joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004f9f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x1000985d
call fcn.10008a15
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x418], ebx
push 0x60
push ebx
push esi
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x1000501c
push 2
push ebx
push esi
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x1000501c
call fcn.10003697
mov esi, eax
jmp 0x1000512c
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x1000503f
call fcn.10003697
jmp 0x1000511f
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x10005035
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x420], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x10005072
mov esi, 0x8007000e
jmp 0x10005121
push 2
push eax
lea eax, [ebp - 0x41c]
mov byte [ebp - 4], 2
push eax
call fcn.10008d2b
test eax, eax
js 0x1000515a
cmp dword [ebp - 0x41c], 0x400
jbe 0x100050c2
push dword [ebp - 0x41c]
lea ecx, [ebp - 0x418]
call fcn.10008d2b
jmp 0x100050ce
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
je 0x10005068
push esi
push dword [ebp - 0x418]
push esi
push dword [ebp - 0x428]
push ebx
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x10005035
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x434]
push dword [ebp - 0x418]
call fcn.10008d2b
mov esi, eax
test edi, edi
je 0x1000512c
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10005145
lea ecx, [ebp - 0x418]
call fcn.1000365f
lea ecx, [ebp - 0x42c]
call fcn.10003d3f
mov eax, esi
call fcn.10008966
ret 0x10
push eax
call fcn.10008d2b
int3
Function at 0x10008d2b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x10008d3a
pop dword [ebp - 0x18]
mov eax, 0x10008d3a
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xb9b8fd3c
add dword [ebp - 0x28], 0x9499480f
mov dword [ebp - 0x24], 0x14a538fb
sub dword [ebp - 0x24], 0xe271ecb6
mov dword [ebp - 0x20], 0xc89f848c
sub dword [ebp - 0x20], 0x7c53405e
mov dword [ebp - 0x1c], 0xbae3e1f9
sub dword [ebp - 0x1c], 0xbae3e1f9
lea eax, [ebp - 0x28]
push eax
mov eax, 0x71abf432
add eax, 0x9e54ac86
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xcb0a15ec
sub dword [ebp - 0x28], 0x5697ac96
mov dword [ebp - 0x24], 0x77e3165b
add dword [ebp - 0x24], 0xc9894b1a
mov dword [ebp - 0x20], 0x653ce953
sub dword [ebp - 0x20], 0x1cd7ce7
mov dword [ebp - 0x1c], 0x67d9f5a3
sub dword [ebp - 0x1c], 0x67d9f5a3
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x7b7003f
add eax, 0x849a031
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x38842
push 0
call eax
mov ecx, 0x86a04249
add ecx, 0x796007f9
mov edi, eax
mov edx, 0x3191dea4
add edx, 0xde6f535c
add edx, dword [ebp - 0x18]
mov esi, 0x5d4edb65
sub esi, 0xa68d40ec
xor dword [ebp - 0x14], 0xf4bd9181
mov ebx, dword [edx]
mov dword [ebp - 8], 0xd5fef850
xor ebx, esi
xor dword [ebp - 4], edi
mov dword [edi], ebx
sub dword [ebp - 0xc], 0xabebd823
add edi, 4
add edx, 4
loop 0x10008e57
add eax, 0xc96b5166
sub eax, 0xc96a358b
mov ebx, eax
add eax, 0x85431ba4
sub eax, 0x85431b9f
mov ecx, 0x7d55bb21
sub ecx, 0x6d55bb21
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x401980
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x4019bf
mov eax, dword [ebx + 0x18]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
mov eax, dword [ebx + 0x14]
mov dword [ebx + 0x18], 0
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [ebx + 0x14], 0
sub esp, 4
movzx eax, word [esi]
and eax, 0xffffffdf
cmp ax, 0x48
je 0x4019e0
mov dword [ebx + 0x34], 2
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0x5c
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_wcschr]
mov dword [esp], esi
mov edi, eax
test eax, eax
je 0x401a20
call sym._path_get_rootkey
test eax, eax
je 0x4019cb
cmp word [edi + 2], 0
je 0x4019cb
add edi, 2
mov dword [esp], eax
mov dword [esp + 4], edi
call dword [sym.imp.advapi32.dll_RegDeleteTreeW]
sub esp, 8
jmp 0x4019cb
call sym._path_get_rootkey
jmp 0x4019cb

Function at 0x401a30
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lea ebx, [eax + 2]
movzx eax, word [eax + 2]
cmp ax, 9
je 0x401a58
cmp ax, 0x20
jne 0x401a6b
lea esi, [esi]
movzx eax, word [ebx + 2]
add ebx, 2
cmp ax, 0x20
je 0x401a58
cmp ax, 9
je 0x401a58
test ax, ax
je 0x401a90
cmp ax, 0x3b
je 0x401a90
mov dword [esi + 0x34], 2
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
mov eax, dword [esi + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [esi + 0x14]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegDeleteValueW]
mov dword [esi + 0x34], 2
mov eax, ebx
sub esp, 8
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x402e40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x402e9b
cmp byte [esi + ebx - 1], 0xa
je 0x402e6f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4081a8], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x402f00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x4080ec]
mov dword [esp], eax
mov eax, dword [sym.imp.ucrtbase.dll_free]
mov dword [ebp - 0x1c], eax
call eax
mov edx, dword [ebp + 8]
test edx, edx
je 0x403078
mov eax, dword [0x4081b8]
test eax, eax
je 0x403048
mov esi, dword [0x408188]
test esi, esi
je 0x403078
mov dword [esp + 4], 0x409234
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strpbrk]
test eax, eax
jne 0x403088
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov edi, dword [0x408090]
mov dword [esp + 4], esi
mov ebx, eax
lea eax, [eax + 1]
mov dword [esp + 8], eax
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_memmove]
mov esi, dword [0x4081b8]
mov eax, esi
sub eax, ebx
cmp eax, 2
jbe 0x403020
mov eax, dword [ebp + 8]
add edi, ebx
mov dword [esp + 4], 1
mov dword [esp], edi
mov dword [esp + 0xc], eax
mov eax, ebx
not eax
lea edx, [eax + esi]
mov dword [esp + 8], edx
call dword [sym.imp.ucrtbase.dll_fread]
test eax, eax
jne 0x402fe0
mov eax, dword [0x408090]
mov dword [0x408188], 0
test eax, eax
je 0x402fd3
call sym._GetWideString.part.0
mov dword [0x4080ec], eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [0x408090]
add ebx, esi
mov dword [0x408188], esi
mov byte [ebx + eax], 0
test esi, esi
jne 0x402f41
mov dword [esp], esi
mov eax, dword [ebp - 0x1c]
mov dword [0x4080ec], 0
call eax
xor eax, eax
mov dword [0x4081b8], 0
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
add esi, esi
mov dword [esp], edi
mov dword [0x4081b8], esi
mov dword [esp + 4], esi
call dword [sym.imp.ucrtbase.dll_realloc]
mov dword [0x408090], eax
mov edi, eax
jmp 0x402f92
mov dword [0x4081b8], 0x1000
mov dword [esp], 0x1000
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [0x408090], eax
mov esi, eax
mov byte [eax], 0
mov dword [0x408188], eax
jmp 0x402f41
mov esi, dword [0x408090]
jmp 0x402ffa
lea ecx, [eax + 1]
cmp byte [eax], 0xd
mov dword [0x408188], ecx
je 0x4030b0
mov byte [eax], 0
mov eax, esi
call sym._GetWideString.part.0
mov dword [0x4080ec], eax
jmp 0x402fd8
cmp byte [eax + 1], 0xa
jne 0x403096
lea ecx, [eax + 2]
mov dword [0x408188], ecx
jmp 0x403096
Function at 0x4030d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [ebp + 8]
test eax, eax
je 0x40325e
mov edi, dword [0x4081b4]
test edi, edi
je 0x403220
mov ebx, dword [0x408184]
test ebx, ebx
je 0x40325e
mov dword [esp + 4], 0x40922e
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcspbrk]
test eax, eax
jne 0x403269
mov edx, dword [0x408184]
cmp word [edx], 0
je 0x403250
mov eax, edx
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x403130
sub eax, edx
mov edi, eax
mov ebx, eax
lea eax, [eax + 2]
sar edi, 1
mov esi, dword [0x40808c]
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_memmove]
mov eax, dword [0x4081b4]
mov edx, eax
sub edx, edi
cmp edx, 2
jbe 0x4031f0
mov ecx, dword [ebp + 8]
mov edx, edi
mov dword [esp + 4], 2
not edx
add eax, edx
mov dword [esp + 0xc], ecx
lea ecx, [esi + ebx]
mov dword [esp + 8], eax
mov dword [esp], ecx
call dword [sym.imp.ucrtbase.dll_fread]
test eax, eax
jne 0x4031b0
mov dword [0x408184], 0
mov ebx, dword [0x40808c]
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [0x40808c]
add eax, edi
xor ecx, ecx
mov word [ebx + eax*2], cx
mov dword [0x408184], ebx
test ebx, ebx
jne 0x403100
mov dword [esp], ebx
xor ebx, ebx
call dword [sym.imp.ucrtbase.dll_free]
mov eax, ebx
mov dword [0x4081b4], 0
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
lea edx, [eax + eax]
shl eax, 2
mov dword [esp], esi
mov dword [0x4081b4], edx
mov dword [ebp - 0x1c], edx
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll_realloc]
mov edx, dword [ebp - 0x1c]
mov dword [0x40808c], eax
mov esi, eax
mov eax, edx
jmp 0x40316d
mov dword [0x4081b4], 0x1000
xor esi, esi
mov dword [esp], 0x2000
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [0x40808c], eax
mov ebx, eax
mov word [eax], si
mov dword [0x408184], eax
jmp 0x403100
mov eax, 2
xor ebx, ebx
xor edi, edi
jmp 0x403144
mov ebx, dword [0x40808c]
jmp 0x4031cc
lea edx, [eax + 2]
cmp word [eax], 0xd
mov dword [0x408184], edx
je 0x403282
xor edx, edx
mov word [eax], dx
jmp 0x4031a6
cmp word [eax + 2], 0xa
jne 0x403278
lea edx, [eax + 4]
mov dword [0x408184], edx
jmp 0x403278
Function at 0x404010
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [esp], 0xfffffff5
mov edi, dword [sym.imp.kernel32.dll_GetStdHandle]
call edi
lea edx, [ebp - 0x1c]
sub esp, 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteConsoleW]
sub esp, 0x14
test eax, eax
je 0x404060
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [sym.imp.kernel32.dll_GetOEMCP]
mov dword [ebp - 0x38], ecx
call ecx
mov edx, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [ebp - 0x34], edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call edx
sub esp, 0x20
mov dword [ebp - 0x2c], eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x30], eax
call ecx
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x30]
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
lea ebx, [ebp - 0x1c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
mov edx, dword [ebp - 0x34]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call edx
sub esp, 0x20
mov dword [esp], 0xfffffff5
call edi
mov edi, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
sub esp, 4
mov dword [esp + 0xc], ebx
mov dword [esp + 4], edi
mov dword [esp + 0x10], 0
mov dword [esp + 8], ecx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
mov dword [ebp + 8], edi
sub esp, 0x14
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp dword [sym.imp.ucrtbase.dll_free]
Function at 0x406350
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x6c
cmp dword [ebp + 8], 4
mov ebx, dword [ebp + 0xc]
jg 0x40637a
mov dword [ebp - 0x40], 0
jne 0x4063d8
mov edx, dword [ebx + 0xc]
movzx eax, word [edx]
and eax, 0xfffffffd
cmp ax, 0x2d
je 0x4063b0
mov dword [esp], 0x69
call sym._output_message
mov eax, dword [ebx + 4]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__wcsupr]
mov dword [esp], 0x6a
mov dword [esp + 4], eax
call sym._output_message
mov eax, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esi, [edx + 2]
mov dword [esp + 4], str.reg:32
mov edi, dword [sym.imp.kernel32.dll_lstrcmpiW]
mov dword [esp], esi
call edi
sub esp, 8
test eax, eax
jne 0x406560
mov dword [ebp - 0x40], 0x200
mov esi, dword [ebx + 8]
mov dword [esp + 4], 0x40929c
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll__wfopen]
mov ebx, eax
test eax, eax
je 0x406540
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x52]
mov dword [esp + 8], 1
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_fread]
cmp eax, 1
jne 0x406528
movzx ecx, byte [ebp - 0x51]
movzx eax, byte [ebp - 0x52]
xor esi, esi
mov byte [ebp - 0x59], cl
mov ecx, sym._get_lineA
cmp al, 0xff
jne 0x406448
xor edx, edx
mov edi, sym._get_lineW
cmp byte [ebp - 0x59], 0xfe
sete dl
cmove ecx, edi
mov esi, edx
movzx edx, byte [ebp - 0x59]
mov dword [ebp - 0x48], esi
lea esi, [ebp - 0x50]
mov word [ebp - 0x4c], ax
lea eax, [ebp - 0x4c]
mov word [ebp - 0x4a], dx
mov edx, 0xffffffff
mov word [ebp - 0x44], dx
mov edx, sym._header_state
mov dword [0x4080e8], ecx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
jmp 0x4064c2
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx*4 + 0x409820]
mov dword [esp + 4], eax
mov dword [esp], esi
call edx
test eax, eax
jne 0x4064b8
cmp word [ebp - 0x44], 4
je 0x406528
mov eax, dword [ebp - 0x34]
mov esi, dword [sym.imp.ucrtbase.dll_free]
mov dword [esp], eax
call esi
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x406510
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call esi
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x38], 0
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [ebp - 0x3c], 0
sub esp, 4
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fclose]
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fclose]
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], esi
mov dword [esp], 0x192
call sym._output_message
mov eax, 1
jmp 0x4063a7
mov dword [esp + 4], 0x40928e
mov dword [esp], esi
call edi
sub esp, 8
test eax, eax
jne 0x40637a
mov dword [ebp - 0x40], 0x100
jmp 0x4063d8
Function at 0x407070
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x2c]
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0x28]
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0x24]
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
mov eax, dword [ebx + 0x20]
sub esp, 0x18
sub eax, 3
cmp eax, 1
jbe 0x4070e0
cmp word [ebx + 0xc], 1
mov eax, 1
mov dword [ebx + 0x28], 0
sbb eax, 0xffffffff
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x34], eax
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp - 4]
leave
ret
mov eax, dword [ebx + 0x28]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x4070b8

Function at 0x407b60
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
Function at 0x6f20b9b4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], 0x6f235c24
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.6f21169c
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort

Function at 0x6f20c32c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x6f20c34b
mov eax, 0
jmp 0x6f20c38f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x6f20c36e
mov eax, 0
jmp 0x6f20c38f
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x6f20c38a
mov eax, 0
jmp 0x6f20c38f
mov eax, 1
leave
ret

Function at 0x6f20c391
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x6f20c3f0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x6f20c3e8
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x6f20c3e8
mov eax, dword [ebp - 4]
jmp 0x6f20c404
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x6f20c3c5
mov eax, 0
leave
ret
Function at 0x6f21294f
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
add esp, 0xffffff80
cmp dword [ebp + 8], 0
je 0x6f212a68
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym.hal.dll_pthread_spin_destroy
cmp eax, 1
jne 0x6f212a5e
mov dword [ebp - 0x77], 0x6f727245
mov dword [ebp - 0x73], 0x6c632072
mov dword [ebp - 0x6f], 0x696e6165
mov dword [ebp - 0x6b], 0x7520676e
mov dword [ebp - 0x67], 0x70732070
mov dword [ebp - 0x63], 0x6b5f6e69
mov dword [ebp - 0x5f], 0x20737965
mov dword [ebp - 0x5b], 0x20726f66
mov dword [ebp - 0x57], 0x65726874
mov dword [ebp - 0x53], 0x206461
lea eax, [ebp - 0x4f]
mov ecx, 0x43
mov ebx, 0
mov dword [eax], ebx
mov dword [eax + ecx - 4], ebx
lea edx, [eax + 4]
and edx, 0xfffffffc
sub eax, edx
add ecx, eax
and ecx, 0xfffffffc
shr ecx, 2
mov edi, edx
mov eax, ebx
rep stosd dword es:[edi], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov dword [esp + 8], 0xa
lea edx, [ebp - 0x77]
add edx, 0x27
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultoa]
call eax
mov dword [ebp - 0xc], 0x27
jmp 0x6f212a14
add dword [ebp - 0xc], 1
lea edx, [ebp - 0x77]
mov eax, dword [ebp - 0xc]
add eax, edx
movzx eax, byte [eax]
test al, al
je 0x6f212a2b
mov eax, dword [ebp - 0xc]
cmp eax, 0x69
jbe 0x6f212a10
mov eax, dword [ebp - 0xc]
cmp eax, 0x69
ja 0x6f212a49
lea edx, [ebp - 0x77]
mov eax, dword [ebp - 0xc]
add eax, edx
mov byte [eax], 0xa
mov eax, dword [ebp - 0xc]
add eax, 1
mov byte [ebp + eax - 0x77], 0
lea eax, [ebp - 0x77]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call eax
sub esp, 4
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x6f212a69
nop
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret