joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5597f1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
mov eax, dword [ebp + 8]
mov ecx, dword [0x5a7c54]
add ecx, 0xffffea48
mov dword [0x5a7c58], ecx
mov dword [ebp - 0x10], eax
call fcn.0055ac5a
mov ecx, eax
mov dword [0x5a7c54], 0x249c
mov edx, dword [eax + 0x3c]
mov dword [0x5a7c58], 0x19ce
mov dword [0x5a7c54], 0xfffff674
mov eax, dword [eax + edx + 0x78]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
xor eax, eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
add ecx, dword [ecx + edx + 0x20]
mov dword [0x5a7c54], 0xffffecdd
mov esi, dword [ebp - 0x14]
mov edi, dword [esi + edx + 0x24]
mov dword [0x5a7c58], 0x23a3
mov ebx, dword [esi + edx + 0x18]
cmp ebx, 0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], eax
je 0x559982
jmp 0x5598bb
mov eax, dword [ebp - 0x2c]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
add edx, dword [edx + esi + 0x1c]
mov dword [0x5a7c58], 0x17f3
mov edi, dword [ebp - 0x14]
add edi, dword [edx + ecx*4]
mov dword [0x5a7c54], 0x16e6
mov dword [ebp - 0x28], edi
jmp 0x559982
xor eax, eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
add ecx, edx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
xor edx, edx
mov esi, dword [ebp - 0x20]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
mov ecx, eax
mov edx, dword [ebp - 0x3c]
add ecx, edx
mov esi, dword [ebp - 0x14]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x45], bh
mov byte [ebp - 0x46], cl
je 0x559943
mov eax, dword [ebp - 0x44]
add eax, 1
mov cl, byte [ebp - 0x45]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x46]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x4d], ch
mov al, byte [ebp - 0x4d]
test al, 1
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x40], ecx
jne 0x5598e5
jmp 0x559943
mov al, byte [ebp - 0x46]
test al, 1
jne 0x559889
jmp 0x559950
xor eax, eax
mov dword [0x5a7c58], 0xffffe6b4
mov ecx, dword [ebp - 0x2c]
add ecx, 2
mov edx, dword [ebp - 0x38]
add edx, 1
mov esi, dword [ebp - 0x1c]
cmp edx, esi
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x28], eax
jb 0x5598cb
mov eax, dword [ebp - 0x28]
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x55998d
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov eax, dword [0x5a7c54]
add eax, 0xfffff45e
mov dword [0x5a7c58], eax
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov dword [0x5a7c54], 0xeb8
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x5a7c58], 0x240e
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x559a3f
mov eax, dword [ebp - 0x14]
mov dword [0x5a7c54], 0x2db
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x18], eax
je 0x559a71
jmp 0x559ae8
mov dword [0x5a7c54], 0xa99
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff9
shl eax, 1
mov ecx, dword [ebp - 0xc]
add ecx, eax
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cmp word [eax], 0x6c
jne 0x559ae8
mov eax, 1
mov dword [0x5a7c54], 0x834
mov dword [ebp - 0x20], eax
jmp 0x559af7
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], edx
je 0x5599dc
mov eax, dword [ebp - 0x24]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], eax
jl 0x559a3f
jmp 0x5599dc
mov dword [0x5a7c54], 0xffffdf97
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x559ae8
mov dword [0x5a7c54], 0xc2b
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff5
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2], 0x61
jne 0x559ae8
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x559ae8
mov dword [0x5a7c54], 0xffffec1d
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x559ae8
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x5599fd
xor eax, eax
mov dword [0x5a7c58], 0x237b
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
add esp, 0x28
pop ebp
ret
Function at 0x559caf
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, 0xffffffff
mov dword [0x5a7c54], 0x42d
cmp ecx, 0
sete bl
cmp eax, 0
sete bh
and bl, bh
test bl, 1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
jne 0x559ea0
mov dword [0x5a7c58], 0xf8f
mov dword [0x5a7c54], 0x139d
mov ecx, dword fs:[0x18]
mov dword [0x5a7c54], 0x1ee6
mov dword [0x5a7c58], 0x1798
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x30]
mov ecx, dword [ecx + 0xc]
add ecx, 0x14
mov dword [0x5a7c54], 0x20bd
mov edx, dword [ebp - 0x10]
cmp edx, 0
setne bl
mov esi, ecx
mov dword [ebp - 0x20], ecx
mov byte [ebp - 0x21], bl
mov dword [ebp - 0x28], esi
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [eax]
mov edx, dword [ebp - 0x20]
cmp eax, edx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], ecx
je 0x559ea0
mov eax, dword [ebp - 0x2c]
mov cx, word [eax + 0x24]
mov dword [0x5a7c58], 0x62f
mov edx, dword [eax + 0x28]
mov dword [0x5a7c54], 0x1544
mov esi, dword [eax + 0x10]
mov edi, dword [ebp - 0x10]
cmp esi, edi
sete bl
mov bh, byte [ebp - 0x21]
and bh, bl
test bh, 1
mov word [ebp - 0x2e], cx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], esi
jne 0x559dab
jmp 0x559dbb
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff8
mov dword [ebp - 0x18], eax
jmp 0x559ea0
mov dword [0x5a7c54], 0x151b
xor eax, eax
mov cx, word [ebp - 0x2e]
shr cx, 1
movzx edx, cx
cmp cx, 0
mov esi, dword [ebp - 0x2c]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x40], eax
je 0x559d54
mov eax, dword [ebp - 0x40]
mov ecx, 0x1749
mov edx, dword [ebp - 0x34]
mov si, word [edx + eax*2]
mov di, si
add di, 0xffbf
mov bx, si
add bx, 0x20
cmp di, 0x1a
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov word [ebp - 0x4a], si
mov word [ebp - 0x4c], bx
jb 0x559e25
mov ax, word [ebp - 0x4a]
mov word [ebp - 0x4c], ax
mov ax, word [ebp - 0x4c]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x44]
cmp word [ecx + edx*2], ax
sete bl
cmp ax, 0
sete bh
mov al, bl
xor al, 1
or bh, al
test bh, 1
mov esi, dword [ebp - 0x48]
mov byte [ebp - 0x4d], bl
mov dword [ebp - 0x54], esi
jne 0x559e75
mov eax, dword [ebp - 0x44]
add eax, 1
mov dword [ebp - 0x58], eax
mov eax, 0x1a2c
mov ecx, dword [ebp - 0x58]
mov edx, dword [ebp - 0x3c]
cmp ecx, edx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x54], eax
jb 0x559de9
mov eax, dword [ebp - 0x54]
mov dword [0x5a7c58], 0xd66
mov dword [0x5a7c54], eax
mov cl, byte [ebp - 0x4d]
test cl, 1
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], edx
jne 0x559ea0
jmp 0x559d54
mov eax, dword [ebp - 0x18]
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x559fcc
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [0x5a7c60], 0
mov byte [0x5a7c64], 0
mov esi, dword [0x5a7c54]
add esi, 0xffffe890
mov dword [0x5a7c58], esi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
xor eax, eax
mov dword [0x5a7c5c], 0
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [0x5a7c54], 0x842
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x5a7c58], 0xfb4
mov eax, dword [0x5a7c5c]
add eax, 1
mov dword [0x5a7c5c], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x55a019
mov eax, 0x41d
xor ecx, ecx
mov dword [0x5a7c54], 0x41d
mov dword [0x5a7c5c], 0
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov edx, 0x100
add ecx, 0x260d
mov dword [0x5a7c68], 0
mov dword [ebp - 0x28], eax
xor esi, esi
mov dword [ebp - 0x2c], edx
mov edx, esi
mov esi, dword [ebp - 0x10]
div esi
mov edi, dword [0x5a7c60]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x28]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x5a7c68], esi
mov dword [0x5a7c58], ecx
mov eax, esi
cdq
mov ecx, dword [ebp - 0x2c]
idiv ecx
mov dword [0x5a7c60], edx
mov dword [0x5a7c54], 0xffffe2de
mov esi, dword [ebp - 0x28]
mov cl, byte [ebx + esi]
mov byte [0x5a7c64], cl
mov dword [0x5a7c58], 0x1ec0
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov dword [0x5a7c54], 0x210a
mov cl, byte [0x5a7c64]
mov edx, dword [0x5a7c60]
mov byte [ebx + edx], cl
mov edx, dword [0x5a7c5c]
add edx, 1
mov dword [0x5a7c5c], edx
cmp edx, 0x100
mov dword [ebp - 0x30], edx
jge 0x55a142
mov eax, dword [0x5a7c54]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
jmp 0x55a074
mov dword [0x5a7c54], 0xf79
mov dword [0x5a7c58], 0xcbe
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x55a2b9
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [0x5a7c58], 0xcb1
mov dword [0x5a7c54], 0x2d58
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x55a2e6
mov eax, dword [ebp - 0x2c]
mov cl, byte [eax + 0x55c1b4]
mov dl, byte [eax + 0x55c185]
sub dl, cl
mov byte [ebp + eax - 0x20], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x2c], eax
jne 0x55a2e6
lea eax, [ebp - 0x20]
mov dword [0x5a7c54], 0x2381
mov dword [0x5a7c58], 0xf0d
mov dword [ebp - 0x30], eax
call fcn.0055a465
mov dword [esp], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
call fcn.0055a54e
xor ecx, ecx
mov dword [0x5a7c54], 0xe97
cmp eax, 0
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
je 0x55a42b
mov eax, dword [ebp - 0x34]
mov ecx, dword [0x5a7c58]
mov edx, ecx
add edx, 0x6ec
mov dword [0x5a7c54], edx
add ecx, 0xffffe1e6
mov dword [0x5a7c58], ecx
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov ecx, dword [0x5a7c54]
add ecx, 0xea9
mov dword [0x5a7c54], ecx
mov dword [esp], eax
mov ecx, dword [ebp - 0x24]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.00559eab
xor eax, eax
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x28]
mov dword [edx + 0x20], ecx
mov dword [0x5a7c58], 0x1a18
mov ecx, dword [ebp - 0x3c]
mov dword [edx + 0x48], ecx
mov dword [0x5a7c54], 0x1388
cmp ecx, 0
mov dword [ebp - 0x38], eax
je 0x55a42b
mov eax, dword [ebp - 0x3c]
add eax, 0x2770
mov dword [0x5a7c54], 0x1dc3
mov dword [0x5a7c58], 0x12c2
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
add esp, 0x4c
pop ebp
ret
Function at 0x55addf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x5a7c5c], 0
mov dword [0x5a7c60], 0
mov dword [0x5a7c6c], 0
mov dword [0x5a7c54], 0x1df9
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
jne 0x55ae50
mov dword [0x5a7c58], 0x13f8
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov dword [0x5a7c58], 0x535
add ecx, 1
mov dword [ebp - 0x2c], eax
mov eax, ecx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x5a7c5c], edx
mov dword [0x5a7c54], 0x914
mov ecx, dword [ebp - 0x20]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x30]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x5a7c60], edx
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x5a7c64], cl
mov dword [0x5a7c58], 0x4f8
mov edi, dword [ebp - 0x20]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x5a7c64]
mov edx, dword [0x5a7c60]
mov byte [edi + edx], cl
mov dword [0x5a7c54], 0x1cff
mov edx, dword [0x5a7c5c]
movzx edx, byte [edi + edx]
mov ebx, dword [0x5a7c60]
movzx ebx, byte [edi + ebx]
add ebx, edx
mov dword [0x5a7c58], 0x2373
and ebx, 0xff
mov dword [0x5a7c6c], ebx
mov dword [0x5a7c54], 0xf7d
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x2c]
mov ch, byte [edx + ebx]
mov byte [0x5a7c71], ch
mov byte [0x5a7c72], cl
xor ch, cl
mov byte [0x5a7c70], ch
mov dword [0x5a7c54], 0x2532
mov edx, dword [ebp - 0x1c]
mov byte [edx + ebx], ch
mov edx, dword [0x5a7c54]
add edx, 0xfffffdd7
mov dword [0x5a7c58], edx
add ebx, 1
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x38], ebx
je 0x55ae3e
mov eax, dword [0x5a7c5c]
mov ecx, dword [0x5a7c60]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], edx
jmp 0x55ae50
Function at 0x55af83
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa0
mov eax, dword [0x5a7c58]
add eax, 0xfffff879
mov dword [0x5a7c58], eax
call fcn.0040107a
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x2c], ecx
jne 0x55b122
lea eax, [esp + 0x30]
lea ecx, [esp + 0x40]
mov dword [0x5a7c58], 0xf2f
mov dword [0x5a7c54], 0xf1d
mov dword [esp], eax
mov dword [esp + 0x28], ecx
call fcn.0055a737
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ecx
lea eax, [0x55a268]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x68], 0x138e00
mov edx, dword [0x5a7c40]
mov dword [esp + 0x74], edx
mov edx, dword [0x5a7c44]
mov dword [esp + 0x90], edx
mov edx, dword [0x5a7c48]
mov dword [esp + 0x64], edx
mov edx, dword [0x5a7c4c]
mov dword [esp + 0x54], edx
mov edx, dword [0x5a7c50]
mov dword [esp + 0x8c], edx
mov dword [0x5a7c58], 0xe69
mov dword [0x5a7c54], 0xfffff84c
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0x18], eax
jne 0x55b071
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x14], ecx
je 0x55b08d
mov eax, dword [esp + 0x18]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
jmp 0x55b04e
mov eax, dword [esp + 0x18]
mov dword [esp + 0x9c], eax
mov dword [0x5a7c58], 0x19ce
mov ecx, dword [esp + 0x14]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x78], edx
mov dword [0x5a7c54], 0xffffd23b
call fcn.0055998d
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0xc], ecx
jne 0x55b11a
lea eax, [esp + 0x40]
mov ecx, dword [0x5a7c58]
add ecx, 0xffffe6db
mov dword [0x5a7c54], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.0055a2b9
mov dword [0x5a7c58], 0x1db8
mov ecx, esp
lea edx, [esp + 0x40]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [0x5a7c54], 0x11f7
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov esp, ebp
pop ebp
ret
Function at 0x2206698
Capabilities:
Encode data using xor

Disassembly:
jmp 0x22066a2
pushal
call 0x22066a8
pop ebp
sub ebp, 0x10
sub ebp, 0x1e06698
jmp 0x22066be
and bh, byte [eax + 0x1e06698]
mov eax, 0x1e06698
add eax, ebp
add eax, 0x4c
mov ecx, 0x608
mov edx, 0x4bafd120
xor byte [eax], dl
inc eax
dec ecx
jne 0x22066d5
jmp 0x22066e8
stosd dword es:[edi], eax
in eax, dx
stosd dword es:[edi], eax
test eax, 0x2020201c
mov eax, dword [0x2020d8e1]
and byte [ebx], ah
in eax, dx
cwde
and al, 0x20
and byte [eax], ah
lcall 0xc2d7, 0x20202008
and ebp, eax
stosd dword es:[edi], eax
mov eax, dword [0x2020202c]
and esp, ebp
jo 0x22066bd
inc esp
add al, 0xdc
test eax, 0x10480424
xchg esp, eax
and byte cs:[eax + 0x46], cl
xchg edx, eax
int1
and dword [ecx], esp
or al, 4
and dword [esp + eax], ecx
dec eax
jne 0x2206720
or dh, byte [esi - 0x38]
and eax, 0xc9202020
adc al, 0x20
and byte [eax], ah
lodsd eax, dword [esi]
inc esp
add al, 0xdc
test eax, 0x7d74040c
stosd dword es:[edi], eax
movsd dword es:[edi], dword [esi]
sub byte [eax], ah
and byte [eax], ah
stosd dword es:[edi], eax
mov ch, 0x2c
and byte [eax], ah
and byte [ebx + 0x202030ad], ch
and cl, ah
leave
and dl, byte [ecx]
and ah, byte [ebx + 0x2f6924e2]
movsd dword es:[edi], dword [esi]
aam 0xdf
invalid
Function at 0x401d10
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x403a28
call fcn.00402460
push 1
call fcn.00401f06
pop ecx
test al, al
je 0x401cf8
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.00401ed4
mov byte [ebp - 0x24], al
mov eax, dword [0x4053dc]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x401cf8
test eax, eax
jne 0x401c1c
mov dword [0x4053dc], ecx
push 0x403158
push 0x40314c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x401bff
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x401ce8
push 0x403148
push 0x403140
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x4053dc], 2
jmp 0x401c21
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0040205d
pop ecx
call fcn.004021f0
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x401c52
push esi
call fcn.00401fc9
pop ecx
test al, al
je 0x401c52
mov esi, dword [esi]
push edi
push 2
push edi
mov ecx, esi
call dword [0x40313c]
call esi
call fcn.004021f6
mov esi, eax
cmp dword [esi], edi
je 0x401c70
push esi
call fcn.00401fc9
pop ecx
test al, al
je 0x401c70
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
call fcn.00402316
movzx esi, ax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_narrow_winmain_command_line
push esi
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.0040234c
test al, al
je 0x401cff
test bl, bl
jne 0x401c9e
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.0040207a
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x401ce8
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
push 7
call fcn.004021fc
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
push dword [ebp - 0x20]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__exit
int3
call fcn.00574000
jmp 0x401b92
Function at 0x401080
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
lea eax, [ebp - 0x88]
sub esp, 0x9c
mov dword [esp + 4], eax
mov dword [esp], str.browseui.dll
call dword [0x4061dc]
sub esp, 8
test eax, eax
jne 0x4010c2
mov dword [esp], str.Native_IE_detected__not_doing_registration_n
call sym._wine_dbg_printf.constprop.0
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword fs:[0x18]
mov edi, eax
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x8c], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
lea edi, [ebp - 0x80]
mov dword [esp + 4], 0
mov dword [esp], str.browseui.dll
call dword [0x4061e0]
lea eax, [ebp - 0x7c]
sub esp, 0x10
mov dword [esp + 0xc], edi
mov dword [esp + 4], str.VarFileInfoTranslation
mov dword [esp + 8], eax
mov eax, dword [0x4061e4]
mov dword [esp], esi
mov dword [ebp - 0x90], eax
call eax
sub esp, 0x10
test eax, eax
mov edx, dword [ebp - 0x8c]
jne 0x401170
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x4010ac
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x94], edx
movzx ecx, word [eax + 2]
mov dword [esp + 0xc], ecx
movzx eax, word [eax]
lea ecx, [ebp - 0x78]
mov dword [esp + 4], str.StringFileInfo_04x_04xFileDescription
mov dword [esp], ecx
mov dword [ebp - 0x8c], ecx
mov dword [esp + 8], eax
call dword [0x4061d0]
mov ecx, dword [ebp - 0x8c]
lea eax, [ebp - 0x84]
mov dword [esp + 0xc], edi
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
call dword [ebp - 0x90]
sub esp, 0x10
test eax, eax
mov edx, dword [ebp - 0x94]
je 0x401144
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x8c], edx
mov dword [esp + 4], 0x4030e6
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcsstr]
mov edx, dword [ebp - 0x8c]
mov dword [esp + 8], esi
mov edi, eax
mov dword [esp + 4], 0
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
test edi, edi
je 0x4010ac
test ebx, ebx
mov edx, str.UnregisterIE
mov eax, str.RegisterIE
cmove eax, edx
mov dword [esp + 8], 0
mov dword [esp], 0
mov dword [esp + 4], eax
call sym._RegInstallA_12
sub esp, 0xc
lea esp, [ebp - 0xc]
shr eax, 0x1f
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4013b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_strlen]
mov esi, eax
xor eax, eax
test esi, esi
je 0x40140b
cmp byte [ebx + esi - 1], 0xa
je 0x4013df
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x405084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret