joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45057c
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x45d40c], 0
jne 0x4505fd
cmp dword [0x45d428], 0
jne 0x4505ac
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x45d428], eax
test eax, eax
jne 0x4505ac
push str.GetEnvironmentStrings_failed
call fcn.0044ff54
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x45d428]
jmp 0x4505c0
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.00447ae8
pop ecx
mov edi, eax
test eax, eax
jne 0x4505b8
lea edi, [ebp + 1]
push edi
call fcn.004474dc
pop ecx
mov ebx, eax
mov dword [0x45d410], ebx
test ebx, ebx
jne 0x4505ea
xor eax, eax
jmp 0x4506c0
push edi
mov edx, dword [0x45d428]
push edx
push ebx
call fcn.00447944
add esp, 0xc
jmp 0x45061d
xor esi, esi
mov ebx, dword [0x45d40c]
jmp 0x450617
push eax
call fcn.00447ae8
pop ecx
test eax, eax
jne 0x450613
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x450607
lea ebx, [esi + 4]
push 4
mov dword [0x45d414], ebx
inc ebx
push ebx
call fcn.0044701c
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x450640
xor eax, eax
jmp 0x4506c0
cmp dword [0x45d40c], 0
jne 0x450671
xor esi, esi
mov ebx, dword [0x45d410]
mov eax, dword [esp]
mov ebp, eax
jmp 0x450662
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.00447ae8
pop ecx
mov edi, eax
test eax, eax
jne 0x450658
jmp 0x4506a2
xor esi, esi
mov ebx, dword [0x45d40c]
mov eax, dword [esp]
mov edi, eax
jmp 0x45069c
push eax
call fcn.00447ae8
pop ecx
test eax, eax
je 0x450691
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x450695
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x450680
mov eax, dword [0x45d40c]
test eax, eax
je 0x4506b2
push eax
call fcn.004474ec
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x45d40c], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x1002195
Capabilities:
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xf0
push 4
call fcn.010012b0
test eax, eax
pop ecx
je 0x10021b6
mov ecx, eax
call dword [sym.imp.ulib.dll_public:_void___thiscall_CLASS_DESCRIPTOR::constructor_void_]
jmp 0x10021b8
xor eax, eax
test eax, eax
mov dword [0x1004004], eax
je 0x10021c9
mov ecx, eax
call dword [sym.imp.ulib.dll_public:_unsigned_char___thiscall_CLASS_DESCRIPTOR::Initialize_void_]
lea ecx, [ebp - 0x78]
call fcn.010012ff
lea ecx, [ebp - 0x78]
call fcn.01001cd6
test al, al
je 0x10021ee
lea ecx, [ebp - 0x78]
call fcn.0100133e
test al, al
je 0x10021ee
push dword [ebp + 0x10]
jmp 0x10021f0
push 2
call dword [sym.imp.msvcrt.dll_exit]
int3
Function at 0x401000
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x60
push 0xb4e120
call fcn.0040121c
mov edi, 0x94
mov eax, edi
call fcn.004011dc
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0xb4e120], ecx
mov eax, dword [esi + 4]
mov dword [0xb4e124], eax
mov edx, dword [esi + 8]
mov dword [0xb4e128], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0xb4e12c], esi
cmp ecx, 2
je 0x401060
or esi, 0x8000
mov dword [0xb4e130], esi
shl eax, 8
add eax, edx
mov dword [0xb4e120], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x40109b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40109b
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x4010b3
cmp eax, 0x20b
je 0x4010a0
mov dword [ebp - 0x1c], esi
jmp 0x4010c7
cmp dword [ecx + 0x84], 0xe
jbe 0x40109b
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x4010c1
cmp dword [ecx + 0x74], 0xe
jbe 0x40109b
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call fcn.00401224
pop ecx
test eax, eax
jne 0x4010f3
cmp dword [0xb4e120], 1
jne 0x4010e0
call fcn.00401224
push 0x1c
call fcn.00401224
push 0xff
call fcn.00401224
pop ecx
pop ecx
call fcn.00401224
mov dword [ebp - 4], esi
call fcn.00401224
test eax, eax
jge 0x40110c
push 0x1b
call fcn.00401224
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0xb4e120], eax
call fcn.00401224
mov dword [0xb4e124], eax
call fcn.00401224
test eax, eax
jge 0x401132
push 8
call fcn.00401224
pop ecx
call fcn.00401224
test eax, eax
jge 0x401143
push 9
call fcn.00401224
pop ecx
push 1
call fcn.00401224
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x401159
push eax
call fcn.00401224
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00401224
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x40117a
movzx eax, word [ebp - 0x40]
jmp 0x40117d
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00401228
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x40119b
push edi
call fcn.00401220
call fcn.00401224
jmp 0x4011cd
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00401224
ret

Function at 0x401228
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push esi
push edi
push ebx
lea eax, [ebp - 4]
push eax
push 0x40
push 0x366000
push section..rdata
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x401252
push 0x7e93a0
jmp 0x40125e
pop ebx
pop edi
pop esi
leave
ret 0x14
ret
Function at 0x100011c0
Capabilities:
Create udp socket
Initialize winsock library
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a8
mov eax, dword [0x10057a08]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1a8], ecx
mov word [ebp - 0x19c], 0x202
lea eax, [ebp - 0x198]
push eax
mov cx, word [ebp - 0x19c]
push ecx
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0x10
push 0
mov edx, dword [ebp - 0x1a8]
add edx, 4
push edx
call fcn.100174d0
add esp, 0xc
mov eax, dword [ebp - 0x1a8]
mov word [eax + 4], 2
push 0
call dword [sym.imp.WS2_32.dll_htonl]
mov ecx, dword [ebp - 0x1a8]
mov dword [ecx + 8], eax
mov dx, word [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [ebp - 0x1a8]
mov word [ecx + 6], ax
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov edx, dword [ebp - 0x1a8]
mov dword [edx + 0x24], eax
push 0x10
mov eax, dword [ebp - 0x1a8]
add eax, 4
push eax
mov ecx, dword [ebp - 0x1a8]
mov edx, dword [ecx + 0x24]
push edx
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x1000127b
xor al, al
jmp 0x100012bd
mov dword [ebp - 0x1a4], 1
mov dword [ebp - 0x1a0], 0
push 8
lea eax, [ebp - 0x1a4]
push eax
push 0x1006
push 0xffff
mov ecx, dword [ebp - 0x1a8]
mov edx, dword [ecx + 0x24]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov eax, dword [ebp - 0x1a8]
mov byte [eax], 1
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100167d5
mov esp, ebp
pop ebp
ret 4

Function at 0x100012d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x10057a08]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0x414]
add ecx, 0x14
push ecx
push 0
push 0x400
lea edx, [ebp - 0x410]
push edx
mov eax, dword [ebp - 0x414]
mov ecx, dword [eax + 0x24]
push ecx
call dword [sym.imp.WS2_32.dll_recvfrom]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov byte [ebp + edx - 0x410], 0
mov ecx, 0x101
lea esi, [ebp - 0x410]
mov edi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.100167d5
mov esp, ebp
pop ebp
ret 4

Function at 0x10001360
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10057a08]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ecx
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.100174d0
add esp, 0xc
mov word [ebp - 0x14], 2
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x10], eax
mov dx, word [ebp + 0xc]
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
push 0x10
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x24]
push ecx
call dword [sym.imp.WS2_32.dll_sendto]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100167d5
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10002010
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
movzx ecx, word [edx + 0x14]
lea edx, [eax + ecx + 0x18]
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], 0
jmp 0x10002052
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x28
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
movzx ecx, word [eax + 6]
cmp dword [ebp - 4], ecx
jge 0x10002156
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x10], 0
jne 0x100020d3
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x38]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
jle 0x100020ce
push 4
push 0x1000
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
add ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100020a7
xor eax, eax
jmp 0x1000215b
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
add eax, dword [edx + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 0xc]
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
call fcn.10001e10
add esp, 0xc
jmp 0x10002040
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x14]
mov ecx, dword [ebp - 0x14]
add eax, dword [ecx + 0x10]
push eax
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp - 0x18]
call fcn.10001fe0
test eax, eax
jne 0x100020f4
xor eax, eax
jmp 0x1000215b
push 4
push 0x1000
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
add eax, dword [edx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1000211f
xor eax, eax
jmp 0x1000215b
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
add edx, dword [ecx + 0xc]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.10001e60
add esp, 0xc
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov dword [edx + 8], eax
jmp 0x10002040
mov eax, 1
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100088e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp + 8]
mov dword [0x10058ed0], ecx
mov edx, dword [ebp + 0xc]
mov dword [0x10058ed4], edx
mov eax, dword [ebp + 0x10]
mov dword [0x10058ed8], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 8], 0
call fcn.10008860
test eax, eax
jne 0x10008966
mov dword [0x10056f08], 0
mov dword [0x10056f0c], 0
mov dword [0x10056f10], 0
mov dword [0x10056f18], 0
mov dword [0x10056f14], 0
jmp 0x1000897a
push 0x10029b4c
call fcn.1001771b
add esp, 4
xor eax, eax
jmp 0x10008adc
mov dword [ebp - 0x24], 0x44368d
mov dword [ebp - 0x30], 0x3f8fc5
mov dword [ebp - 0x10], 0x3b272b
mov dword [ebp - 0x14], 0x2feb60
mov dword [ebp - 0x28], 0xdd3c
mov dword [ebp - 0x2c], 0x47c
mov dword [ebp - 0x20], 0x24e00
push 0x10029b30
call fcn.10006170
add esp, 4
mov dword [ebp - 0x18], eax
push 0x10029b1c
call fcn.10006170
add esp, 4
mov dword [ebp - 0x1c], eax
push 0x70e66e6b
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.10006d50
add esp, 8
mov dword [0x10058eb0], eax
push 0x579606ae
mov edx, dword [ebp - 0x18]
push edx
call fcn.10006d50
add esp, 8
mov dword [0x10058eb8], eax
cmp dword [0x10058eb8], 0
je 0x10008a36
push 0
push 0x10029b18
call fcn.10017716
add esp, 4
push eax
push str.8192
call fcn.10017716
add esp, 4
or eax, 0x1000
push eax
mov eax, dword [ebp - 0x20]
push eax
push 0
push 0xffffffffffffffff
call dword [0x10058eb8]
mov dword [ebp - 8], eax
jmp 0x10008a66
push 0x10029b18
call fcn.10017716
add esp, 4
push eax
push str.8192
call fcn.10017716
add esp, 4
or eax, 0x1000
push eax
mov ecx, dword [ebp - 0x20]
push ecx
push 0
call dword [0x10058eb0]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0x20]
push edx
push 0x10032098
mov eax, dword [ebp - 8]
push eax
call fcn.10016a10
add esp, 0xc
mov ecx, dword [0x10056f04]
push ecx
call fcn.1001703b
add esp, 4
mov dword [ebp - 0xc], eax
push 0x6c
push str.vzyxQQjtnPpM1kMtP2c_toAOgGzJnA_x4n_mZV_Zgqbqls_28Kb303hUncVaad__NA_W2eBhDNdm_Bl2cFznqhvrDpHPGj____pbLp
mov edx, dword [ebp - 0xc]
push edx
call fcn.10002fa0
add esp, 0xc
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.10004f00
add esp, 0xc
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov ecx, 0x10058ebc
call fcn.10002d20
mov dword [0x10058edc], eax
mov edx, dword [ebp - 0x24]
push edx
push 0
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000cd9b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, 0xffff0000
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
jne 0x1000cdbb
cmp dword [edi + 0x54], 0
jne 0x1000cdbb
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.1000d5ec
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [esp + 0x18]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.1000cd62
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
ret 8

Function at 0x100126f9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x1001273c
call fcn.1000d5ec
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x1001273c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x10012757
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.100122b0
test ebx, ebx
mov esi, eax
je 0x10012755
test edi, edi
je 0x10012755
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x100167d5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10057a08]
jne 0x100167df
repz ret
jmp fcn.1001c38c
Function at 0x10023a79
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.1001bd66
xor ebx, ebx
cmp dword [0x1005b760], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x10023b4e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x10023ab9
xor eax, eax
jmp 0x10023c12
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1002c5ac
push edi
call esi
cmp eax, ebx
je 0x10023ab2
push eax
call fcn.1001bd03
mov dword [esp], 0x1002c59c
push edi
mov dword [0x1005b760], eax
call esi
push eax
call fcn.1001bd03
mov dword [esp], 0x1002c588
push edi
mov dword [0x1005b764], eax
call esi
push eax
call fcn.1001bd03
mov dword [0x1005b768], eax
lea eax, [ebp - 8]
push eax
call fcn.10017e4f
test eax, eax
pop ecx
pop ecx
je 0x10023b1c
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1001c49a
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x10023b4e
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.1001bd03
cmp eax, ebx
pop ecx
mov dword [0x1005b770], eax
je 0x10023b4e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1001bd03
pop ecx
mov dword [0x1005b76c], eax
mov eax, dword [0x1005b76c]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x10023bc7
cmp dword [0x1005b770], esi
je 0x10023bc7
push eax
call fcn.1001bd6f
pop ecx
call eax
cmp eax, ebx
je 0x10023b94
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x1005b770]
call fcn.1001bd6f
pop ecx
call eax
test eax, eax
je 0x10023b94
test byte [ebp - 0x18], 1
jne 0x10023bc7
lea eax, [ebp - 0xc]
push eax
call fcn.10017e86
test eax, eax
pop ecx
je 0x10023baf
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1001c49a
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x10023bbe
or dword [ebp + 0x10], 0x200000
jmp 0x10023bf8
or dword [ebp + 0x10], 0x40000
jmp 0x10023bf8
mov eax, dword [0x1005b764]
cmp eax, esi
je 0x10023bf8
push eax
call fcn.1001bd6f
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x10023bf8
mov eax, dword [0x1005b768]
cmp eax, esi
je 0x10023bf8
push dword [ebp - 4]
push eax
call fcn.1001bd6f
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x1005b760]
call fcn.1001bd6f
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1004cad
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push edi
xor ebx, ebx
xor edi, edi
cmp dword [ebp + 8], ebx
jne 0x1004cc5
xor eax, eax
jmp 0x1004d45
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x1004d43
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0x7fff
jae 0x1004d39
push esi
call sub.cmutil.dll_CmMalloc
mov edi, eax
cmp edi, ebx
je 0x1004d39
push ebx
lea eax, [ebp - 4]
push eax
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1004d39
cmp byte [edi], bl
mov eax, edi
je 0x1004d39
mov cl, byte [eax]
cmp cl, 9
je 0x1004d37
cmp cl, 0xa
je 0x1004d37
cmp cl, 0xd
je 0x1004d37
inc eax
cmp byte [eax], bl
jne 0x1004d1f
jmp 0x1004d39
mov byte [eax], bl
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, edi
pop edi
pop ebx
leave
ret 4

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40701c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x407028
push 0x407024
push 0x407020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x407028]
push dword [0x407024]
push dword [0x407020]
mov dword [0x407014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x40129c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x84], 0
call fcn.004019f0
mov edi, eax
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov eax, edi
or al, 0x40
push eax
lea eax, [0x404731]
lea edx, [fcn.00401a74]
sub eax, edx
push eax
push fcn.00401a74
call sub.KERNEL32.dll_VirtualProtect
cmp dword [ebp - 4], 0
je 0x40132d
push edi
call fcn.004018e0
lea eax, [ebp - 0x84]
push eax
push edi
call fcn.0040192f
mov eax, edi
add eax, 0x1e200
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x84]
push eax
mov esi, dword [ebp - 0x88]
mov ecx, edi
sar esi, cl
push esi
lea esi, [0x4070e4]
mov ebx, edi
dec ebx
and esi, ebx
push esi
call fcn.00401a74
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4019f0
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push edi
and dword [ebp - 0x120], 0
xor edi, edi
push 0
push 0
call sub.USER32.DLL_GetWindowLongA
push 0
push 0
call sub.USER32.DLL_GetDlgItem
push 0
push 0
push 0
push 0
call sub.USER32.DLL_GetDlgItemInt
mov dword [ebp - 0x11c], 0x14
mov byte [ebp - 0x104], 0
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x118]
push eax
push 1
push 1
lea eax, [ebp - 0x104]
push eax
call sub.CRYPT32.DLL_CryptBinaryToStringW
movzx eax, word [ebp - 0x118]
mov edi, eax
sub edi, 0x41
mov eax, edi
pop edi
leave
ret
Function at 0x1003f5fc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100846e0]
jne 0x1003f606
repz ret
jmp fcn.1003f8ad

Function at 0x1003fe40
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [0x100846c4], 0
mov byte [0x100846c8], 0
mov esi, dword [0x100846bc]
add esi, 0x1248
mov dword [0x100846b8], esi
mov dword [0x100846c0], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov eax, dword [0x100846c0]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x100846b8], 0xa1e
mov eax, dword [0x100846c0]
add eax, 1
mov dword [0x100846c0], eax
cmp eax, 0x100
jl 0x1003fe88
mov eax, dword [0x100846bc]
add eax, 0x101c
mov dword [0x100846b8], eax
mov dword [0x100846c0], 0
mov eax, 0x100
mov dword [0x100846cc], 0
mov dword [0x100846b8], 0x1dfc
mov ecx, dword [0x100846c4]
mov edx, dword [0x100846c0]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + edx]
add edi, ecx
mov dword [ebp - 0x1c], eax
mov eax, edx
xor edx, edx
mov ecx, dword [ebp - 0x10]
div ecx
mov ebx, dword [ebp - 0x14]
movzx edx, byte [ebx + edx]
add edi, edx
mov dword [0x100846cc], edi
mov edx, dword [0x100846b8]
mov eax, edi
mov dword [ebp - 0x20], edx
cdq
mov edi, dword [ebp - 0x1c]
idiv edi
mov dword [0x100846c4], edx
mov edx, dword [ebp - 0x20]
add edx, 0x152a
mov dword [0x100846b8], edx
mov edx, dword [0x100846c0]
mov cl, byte [esi + edx]
mov byte [0x100846c8], cl
mov dword [0x100846b8], 0x118d
mov edx, dword [0x100846c4]
mov cl, byte [esi + edx]
mov edx, dword [0x100846c0]
mov byte [esi + edx], cl
mov cl, byte [0x100846c8]
mov edx, dword [0x100846c4]
mov byte [esi + edx], cl
mov dword [0x100846b8], 0x24c0
mov edx, dword [0x100846c0]
add edx, 1
mov dword [0x100846c0], edx
cmp edx, 0x100
jl 0x1003fed0
mov dword [0x100846b8], 0x23eb
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret