx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1005cc7
sub eax, edx
sar eax, 1
mov edx, eax
mov eax, dword [ebp + 0xc]
lea esi, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1005ce0
sub eax, esi
sar eax, 1
add eax, edx
lea eax, [eax + eax + 0x1a]
call fcn.010089f0
mov ebx, esp
push 0x40
lea eax, [ebp - 0x68]
push 0
push eax
mov dword [ebp - 0x6c], 0x44
call sub.msvcrt.dll_memset
push 0x10042ac
call dword [sym.imp.msvcrt.dll_puts]
lea eax, [ebp - 0x28]
mov edx, ebx
mov ecx, eax
add esp, 0x10
sub edx, ecx
jmp 0x1005d30
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x1005d30
mov eax, edi
mov edx, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1005d43
mov edi, ebx
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x1005d55
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x1005d76
mov edx, dword [0x10042a8]
mov eax, dword [ebp + 0xc]
mov dword [edi], edx
mov edx, eax
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1005d90
mov edi, ebx
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x1005da2
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x10]
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x6c]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1005dfa
push 0x100427c
call fcn.01005400
mov eax, 8
lea esp, [ebp - 0x78]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [ebp - 0x10]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x10]
push ecx
call esi
xor eax, eax
lea esp, [ebp - 0x78]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1008980
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
jne 0x10089bd
push 0x10
push 0x1005208
push 0x10051dc
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
push eax
push ecx
call fcn.01007420
add esp, 8
push eax
call dword [sym.imp.msvcrt.dll_exit]
int3

Function at 0x1009000
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x1009013
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x100900f
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x1009040
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x100907f
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x1009075
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x1009081
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x1009065
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x972058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x9721a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x97207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x97206a
add dl, dl
jne 0x972089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9720dc
xor eax, eax
add dl, dl
jne 0x972096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x97217d
add dl, dl
jne 0x9720a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9720b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9720bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9720c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9720d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x972075
mov eax, 1
add dl, dl
jne 0x9720ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9720f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9720e1
sub eax, ebx
mov ebx, 1
jne 0x972128
mov ecx, 1
add dl, dl
jne 0x97210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x972119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x972105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x972075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x97213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x97214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x972136
cmp eax, 0x7d00
jae 0x97216d
cmp eax, 0x500
jb 0x972168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x972075
cmp eax, 0x7f
ja 0x972170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x972075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x97219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x972075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10