joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa6edf1
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 0xc]
mov ebx, dword [esp + 6]
lea ebx, reloc.RASAPI32.dll_RasGetConnectStatusA
jmp 0xa6ee28
lea ebp, [eax + ecx]
lea esp, [esp + 9]
bts si, cx
seto dl
push di
jmp 0xa6ee41
xchg byte [esp + 0xa], dl
mov si, bx
pop word [esp + 0x12]
bsr bx, bx
push word [esp + 0xe]
not edi
jmp 0xa6ee12
mov eax, 0x94607580
bt dx, si
mov ecx, esi
lea edx, [ebp - 0xdb]
mov bx, word [esp + 0x12]
dec ecx
jmp 0xa6eeed
mov ax, dx
lea eax, [ebx + esi]
xchg dh, bl
pop di
mov di, word [esp + 8]
mov word [esp + 0xa], cx
jmp 0xa6eebe
bsf cx, cx
std
mov bh, 0x2f
cld
pop bp
mov cl, dl
jmp 0xa6ee77
mov edx, esi
mov word [esp + 2], di
lea eax, [eax*4]
jmp 0xa6eed4
mov bx, dx
push word [esp + 0x11]
xchg ebp, esi
xchg dword [esp + 5], ebp
mov byte [esp + 3], cl
sub ebp, ebp
jmp 0xa6eea8
btc cx, bx
push dword [esp + 1]
mov eax, dword [esp + 0x10]
xchg esi, ebx
or al, 0x84
jmp 0xa6ef3c
push word [esp + 8]
cpuid
cpuid
xchg byte [esp + 7], al
mov bx, word [esp + 0x14]
lea ebx, reloc.RASAPI32.dll_RasGetConnectStatusA
jmp 0xa6ee9a
mov byte [esp + 5], ah
mov edx, 0x21ca2c0b
mov si, word [esp + 0xc]
jmp 0xa6efd2
mov bh, 0xe2
lea ecx, [eax*4]
pop dword [esp + 6]
sub esp, 0x13
mov al, byte [esp + 9]
pop ebx
jmp 0xa6ef07
btc si, bp
pop bx
mov dword [esp + 0x10], ebp
dec cl
xchg bl, cl
mov dl, byte [esp]
jmp 0xa6ef1d
setbe al
mov dword [esp + 0x14], ebp
cpuid
lea ecx, [ebx + edi]
mov edi, 0xf5da1753
mov cx, 0x5cb5
jmp 0xa6efa8
neg esi
btc dx, di
lea eax, [eax*4]
neg si
cpuid
mov di, 0x206d
jmp 0xa6ef4f
popal
or bl, bh
mov dh, 0x27
mov dx, word [esp]
mov ah, cl
rdtsc
jmp 0xa6efba
mov word [esp + 0xc], ax
mov cx, dx
rdtsc
mov cl, ch
shl ah, cl
push si
jmp 0xa6ef92
cpuid
clc
cld
bts si, sp
mov dh, byte [esp]
mov cx, word [esp]
jmp 0xa6efe8
or cx, sp
mov eax, ebp
pop word [esp + 9]
stc
lea esi, reloc.RASAPI32.dll_RasGetConnectStatusA
setge cl
jmp 0xa6ef7a
mov dx, 0x91f
mov ch, byte [esp]
xchg bp, di
mov bl, ch
xchg di, ax
call fcn.00a70bdc
invalid

Function at 0xa6f3f5
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
adc bl, ah
rol eax, cl
dec ch
call fcn.00a6f3ac
insb byte es:[edi], dx
jae 0xa6f3f4
jb 0xa6f3e5
insd dword es:[edi], dx
jo 0xa6f3c6
add byte [ebp + 0x8504], cl
add byte [eax], al
lea eax, [eax*4]
mov dx, word [esp + 7]
mov edi, ebp
xchg word [esp + 2], di
jmp 0xa6f370
popal
je 0xa6f43e
jae 0xa6f40c
add byte [esi - 0x75], ah
jl 0xa6f3f4
or al, ch
adc al, 0xff
invalid
pop edx
pop word [esp + 2]
pop word [esp + 4]
shr bx, cl
pushal
mov byte [esp + 6], dh
jmp 0xa6f40a
add byte [esi - 0x71], ah
inc esp
and al, 9
rcl ah, cl
xchg dword [esp + 1], edi
neg bp
mov eax, 0x49027538
jmp 0xa6f3d6
bswap ebp
mov ecx, 0x915344bb
cpuid
add esp, 0x14
cld
lea esi, reloc.RASAPI32.dll_RasGetConnectStatusA
jmp 0xa6f4b0
mov edi, dword [esp + 0xb]
mov bh, byte [esp + 7]
btr bx, sp
std
mov ah, 0xf6
jmp 0xa6f43e
not ecx
xchg word [esp + 0xb], di
cpuid
bswap edi
popal
pop bp
jmp 0xa6f454
mov dword [esp + 5], edi
lea edx, [esp + ecx]
setp bh
mov byte [esp], cl
add esp, 5
pushal
jmp 0xa6f46b
Function at 0xa6f70a
Capabilities:
Execute anti-debugging instructions

Disassembly:
cpuid
add ecx, 0x557df3ce
inc eax
cpuid
btr esi, eax
push ecx
jmp 0xa6f722
jmp 0xa6f6f4
mov bx, si
inc bp
rdtsc
bsr si, dx
xchg byte [esp + 0x15], al
jmp 0xa6f75d
xor bp, bx
pop word [esp + 6]
pop ax
rdtsc
mov edi, dword [esp + 0x17]
lea ebx, [esi + esi]
jmp 0xa6f70c

Function at 0xa701f1
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 8]
sub esp, 0x18
mov ch, byte [esp + 1]
cld
add esp, 0x1e
jmp 0xa6fb3c

Function at 0xa73eb1
Capabilities:
Access peb ldr_data
Execute anti-debugging instructions

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
mov dl, byte [esp + 1]
pop bx
xchg si, ax
xchg cx, dx
dec bh
jmp 0xa6e926
mov esi, ebp
xchg dword [esp + 0xc], ebp
btr bx, ax
pop ebx
xchg byte [esp + 0xd], cl
jmp 0xa6e8fd
mov dword [esp + 3], ebp
stc
pop dword [esp + 6]
bsr ecx, ebx
lea edi, [edx + esi]
pop dword [esp + 0xc]
jmp 0xa6e8d2
btc ebx, esp
mov si, ax
bswap ecx
lea ebx, [ecx + ecx]
stc
pushal
jmp 0xa6e910
not ah
lea esp, [esp + 0x10]
mov dh, byte [esp + 6]
pushal
lea esp, [esp + 0x44]
jmp 0xa6e94b
bsr ax, bx
bswap edi
cld
rdtsc
rol si, cl
pushal
jmp 0xa6e8e8
rdtsc
mov byte [esp + 0xd], bh
popal
neg di
btc ebx, esp
rdtsc
jmp 0xa6e958
rdtsc
bsr ebp, esi
setp dl
std
clc
pushal
jmp 0xa6e935
lea ebx, [edx*4]
neg bh
lea eax, [esi + ebp]
bsr ebp, eax
jmp 0xa6ea20
push word [esp + 3]
xchg al, dl
call fcn.00a6e985
ror dx, cl
xchg cx, dx
mov cx, 0xf960
setne dl
mov esi, ebp
jmp 0xa6e9f8
setne bh
sub esp, 6
xchg dx, cx
mov edx, 0xdab2ed5f
mov bx, 0x5dde
mov si, 0xb771
jmp 0xa6e9a7
neg edi
add esp, 7
sub esp, 0x13
mov ah, 5
lea edx, [ebp - 0xbb]
mov eax, dword [esp + 0xb]
jmp 0xa6ea51
bsf cx, di
mov edi, dword [esp]
mov al, bl
mov ah, ch
xchg dh, bl
std
jmp 0xa6e9e0
mov byte [esp + 4], dh
add edx, edx
push dword [esp + 0xf]
mov al, bh
call fcn.00a6ea61
ret 0xdf4f
xchg dword [esp], edx
xchg ebx, eax
inc bh
bswap edx
setbe ah
pop di
jmp 0xa6ea30
inc dword [eax + 0x96b00c]
pushfd
stc
clc
call 0xa6ead6
jmp 0xa6f03c
call 0xa6f041
jmp 0xa6f823
pop eax
sub eax, 0xa6f041
jmp 0xa6f8f0
popal
jmp 0xa6e892
cmp dword [eax + reloc.RASAPI32.dll_RasGetConnectStatusA], 0
je 0xa6ede3
lea esp, [esp + 8]
jmp 0xa6f88e
call 0xa73061
jmp 0xa73efc
pop word [esp]
lea esp, [esp + 1]
jmp 0xa73ed4
push eax
lea esp, [esp + 1]
mov dword [esp + 4], edi
lea esp, [esp + 4]
jmp 0xa73f34
pop eax
jmp 0xa73f1d
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0xa7305c
sub eax, 0x673061
jmp 0xa73f58
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0xa73f12
push eax
jmp 0xa6ee61
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x403e59
pop dword [ebp - 0x24]
mov eax, 0x403e59
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x1d143c1
sub dword [ebp - 0x34], 0xb37efe76
mov dword [ebp - 0x30], 0xc4f2b4bb
add dword [ebp - 0x30], 0x6d40978a
mov dword [ebp - 0x2c], 0x390c90aa
sub dword [ebp - 0x2c], 0xecc04c7c
mov dword [ebp - 0x28], 0xca7949d1
sub dword [ebp - 0x28], 0xca7949d1
lea eax, [ebp - 0x34]
push eax
mov eax, 0xe7df5384
sub eax, 0xe79ed2f8
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x710d6fbf
sub dword [ebp - 0x34], 0xfc9b0669
mov dword [ebp - 0x30], 0xaa343fc1
sub dword [ebp - 0x30], 0x68c7de4c
mov dword [ebp - 0x2c], 0xb587c3a5
add dword [ebp - 0x2c], 0xade7a8c7
mov dword [ebp - 0x28], 0x5446226c
add dword [ebp - 0x28], 0xabb9dd94
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x36909
push 0
call eax
mov ecx, 0x30ce414b
add ecx, 0xcf3205fa
xor ebx, ebx
add ebx, eax
mov esi, 0x924b9fc9
add esi, 0x6df57037
add esi, dword [ebp - 0x24]
mov edi, 0x3195c9f1
xor dword [ebp - 8], 0x241d0dad
mov edx, dword [esi]
sub dword [ebp - 0x20], 0x9148936b
xor edx, edi
xor dword [ebp - 4], 0x8cb0fb01
mov dword [ebx], edx
sub dword [ebp - 0x14], ecx
add ebx, 0x781115dd
sub ebx, 0x781115d9
add esi, 0xa93b72be
add esi, 0x56c48d46
loop 0x403f6d
add eax, 0x10fe7
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x40596d
pop dword [ebp - 0x40]
mov eax, 0x40596d
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x1d6b6aef
sub dword [ebp - 0x50], 0xcf1925a4
mov dword [ebp - 0x4c], 0xece1653a
add dword [ebp - 0x4c], 0x4551e70b
mov dword [ebp - 0x48], 0xd47a92a2
add dword [ebp - 0x48], 0x77d1b18c
mov dword [ebp - 0x44], 0xb56ee806
sub dword [ebp - 0x44], 0xb56ee806
lea eax, [ebp - 0x50]
push eax
mov eax, 0x72c04b09
sub eax, 0x727fdaa9
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x7710d5d6
sub dword [ebp - 0x50], 0x29e6c80
mov dword [ebp - 0x4c], 0x761b99b4
add dword [ebp - 0x4c], 0xcb50c7c1
mov dword [ebp - 0x48], 0xdb67ffdb
sub dword [ebp - 0x48], 0x77f8936f
mov dword [ebp - 0x44], 0x836c33c2
sub dword [ebp - 0x44], 0x836c33c2
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x193de245
sub eax, 0x18fd7145
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3b233
push 0
call eax
mov ecx, 0xb6a26107
sub ecx, 0xb6a20758
xor esi, esi
add esi, eax
mov edi, 0x410000
add edi, dword [ebp - 0x40]
mov edx, 0xe9a5373a
sub edx, 0xb4d3cd10
mov dword [ebp - 0x3c], 0xa11c53a4
mov ebx, dword [edi]
sub dword [ebp - 4], eax
xor ebx, edx
mov dword [ebp - 0x10], 0xc5a32c63
mov dword [esi], ebx
mov dword [ebp - 0x18], 0xf1f29a35
add esi, 0x51c7d068
add esi, 0xae382f9c
add edi, 0x12c42c98
sub edi, 0x12c42c94
loop 0x405a86
add eax, 0xe381872f
add eax, 0x1c7fd260
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x66f4d1e
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x46cb1e2e
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x44a7bc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x44a808
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x44a802
mov ecx, dword [0x48a868]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x44a7f6
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x44a7db
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0x44a804
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x44c593
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, 0xf8
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x78]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x1c]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
jmp 0x44c5ff
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp eax, dword [edx + 0x18]
jae 0x44c648
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.004639d0
add esp, 8
test eax, eax
jne 0x44c646
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov dx, word [ecx + eax*2]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x44c64a
jmp 0x44c5f6
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x453138
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2cc
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.0044e6ba
add esp, 4
and eax, 0xff
test eax, eax
je 0x4531c1
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0x2cc
push 0
lea eax, [ebp - 0x2cc]
push eax
call fcn.0045e0b0
add esp, 0xc
mov dword [ebp - 0x2cc], 0x10001
lea ecx, [ebp - 0x2cc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x4531bf
mov ecx, dword [ebp - 0x214]
cmp ecx, dword [ebp + 0xc]
jne 0x4531bf
jmp 0x4531c1
jmp 0x453141
mov esp, ebp
pop ebp
ret

Function at 0x453683
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
movsx eax, byte [0x48b4c8]
test eax, eax
jne 0x453697
call fcn.004535b4
xor ecx, ecx
mov cl, byte [0x48b4c5]
test ecx, ecx
jne 0x45371e
xor edx, edx
mov dl, byte [0x48b4c4]
test edx, edx
jne 0x45371e
cmp dword [0x48b6d0], 0
je 0x4536f9
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0x180
mov ecx, dword [0x48b6d0]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 4], eax
push 0
mov edx, dword [ebp - 4]
push edx
push 0x186
mov eax, dword [0x48b6d0]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x48b6d0]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x45371e
push 0x10001
push 0x48b4c8
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
jne 0x45371e
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret
Function at 0x45682a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x45683a
xor eax, eax
jmp 0x456a03
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x4569bb
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x488f0c]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x488f0c]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x488f0c]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x488f0c]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x488f0c]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x488f0c]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x488f0c]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x488f0c]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0x10]
sub ecx, 8
mov dword [ebp + 0x10], ecx
jmp 0x456843
cmp dword [ebp + 0x10], 0
je 0x4569fd
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx]
mov ecx, dword [ebp + 8]
xor ecx, eax
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
mov eax, dword [ecx*4 + 0x488f0c]
xor eax, edx
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
cmp dword [ebp + 0x10], 0
jne 0x4569c1
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x46037d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x486768
cmp edx, dword [eax]
je 0x46039f
add eax, 8
inc ecx
cmp eax, 0x4867f8
jl 0x460390
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x486768]
jne 0x4604cd
mov eax, dword [0x48b750]
cmp eax, 1
je 0x4604a7
test eax, eax
jne 0x4603d0
cmp dword [0x486224], 1
je 0x4604a7
cmp edx, 0xfc
je 0x4604cd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x460407
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0045e170
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0045e320
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x46044a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0045e320
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x48a324
push edi
call fcn.0045e530
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0045e170
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0045e180
lea eax, [ebp - 0xa0]
push 0x48a304
push eax
call fcn.0045e180
push dword [esi + 0x48676c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0045e180
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004629a8
add esp, 0x2c
pop edi
jmp 0x4604cd
lea eax, [ebp + 8]
lea esi, [esi + 0x48676c]
push 0
push eax
push dword [esi]
call fcn.0045e320
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x100293d
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x14
push 0x1006060
push 0x15
xor ebx, ebx
push eax
mov dword [0x1006090], eax
mov dword [ebp - 0x14], ebx
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x1001310
call fcn.01002bca
mov edi, dword [ebp + 0x10]
xor eax, eax
inc eax
cmp byte [edi], 0x2b
jne 0x1002980
mov dword [0x1005b10], eax
inc edi
cmp byte [edi], bl
mov esi, 0x1006020
jne 0x10029b8
push 0x10011ec
push esi
mov dword [ebp + 8], 0x10
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp + 8]
push eax
push 0x1006024
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
neg eax
sbb eax, eax
and eax, esi
mov dword [0x1006088], eax
jmp 0x10029d3
push 0x12
push esi
push 0xffffffffffffffff
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov word [0x1006042], bx
mov dword [0x1006088], esi
call fcn.010028ce
test eax, eax
je 0x10029e9
push dword [ebp + 0x14]
push edi
call fcn.01001c63
test eax, eax
jne 0x10029ed
xor eax, eax
jmp 0x1002a33
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x1002a23
lea eax, [ebp - 0x1c]
push eax
push dword [0x100608c]
push dword [0x1006098]
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x1002a23
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push ebx
push ebx
lea eax, [ebp - 0x1c]
push ebx
push eax
call esi
test eax, eax
jne 0x10029f5
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x1002bca
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1005040]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x3f
mov dword [ebp - 0x108], eax
pop ecx
xor eax, eax
mov dword [ebp - 0x104], 0x5c3a43
lea edi, [ebp - 0x100]
rep stosd dword es:[edi], eax
mov esi, 0x100
push esi
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x1001344
push esi
mov esi, 0x1005048
push esi
lea eax, [ebp - 0x104]
push eax
push 0x1001338
mov ebx, 0x10011f4
push ebx
call fcn.01002dfe
mov eax, esi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1002c3b
sub eax, edi
cmp eax, 0xf5
jae 0x1002c5e
dec esi
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x1002c4c
mov edi, esi
mov esi, 0x100132c
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x1001344
push 1
push 0x100131c
push ebx
call fcn.01002d1f
push 0x80
push dword [ebp - 0x108]
mov dword [0x1005b14], eax
push 0x1005148
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01002ab2
leave
ret 4