joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001c2f1
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1001c26d
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x1001c469
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x1001c469
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x1001c418
jg 0x1001c34a
test eax, eax
je 0x1001c40e
push 1
push 0x1000
call fcn.100157e7
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x1001c370
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x1001c405
push 0x8000
push ebx
call fcn.1001c19e
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x1001c39c
jg 0x1001c397
cmp ecx, 0x1000
jb 0x1001c39c
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.1001941f
add esp, 0x10
cmp eax, 0xffffffff
je 0x1001c3e1
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x1001c397
jl 0x1001c3c8
test ecx, ecx
jne 0x1001c389
push dword [ebp - 0xc]
push ebx
call fcn.1001c19e
push esi
call fcn.100129bb
add esp, 0xc
xor edi, edi
jmp 0x1001c47a
cmp byte [edi + 0x24], 0
je 0x1001c3f8
cmp dword [edi + 0x20], 5
jne 0x1001c3f8
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x1001c403
mov edi, dword [edi + 0x18]
jmp 0x1001c405
xor edi, edi
push esi
call fcn.100129bb
pop ecx
jmp 0x1001c47a
test ecx, ecx
jg 0x1001c3da
jl 0x1001c418
test eax, eax
jae 0x1001c3da
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1001cec8
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x1001c43b
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x1001c3da
jmp 0x1001c472
push ebx
call fcn.100189a9
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1001c3da
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x1001c47a
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x1001c477
mov edi, dword [edi + 0x18]
jmp 0x1001c47a
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.1001cec8
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1001c494
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x1002a1d0]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1001c4d4
cmp byte [ebx], 0xa
jne 0x1001c4d4
or byte [eax + edi + 0x28], 4
jmp 0x1001c4d9
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x1001c5d7
mov al, byte [edx]
cmp al, 0x1a
je 0x1001c5b9
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x1001c508
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x1001c52d
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x1001c537
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x1001c4ea
jmp 0x1001c5d7
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1001c5b4
cmp dword [ebp - 0xc], 0
je 0x1001c5b4
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x1002a1d0]
test byte [eax + edi + 0x28], 0x48
je 0x1001c58e
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x1001c579
mov byte [esi], dl
jmp 0x1001c58a
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x1002a1d0]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x1001c5d7
cmp byte [ebp - 1], 0xa
jne 0x1001c59d
cmp esi, ebx
jne 0x1001c59d
mov byte [esi], 0xa
jmp 0x1001c5d6
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.1001cec8
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x1001c5d7
mov byte [esi], 0xd
jmp 0x1001c5d6
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x1002a1d0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1001c5d3
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x1001c5d7
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1001c5e0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x1002a1d0]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1001c623
cmp word [esi], dx
jne 0x1001c623
or byte [edi + eax + 0x28], 4
jmp 0x1001c628
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x1001c761
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x1001c741
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x1001c66a
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x1001c6a0
cmp eax, edx
jae 0x1001c6ac
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x1001c642
jmp 0x1001c761
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1001c73d
cmp dword [ebp - 0x14], 0
je 0x1001c73d
mov eax, dword [ebx*4 + 0x1002a1d0]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x1001c715
mov cx, word [ebp - 4]
pop eax
cmp cx, ax
je 0x1001c75b
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x1002a1d0]
push 0xa
mov byte [edi + eax + 0x2a], cl
mov eax, dword [ebx*4 + 0x1002a1d0]
shr cx, 8
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x1002a1d0]
pop ecx
mov byte [edi + eax + 0x2c], cl
jmp 0x1001c75e
pop ebx
cmp word [ebp - 4], bx
jne 0x1001c726
cmp esi, dword [ebp + 0xc]
jne 0x1001c726
mov word [esi], bx
jmp 0x1001c75e
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.1001cec8
add esp, 0x10
cmp word [ebp - 4], bx
je 0x1001c761
push 0xd
jmp 0x1001c75a
mov ecx, dword [ebx*4 + 0x1002a1d0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1001c758
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x1001c761
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1001fac0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001faed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001faed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x409978
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409a4b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409a64
push ebx
push 0x409a70
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00403388
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402750
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004033e8
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x4099f8
mov al, 0x69
call fcn.0040961c
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040994c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a01
call fcn.0040994c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a52
lea eax, [ebp - 4]
call fcn.0040316c
ret

Function at 0x409b04
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409bb8
jmp 0x409bad
cmp dword [esi + 0x10], 0x1000
jne 0x409b99
test byte [esi + 0x15], 1
jne 0x409b99
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409b58
cmp eax, 2
je 0x409b58
cmp eax, 0x10
je 0x409b58
cmp eax, 0x20
jne 0x409b6d
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409b6d
mov bl, 1
xor ebp, ebp
jmp 0x409b7e
mov eax, dword [esi]
add eax, ebp
call fcn.00409afc
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409b71
test bl, bl
je 0x409b99
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409bb8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409b30
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x1ff02d8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1ff02e2
pushal
call 0x1ff02e8
pop ebp
sub ebp, 0x10
sub ebp, 0x1bf02d8
jmp 0x1ff02fe
mov eax, 0x1bf02d8
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c7
mov edx, 0x74be4fcc
xor byte [eax], dl
inc eax
dec ecx
jne 0x1ff0315
jmp 0x1ff0328
inc edi
add dword [edi + 0x45], eax
invalid
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x408b8e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x408b9d
pop dword [ebp - 0x28]
mov eax, 0x9b8097a5
add eax, 0x64bff3f8
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x39dfc
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x4aac
mov edi, eax
mov edx, 0x55e4c656
sub edx, 0x55a38a92
add edx, dword [ebp - 0x28]
mov esi, 0x8b6d7cbe
sub esi, 0x81291159
add dword [ebp - 8], 0x1a0361f5
mov ebx, dword [edx]
add dword [ebp - 4], 0xae5dc046
xor ebx, esi
mov dword [edi], ebx
sub dword [ebp - 0x1c], ebx
add edi, 0x3edd8009
sub edi, 0x3edd8005
add edx, 0x87b667cd
sub edx, 0x87b667c9
loop 0x408bf1
add eax, 0x91a497b2
add eax, 0x6e5c85d1
xor ebx, ebx
add ebx, eax
add eax, 0x453d99ef
sub eax, 0x453d99ea
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x421ae0
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004219f4

Function at 0x423ffa
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00423b1e

Function at 0x42f524
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042f11a

Function at 0x42f52f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042f2a4
Function at 0x29807350
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x29877b48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x29807376
xor eax, eax
jmp 0x29807433
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x29807398
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, dword [eax]
cmp dword [eax], edx
jae 0x29807398
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
mov byte [eax], bl
mov eax, ebx
jmp 0x29807433
cmp dword [esi + 0x4c], 0
je 0x29807431
call fcn.29806b4d
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x298073c2
push dword [esi + 0x4c]
push eax
call fcn.29813b70
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x29807431
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x298073ff
sub eax, 1
je 0x298073ff
dec eax
sub eax, 1
jne 0x29807431
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x298073b4
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x30], eax
je 0x29807423
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0x30], eax
jne 0x29807431
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x34], eax
mov eax, ebx
jne 0x29807433
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.29801ca0
leave
ret 4
Function at 0x29827184
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x29855122
call fcn.298516be
mov edx, dword [ebp + 0xc]
xor ebx, ebx
mov eax, dword [ebp + 8]
mov esi, ebx
mov dword [ebp - 0x42c], edx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test eax, eax
je 0x298273a5
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc eax
push 2
push eax
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x420]
push eax
call fcn.29813b70
add esp, 0x10
test eax, eax
js 0x2982739f
mov edi, dword [ebp - 0x420]
cmp edi, 0x400
jg 0x29827228
push edi
call fcn.298281ed
pop ecx
test al, al
je 0x29827228
mov eax, edi
call fcn.29851dd0
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x2982723a
push edi
lea ecx, [ebp - 0x424]
call fcn.29813b70
mov esi, dword [ebp - 0x424]
push 3
push edi
push dword [ebp - 0x41c]
push eax
call fcn.29813b70
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x2982739f
push 0x60
push ebx
push eax
call fcn.29828560
mov edi, eax
mov dword [ebp - 0x420], edi
test edi, edi
jne 0x29827292
push 2
push ebx
push dword [ebp - 0x41c]
call fcn.29828560
mov edi, eax
mov dword [ebp - 0x420], eax
test edi, edi
jne 0x29827292
call fcn.29825408
mov ebx, eax
jmp 0x2982736e
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov dword [ebp - 0x42c], eax
test eax, eax
jne 0x298272b9
call fcn.29825408
jmp 0x29827361
push eax
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x298272af
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x41c], eax
lea ecx, [eax + 1]
cmp ecx, eax
jae 0x298272ec
mov ebx, 0x8007000e
jmp 0x29827363
push ecx
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.29813b70
jmp 0x29827312
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x298272e5
mov eax, dword [ebp - 0x41c]
push eax
push dword [ebp - 0x428]
push eax
push dword [ebp - 0x418]
call fcn.29813b70
mov eax, dword [ebp - 0x418]
add esp, 0x10
mov ecx, dword [ebp - 0x41c]
push dword [ebp + 0x14]
mov byte [eax + ecx], bl
lea ecx, [ebp - 0x434]
push dword [ebp - 0x418]
call fcn.29813b70
mov ebx, eax
test edi, edi
je 0x2982736e
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x29827387
lea ecx, [ebp - 0x418]
call fcn.29825fb4
or dword [ebp - 4], 0xffffffff
jmp 0x29827397
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x2982738d
mov eax, ebx
jmp 0x298273d3
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x298273ba
lea ecx, [ebp - 0x418]
call fcn.29825fb4
or dword [ebp - 4], 0xffffffff
jmp 0x298273ca
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x298273c0
mov eax, 0x8007000e
lea esp, [ebp - 0x444]
call fcn.29851676
ret 0x10
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x424004]
jne 0x40100a
repz ret
jmp fcn.00401506

Function at 0x406493
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x424004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403a87
and dword [ebp - 0x14], 0
cmp dword [0x426da4], 0
mov dword [ebp - 0x18], eax
jne 0x406546
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4065ee
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4065ee
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x426da4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x426da8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x426dac], eax
call edi
push eax
call esi
mov dword [0x426db4], eax
test eax, eax
je 0x406546
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x426db0], eax
mov eax, dword [0x426db0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40659f
cmp dword [0x426db4], ecx
je 0x40659f
push eax
call esi
push dword [0x426db4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40659f
test ebx, ebx
je 0x40659f
call edi
test eax, eax
je 0x406596
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x406596
test byte [ebp - 8], 1
jne 0x40659f
or dword [ebp + 0x10], 0x200000
jmp 0x4065d2
mov eax, dword [0x426da8]
cmp eax, dword [ebp - 0x18]
je 0x4065d2
push eax
call esi
test eax, eax
je 0x4065d2
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4065d2
mov eax, dword [0x426dac]
cmp eax, dword [ebp - 0x18]
je 0x4065d2
push eax
call esi
test eax, eax
je 0x4065d2
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x426da4]
call esi
test eax, eax
je 0x4065ee
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4065f0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret

Function at 0x420900
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x425200]
sub esp, 0x10
push ebx
mov ebx, dword [0x1ef8f50]
push edi
mov edi, dword [0x1ef922c]
push eax
call fcn.00420810
add esp, 4
cmp dword [0x1ef922c], 0x2f
jne 0x42095d
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
call fcn.00420860
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x420be0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x424004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push edi
xor edi, edi
cmp dword [0x1ef922c], 0x8cf
jne 0x420c16
push 0
push 0
call ebx
cmp edi, 0x845013
jne 0x420c2d
mov eax, dword [0x426020]
add eax, 0xa231
mov dword [0x1ef922c], eax
cmp dword [0x1ef922c], 0x141
jne 0x420c5b
push str.leponalesiteciheyekuyoligekogize_jaxazewazuhijut_pubajotoboniwemepolegoh_kilovamihapefibomaciri_lujijosegohuwudejagilemiba
lea ecx, [ebp - 0x804]
push ecx
call esi
mov dword [0x4272c8], 0xec58acac
mov dword [0x4272cc], 0xffffffff
inc edi
cmp edi, 0xbbe2a98
jl 0x420c04
call fcn.00420970
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00401000
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10001c00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ebp, 0xfffffccd
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.10001333
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.100012e8
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
invalid
test dword [ecx], ebx
cld
invalid
invalid

Function at 0x10003270
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea eax, [ebp - 0x7dc]
push eax
call fcn.10001333
pop ecx
push eax
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.10001294
add esp, 0xc
jmp 0x1000329b