joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4014b0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea eax, [ebp - 0x24]
sub esp, 0x40
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0x10
mov dword [ebp - 0x14], 0x6f
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x40708c
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x405bd0
call dword [sym.imp.ole32.dll_CoCreateInstance]
sub esp, 0x14
test eax, eax
js 0x401630
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 8
test eax, eax
js 0x401600
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x20]
mov edx, dword [eax]
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 0x10]
sub esp, 8
test eax, eax
js 0x401600
mov dword [esp + 8], 0x4c
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x401600
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x1c]
mov edx, dword [eax]
mov dword [esp + 8], ecx
mov dword [esp + 4], str.DxDiag_SystemInfo
mov dword [esp], eax
call dword [edx + 0x14]
sub esp, 0xc
test eax, eax
js 0x4015cf
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._fill_system_information
mov esi, eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
test esi, esi
jne 0x401668
mov eax, ebx
call sym._free_system_information
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esi, [esi]
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x401612
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x401626
mov eax, dword [ebx]
mov dword [esp], ebx
xor ebx, ebx
call dword [eax + 8]
sub esp, 4
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
test byte [section..data], 2
je 0x401600
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.IDxDiagProvider_instance_creation_failed_with_0x_08lx_n
mov dword [esp + 8], str.collect_dxdiag_information
mov dword [esp + 4], 0x404000
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x401600
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
mov eax, dword [ebp - 0x24]
sub esp, 4
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
mov eax, ebx
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x401ed0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x401f2b
cmp byte [esi + ebx - 1], 0xa
je 0x401eff
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x404550], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x402470
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x402488
mov ebx, dword [ebp - 4]
leave
ret
mov eax, ebx
call sym._free_system_information
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ebx, dword [ebp - 4]
sub esp, 0xc
leave
ret
Function at 0x403a80
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x403b1b
cmp ax, 9
je 0x403b08
cmp ax, 0x20
je 0x403b08
mov dword [ebp - 0x6c], 0
xor edi, edi
lea esi, [esi]
cmp ax, 0x5c
je 0x403b70
cmp ax, 0x22
je 0x403b80
mov dword [ebp - 0x6c], 0
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x403b1b
cmp ax, 9
sete cl
cmp ax, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x403ac0
test edi, 1
jne 0x403ac0
lea esi, [esi]
movzx eax, word [ebx + 2]
add ebx, 2
cmp ax, 9
je 0x403b08
cmp ax, 0x20
je 0x403b08
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x30], 1
je 0x403b98
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._wWinMain_16
sub esp, 0x10
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
inc dword [ebp - 0x6c]
jmp 0x403adb
and dword [ebp - 0x6c], 1
jne 0x403ad4
xor edi, 1
jmp 0x403adb
mov eax, 1
mov esi, 1
mov word [ebp - 0x2c], ax
jmp 0x403b34

Function at 0x403bb0
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
Function at 0x401000
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0x808
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], edx
xor ebp, ebp
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x40105b
mov edi, ecx
lea edx, [edi + 2]
nop
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x401020
sub edi, edx
sar edi, 1
cmp edi, 0x200
jb 0x40103c
mov edi, 0x1ff
push edi
push ecx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.00402090
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x40107d
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x4010ef
mov esi, dword [ebx]
cmp esi, ebx
je 0x4010ef
test esi, esi
je 0x4010ef
cmp word [esi + 0x24], 2
jbe 0x4010e9
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x4010e9
cmp dword [esi + 0x18], 0
je 0x4010e9
test ebp, ebp
je 0x4010a5
cmp ebp, eax
jne 0x4010e9
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.00402090
mov edx, dword [esp + 0x1c]
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
test edx, edx
je 0x4010ca
cmp edx, dword [esi + 0x18]
jne 0x4010e9
cmp dword [esp + 0x14], eax
je 0x4010fc
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.00403dd0
add esp, 8
test eax, eax
je 0x4010fc
mov esi, dword [esi]
cmp esi, ebx
jne 0x401083
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x808
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x808
ret

Function at 0x401210
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
lea edx, [ebp + 0x10]
sub esp, 0x40
push ebx
push esi
push edi
test ecx, ecx
jle 0x401238
mov eax, dword [ebp + 0x10]
lea edx, [ebp + 0x18]
dec ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0xc], eax
jmp 0x401246
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
test ecx, ecx
jle 0x40125f
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x14], eax
jmp 0x40126d
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
test ecx, ecx
jle 0x401286
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x1c], eax
jmp 0x401294
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
test ecx, ecx
jle 0x4012ad
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x28], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x24], eax
jmp 0x4012bb
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov eax, edx
mov dword [ebp - 0x30], 0
cdq
mov dword [ebp - 0x40], eax
mov eax, ecx
mov dword [ebp - 0x3c], edx
cdq
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov word [ebp - 8], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 4], esp
and esp, 0xfffffff0
push 0x33
call 0x401302
add dword [esp], 5
retf
Function at 0x401390
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Get windows directory from kuser_shared_data

Disassembly:
mov eax, dword [0x803a08]
sub esp, 0x20c
push ebp
mov ebp, ecx
push esi
push edi
test eax, eax
je 0x40153d
cmp dword [0x803a0c], 0
jne 0x401529
xor eax, eax
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
mov byte [esp + 0x1e], al
lea eax, [esp + 0x20]
push eax
call fcn.00403fe0
add esp, 0xc
xor edi, edi
xor eax, eax
nop
mov byte [esp + eax + 0x18], al
inc eax
cmp eax, 0x100
jb 0x4013e0
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x18]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + 0x41a0d4]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
inc esi
mov byte [esp + edi + 0x18], dl
cmp esi, 0x100
jb 0x4013f0
xor esi, esi
xor edi, edi
xor edx, edx
lea eax, [esi + 1]
movzx esi, al
mov cl, byte [esp + esi + 0x18]
movzx eax, cl
add eax, edi
movzx edi, al
movzx eax, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
mov byte [esp + edi + 0x18], cl
movzx eax, byte [esp + esi + 0x18]
movzx ecx, cl
add ecx, eax
movzx eax, cl
movzx eax, byte [esp + eax + 0x18]
xor al, byte [edx + 0x41a0d8]
mov byte [esp + edx + 0xc], al
inc edx
cmp edx, 0xb
jb 0x401425
push 0x200
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00403fe0
mov edx, 0x7ffe0030
add esp, 0xc
xor ecx, ecx
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x401484
sub edx, esi
sar edx, 1
je 0x40153d
mov esi, ebp
lea edi, [esi + 1]
mov edi, edi
mov al, byte [esi]
inc esi
test al, al
jne 0x4014a0
sub esi, edi
add edx, 0xc
add edx, esi
cmp edx, 0x200
ja 0x40153d
xor eax, eax
push ebx
test edx, edx
je 0x4014d8
movzx ebx, word [eax + eax + 0x7ffe0030]
test bx, bx
je 0x4014d8
mov byte [esp + eax + 0x1c], bl
inc ecx
inc eax
cmp eax, edx
jb 0x4014c1
xor eax, eax
test edx, edx
je 0x4014f2
mov edi, edi
mov bl, byte [esp + eax + 0x10]
test bl, bl
je 0x4014f2
mov byte [esp + ecx + 0x1c], bl
inc eax
inc ecx
cmp eax, edx
jb 0x4014e0
xor eax, eax
test edx, edx
je 0x40150f
lea ecx, [esp + ecx + 0x1c]
lea esp, [esp]
mov bl, byte [eax + ebp]
test bl, bl
je 0x40150f
mov byte [ecx], bl
inc eax
inc ecx
cmp eax, edx
jb 0x401500
push 8
push 0
lea eax, [esp + 0x24]
push eax
call dword [0x803a08]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
push 0x800
push 0
push ebp
call eax
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20c
ret
Function at 0x401f80
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [0x804778]
sub esp, 0x11c
test eax, eax
jne 0x40207e
push ebx
push esi
push edi
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov word [esp + 0x2c], ax
lea eax, [esp + 0x30]
push eax
call fcn.00403fe0
add esp, 0xc
xor edi, edi
xor eax, eax
lea ebx, [ebx]
mov byte [esp + eax + 0x28], al
inc eax
cmp eax, 0x100
jb 0x401fd0
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x28]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + 0x41a100]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x28]
mov byte [esp + esi + 0x28], al
inc esi
mov byte [esp + edi + 0x28], dl
cmp esi, 0x100
jb 0x401fe0
xor edi, edi
xor ebx, ebx
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [esp + edi + 0x28]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
movzx eax, byte [esp + ebx + 0x28]
mov byte [esp + edi + 0x28], al
mov byte [esp + ebx + 0x28], cl
movzx eax, byte [esp + edi + 0x28]
add eax, edx
movzx eax, al
movzx eax, byte [esp + eax + 0x28]
xor al, byte [esi + 0x41a104]
mov byte [esp + esi + 0xc], al
inc esi
cmp esi, 0x1a
jb 0x402015
xor edx, edx
lea ecx, [esp + 0xc]
call section..text
pop edi
pop esi
pop ebx
test eax, eax
je 0x402079
mov eax, dword [eax + 0x18]
test eax, eax
je 0x402079
mov dword [0x804778], eax
add esp, 0x11c
ret
mov eax, dword [0x804778]
add esp, 0x11c
ret
Function at 0x4020f0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0xc08
push ebx
push ebp
mov dword [esp + 0xc], edx
xor edx, edx
mov dword [esp + 8], edx
push esi
push edi
test ecx, ecx
je 0x40213b
xor esi, esi
lea edi, [esp + 0x818]
mov al, byte [esi + ecx]
test al, al
je 0x40212b
cbw
inc esi
mov word [edi], ax
add edi, 2
cmp esi, 0x1ff
jb 0x402111
jmp 0x402130
xor eax, eax
mov word [edi], ax
lea edx, [esp + 0x818]
mov dword [esp + 0x10], edx
xor edi, edi
xor ebp, ebp
test edx, edx
je 0x40218b
mov edi, edx
lea ecx, [edi + 2]
jmp 0x402150
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x402150
sub edi, ecx
sar edi, 1
cmp edi, 0x200
jb 0x40216c
mov edi, 0x1ff
push edi
push edx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.00402090
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x4021ad
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x402220
mov esi, dword [ebx]
cmp esi, ebx
je 0x402220
test esi, esi
je 0x402220
cmp word [esi + 0x24], 2
jbe 0x40221a
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x40221a
cmp dword [esi + 0x18], 0
je 0x40221a
test ebp, ebp
je 0x4021d5
cmp ebp, eax
jne 0x40221a
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.00402090
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4021fa
cmp eax, dword [esi + 0x18]
jne 0x40221a
cmp dword [esp + 0x10], 0
je 0x40222d
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.00403dd0
add esp, 8
test eax, eax
je 0x40222d
mov esi, dword [esi]
cmp esi, ebx
jne 0x4021b3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc08
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc08
ret
Function at 0x403930
Capabilities:
Check os version

Disassembly:
mov ecx, 1
mov edx, 0x803b48
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x403a59
cmp dword fs:[0xc0], eax
je 0x40395b
mov dword [0x803b44], 1
mov eax, dword fs:[0x18]
push ebx
push esi
mov ebx, 1
mov esi, dword [eax + 0x30]
mov eax, dword [esi + 0xa4]
mov dword [0x803a2c], eax
mov eax, dword [esi + 0xa8]
mov dword [0x803a30], eax
movzx edx, word [esi + 0xac]
mov dword [0x803a34], edx
mov eax, dword [esi + 0xb0]
mov dword [0x803a38], eax
mov eax, dword [esi + 0x1f4]
test eax, eax
je 0x4039bb
push 0x7f
push eax
push 0x803a3c
call fcn.00402090
mov edx, dword [0x803a34]
add esp, 0xc
jmp 0x4039c3
xor eax, eax
mov word [0x803a3c], ax
movzx eax, byte [esi + 0xaf]
mov ecx, 0xff
mov word [0x803b3c], ax
movzx eax, word [esi + 0xae]
and ax, cx
mov word [0x803b3e], ax
movzx eax, word [0x7ffe02d0]
mov word [0x803b40], ax
mov ecx, eax
mov byte [0x803b42], 0
cmp byte [0x7ffe0268], 0
je 0x403a0a
mov ebx, dword [0x7ffe0264]
pop esi
mov byte [0x803b42], bl
cmp ebx, 1
pop ebx
jne 0x403a24
and ecx, 0xffef
mov word [0x803b40], cx
test edx, edx
jne 0x403a59
call fcn.00403930
cmp dword [0x803a2c], 6
ja 0x403a59
jb 0x403a41
cmp dword [0x803a30], 4
jae 0x403a59
call fcn.00403930
cmp dword [0x803a2c], 0xa
jae 0x403a59
mov dword [0x803a34], 1
ret
Function at 0x419882
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
ret

Function at 0x58a830
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x109000]
push edi
or ebp, 0xffffffff
jmp 0x58a852
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x58a859
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x58a848
mov eax, 1
add ebx, ebx
jne 0x58a86b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x58a87c
jne 0x58a88c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x58a88c
dec eax
add ebx, ebx
jne 0x58a888
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x58a860
xor ecx, ecx
sub eax, 3
jb 0x58a8a4
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x58a916
sar eax, 1
mov ebp, eax
jmp 0x58a8af
add ebx, ebx
jne 0x58a8af
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x58a8bc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x58a8e0
inc ecx
add ebx, ebx
jne 0x58a8cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x58a8c1
jne 0x58a8dd
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x58a8c1
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x58a900
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x58a8f1
jmp 0x58a84e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x58a900
add edi, ecx
jmp 0x58a84e
pop esi
mov edi, esi
mov ecx, 0x6391
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x58a91e
cmp byte [edi], 0x11
jne 0x58a91e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x58a923
lea edi, [esi + 0x188000]
mov eax, dword [edi]
or eax, eax
je 0x58a99b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19077c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x190844]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x58a950
mov ecx, edi
jns 0x58a97f
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x190848]
or eax, eax
je 0x58a995
mov dword [ebx], eax
add ebx, 4
jmp 0x58a96d
call dword [esi + 0x19084c]
popal
jmp 0x4e2948
Function at 0x1001a093
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x1001a0a2
pop dword [ebp - 0x38]
mov eax, 0x801dfff4
add eax, 0x8fe3a0ae
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x41053
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0x7142fc47
sub ecx, 0x7142b220
xor edi, edi
add edi, eax
mov ebx, 0x1003be00
add ebx, dword [ebp - 0x38]
mov edx, 0xe1110eb5
add edx, 0xcb7abb67
mov dword [ebp - 0x24], 0x48dcda29
mov esi, dword [ebx]
mov dword [ebp - 0x24], 0x1b0b8204
sub esi, edx
add dword [ebp - 0x14], 0x52f40102
mov dword [edi], esi
xor dword [ebp - 4], ecx
add edi, 4
add ebx, 0xad264b10
add ebx, 0x52d9b4f4
loop 0x1001a0f8
add eax, 0x11b6f
xor ebx, ebx
add ebx, eax
add eax, 0x5072cdda
add eax, 0xaf8d322b
mov ecx, 0x10000000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x100289d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100330b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10035b0c]
test dword [ebp + 8], eax
je 0x10028a7a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push eax
call fcn.1001a093
xor eax, eax
add esp, 0xc
mov word [ebp - 8], ax
mov eax, dword [0x10035b08]
test eax, eax
je 0x10028a6d
lea ecx, [ebp - 0x808]
push ecx
push eax
call fcn.1001a093
mov eax, dword [0x100330ac]
pop ecx
pop ecx
test eax, eax
jle 0x10028a7a
push esi
mov esi, dword [0x10035b10]
push edi
mov edi, dword [0x10035b14]
cdq
push edx
push eax
push edi
push esi
call fcn.10029420
add esi, 1
mov dword [0x10035b10], esi
adc edi, 0
or eax, edx
mov dword [0x10035b14], edi
pop edi
pop esi
jne 0x10028a7a
push dword [0x10035b08]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
pop ecx
jmp 0x10028a7a
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028d50
leave
ret
Function at 0x401040
Capabilities:
Accept command line arguments
Create process memory minidump

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
lea edx, [ebp - 0x1c]
push ebx
push ecx
sub esp, 0x38
mov eax, dword [ecx + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.shcore.dll_CommandLineToArgvW]
mov ecx, dword [ebp - 0x1c]
mov edx, eax
sub esp, 8
mov eax, 1
test ecx, ecx
jle 0x40117c
mov ebx, dword [edx]
cmp word [ebx], 0x30
jne 0x40109b
movzx eax, word [ebx + 2]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_towlower]
cmp ax, 0x78
je 0x401190
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcstoul]
mov esi, eax
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0x410
call dword [sym.imp.kernel32.dll_OpenProcess]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x4011b0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov dword [esp], str.minidump.dmp
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
mov edi, eax
cmp eax, 0xffffffff
je 0x4011c8
mov dword [esp + 4], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 2
mov dword [esp + 8], eax
mov dword [esp], ebx
call sym._MiniDumpWriteDump_28
sub esp, 0x1c
mov esi, eax
mov dword [esp], edi
mov edi, dword [sym.imp.kernel32.dll_CloseHandle]
call edi
sub esp, 4
mov dword [esp], ebx
call edi
xor eax, eax
sub esp, 4
test esi, esi
sete al
shl eax, 2
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcstoul]
mov esi, eax
jmp 0x4010b6
lea esp, [ebp - 0x10]
mov eax, 2
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, 3
sub esp, 4
jmp 0x40117c