joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403560
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call 0x4035d0
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.00401be0
mov dword [esp], eax
call sub.ucrtbase.dll_exit
nop
nop
nop
jmp dword [sym.imp.ucrtbase.dll___p___argc]
Function at 0x402796
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x74]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x4c], eax
lea ebx, [esp + 0x48]
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll__localtime64]
mov ecx, dword [eax]
mov dword [esp + 0x30], ecx
mov edi, dword [eax + 4]
mov dword [esp + 0x2c], edi
mov ebp, dword [eax + 8]
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
mov dword [esp + 0x34], edx
mov edi, dword [eax + 0x14]
mov eax, dword [eax + 0x1c]
mov dword [esp + 0x38], eax
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll__gmtime64]
mov ebx, dword [eax + 4]
mov dword [esp + 0x3c], ebx
mov ebx, dword [eax + 8]
mov dword [esp + 0x40], ebx
mov ebx, dword [eax + 0x14]
mov dword [esp + 0x44], ebx
mov ebx, dword [eax + 0x1c]
mov edx, 0x6b5fca6b
mov eax, edx
imul dword [esp + 0x7c]
sar edx, 0x16
mov eax, dword [esp + 0x7c]
sar eax, 0x1f
sub edx, eax
mov dword [esp + 0x20], edx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], esi
mov edx, dword [esp + 0x34]
lea esi, [edx + 1]
mov dword [esp + 0xc], esi
lea eax, [edi + 0x76c]
mov dword [esp + 8], eax
mov dword [esp + 4], str._4.4d_2.2d_2.2d_2.2d_2.2d_2.2d_2.2d
mov eax, dword [esp + 0x70]
mov dword [esp], eax
call fcn.0043dbe2
cmp dword [esp + 0x80], 0xffffff9c
jne 0x4028ab
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x3c]
mov ecx, ebp
sub ecx, dword [esp + 0x40]
sub edi, dword [esp + 0x44]
mov edx, edi
mov edi, dword [esp + 0x38]
sub edi, ebx
test edx, edx
cmove edx, edi
lea edx, [edx + edx*2]
lea ecx, [ecx + edx*8]
imul ecx, ecx, 0x3c
add ecx, eax
mov edx, 0x88888889
mov eax, ecx
imul edx
add edx, ecx
sar edx, 3
sar ecx, 0x1f
sub edx, ecx
mov eax, dword [esp + 0x70]
mov byte [eax + 0x10], dl
jmp 0x4028ba
mov esi, dword [esp + 0x70]
movzx eax, byte [esp + 0x80]
mov byte [esi + 0x10], al
mov eax, 0
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40eb34
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
push eax
mov eax, 0x81a8
call fcn.00444b80
sub esp, eax
mov eax, dword [esp + eax]
mov esi, eax
mov ebx, edx
lea eax, [esp + 0x8010]
mov dword [esp], eax
call fcn.004396c0
mov dword [esp + 4], 0x44f080
mov dword [esp], esi
call sub.msvcrt.dll_fopen
mov ebp, eax
test eax, eax
je 0x40ec00
test ebx, ebx
je 0x40ebd3
lea edi, [esp + 0x10]
cmp ebx, 0x8000
mov eax, 0x8000
cmovbe eax, ebx
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], edi
call sub.msvcrt.dll_fread
mov esi, eax
test eax, eax
jne 0x40ebb8
mov dword [esp], ebp
call sub.msvcrt.dll_fclose
mov eax, 0
jmp 0x40ec05
mov dword [esp + 8], eax
mov dword [esp + 4], edi
lea eax, [esp + 0x8010]
mov dword [esp], eax
call fcn.004399f0
sub ebx, esi
jne 0x40eb7d
mov dword [esp], ebp
call sub.msvcrt.dll_fclose
mov dword [esp], 0x40
call fcn.00402e15
mov ebx, eax
lea eax, [esp + 0x8010]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00439ac0
mov eax, ebx
jmp 0x40ec05
mov eax, 0
add esp, 0x81ac
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x41bb70
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [esp + 0x44]
mov eax, dword [0x4937a8]
test eax, eax
jne 0x41bc24
mov eax, dword [0x495064]
mov eax, dword [eax + 0x90]
mov eax, dword [eax + 4]
mov ecx, eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x48]
shl eax, 0xb
mov ebx, eax
mov dword [esp + 0x1c], eax
mov eax, 0x800
cdq
idiv ecx
imul eax, dword [esp + 0x40]
mov ebp, eax
test ebx, ebx
jle 0x41bcd9
mov esi, dword [0x495060]
cmp ebx, esi
mov eax, esi
cmovle eax, ebx
cdq
idiv dword [esp + 0x18]
mov esi, eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebp
mov dword [esp + 4], edi
mov eax, dword [0x495064]
mov dword [esp], eax
call fcn.0042ee05
test eax, eax
js 0x41bc02
mov eax, dword [0x495064]
mov dword [esp], eax
call fcn.0042f4d4
test eax, eax
je 0x41bc0e
mov dword [esp], str.Read_error_on_old_image_n
call fcn.0043ac55
mov eax, dword [esp + 0x18]
imul eax, esi
sub ebx, eax
add edi, eax
add ebp, esi
test ebx, ebx
jg 0x41bbc0
jmp 0x41bcdf
mov dword [esp], eax
call sub.msvcrt.dll__fileno
mov esi, eax
mov dword [esp + 0xc], 0
mov ecx, dword [esp + 0x40]
mov ebx, 0
shld ebx, ecx, 0xb
shl ecx, 0xb
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
mov dword [esp], eax
call fcn.00446350
and eax, edx
cmp eax, 0xffffffff
jne 0x41bc69
mov dword [esp], str.Seek_error_on_old_image_n
call fcn.0043ac55
mov ebx, dword [esp + 0x48]
shl ebx, 0xb
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sub.msvcrt.dll__read
cmp ebx, eax
je 0x41bce3
cmp dword [0x4937a4], 0
je 0x41bcb3
test eax, eax
mov edx, 0
cmovs eax, edx
mov dword [esp + 8], 0
mov edx, ebx
sub edx, eax
mov dword [esp + 4], edx
add eax, edi
mov dword [esp], eax
call fcn.0043afb0
jmp 0x41bce3
test eax, eax
jns 0x41bcc3
mov dword [esp], str.Read_error_on_old_image_n
call fcn.0043ac55
mov dword [esp + 4], str.Short_read_on_old_image_n
mov dword [esp], 0xffffffff
call fcn.0043acd9
jmp 0x41bce3
mov ebx, dword [esp + 0x1c]
jmp 0x41bce3
mov ebx, dword [esp + 0x1c]
mov eax, ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x41c2b9
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov ebx, eax
mov esi, edx
mov edi, ecx
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov dword [esp], edx
call sub.msvcrt.dll_memset
mov dword [esp + 4], 0x450b67
mov dword [esp], ebx
call sub.msvcrt.dll_fopen
mov ebx, eax
test eax, eax
je 0x41c315
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov dword [esp + 4], 1
mov dword [esp], esi
call sub.msvcrt.dll_fread
mov esi, eax
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
mov eax, esi
jmp 0x41c31a
mov eax, 0xffffffff
add esp, 0x10
pop ebx
pop esi
pop edi
ret
Function at 0x424078
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ebp - 0x380]
call dword [ebp - 0x730]
invalid
mov ch, pe_nt_image_headers32
cld
Function at 0x42b865
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_strcpy
mov eax, dword [esp + 0x20]
mov dword [ebx + 0x28], eax
movzx eax, byte [esi]
cmp al, 1
je 0x42b89d
cmp al, 2
je 0x42b946
jmp 0x42b9ee
mov dword [ebx + 0x20], 1
mov eax, dword [esi + 8]
mov dword [ebx + 0x24], eax
mov eax, dword [esi + 0xc]
mov dword [esp], eax
call fcn.00424162
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], 0
mov eax, dword [esi + 0x10]
mov dword [esp], eax
call fcn.00424162
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x3c], 0
mov eax, dword [esi + 0x14]
mov dword [esp], eax
call fcn.00424162
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x44], 0
movzx eax, word [esi + 0x20]
mov word [ebx + 0x48], ax
movzx eax, word [esi + 0x22]
mov word [ebx + 0x4a], ax
movzx eax, word [esi + 0x24]
mov word [ebx + 0x4c], ax
movzx eax, word [esi + 6]
mov word [ebx + 0x50], ax
movzx eax, word [esi + 0x18]
mov word [ebx + 0x52], ax
movzx eax, word [esi + 0x1a]
mov word [ebx + 0x54], ax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x56], ax
movzx eax, word [esi + 0x1e]
mov word [ebx + 0x58], ax
movzx eax, word [esi + 0x28]
mov word [ebx + 0x5c], ax
movzx eax, word [esi + 0x2a]
mov word [ebx + 0x5e], ax
movzx eax, word [esi + 0x26]
mov word [ebx + 0x5a], ax
jmp 0x42b9ee
movzx eax, byte [esi + 4]
and eax, 1
shl eax, 0x1f
sar eax, 0x1f
and eax, 2
mov dword [ebx + 0x20], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x24], eax
mov eax, dword [esi + 0x34]
mov dword [esp], eax
call fcn.00424162
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], 0
mov eax, dword [esi + 0x38]
mov dword [esp], eax
call fcn.00424162
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x3c], 0
mov eax, dword [esi + 0x3c]
mov dword [esp], eax
call fcn.00424162
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x44], 0
movzx eax, word [esi + 0x10]
mov word [ebx + 0x48], ax
movzx eax, word [esi + 0x12]
mov word [ebx + 0x4a], ax
movzx eax, word [esi + 0x14]
mov word [ebx + 0x4c], ax
mov eax, dword [esi + 0x20]
mov dword [ebx + 0x50], eax
mov eax, dword [esi + 0x2c]
mov dword [ebx + 0x54], eax
mov eax, dword [esi + 8]
mov dword [esp + 4], eax
lea eax, [ebx + 0x58]
mov dword [esp], eax
call fcn.00423fa9
mov eax, dword [esi + 0xc]
mov dword [esp + 4], eax
lea eax, [ebx + 0x5d]
mov dword [esp], eax
call fcn.00423fa9
mov byte [ebx + 0x61], 0
mov byte [ebx + 0x5c], 0
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x42cd20
Capabilities:
Read file on windows

Disassembly:
push esi
push ebx
mov eax, 0x2054
call fcn.00444b80
sub esp, eax
mov ebx, dword [esp + 0x2060]
lea eax, [esp + 0x18]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00445b90
test eax, eax
jne 0x42cdba
cmp dword [esp + 0x2c], 0
je 0x42cdc1
movzx edx, word [esp + 0x1e]
and dx, 0xf000
cmp dx, 0x8000
jne 0x42cdd4
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.msvcrt.dll__open
mov ebx, eax
test eax, eax
js 0x42cdc8
mov dword [esp + 8], 0x2000
lea eax, [esp + 0x4f]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll__read
lea edx, [eax + 1]
cmp edx, 1
jbe 0x42cdcf
mov byte [esp + eax + 0x4f], 0
mov dword [esp + 4], edx
lea eax, [esp + 0x4f]
mov dword [esp], eax
call fcn.0042d9e6
mov esi, eax
mov dword [esp], ebx
call sub.msvcrt.dll__close
mov eax, esi
jmp 0x42cdd4
mov eax, 0
jmp 0x42cdd4
mov eax, 0
jmp 0x42cdd4
mov eax, 0
jmp 0x42cdd4
mov eax, 0
add esp, 0x2054
pop ebx
pop esi
ret
Function at 0x439b80
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [esp + 0x34]
call fcn.0043cd90
mov ebp, eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sub.msvcrt.dll__fileno
mov esi, eax
jmp 0x439baa
mov dword [esp], ebp
call fcn.0043f300
mov eax, dword [esp + 0x38]
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], esi
call sub.msvcrt.dll__read
mov ebx, eax
test eax, eax
jns 0x439bce
call fcn.0043cd90
cmp eax, 4
je 0x439ba2
mov eax, ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x43b0f0
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebp, dword [esp + 0x70]
test ebp, ebp
je 0x43b306
mov dword [esp + 4], 0x2f
mov dword [esp], ebp
call sub.msvcrt.dll_strchr
mov dword [esp + 0x18], eax
test eax, eax
je 0x43b12c
mov dword [esp], ebp
call sub.msvcrt.dll__strdup
mov dword [esp + 0x18], eax
jmp 0x43b30e
cmp dword [esp + 0x7c], 0
jne 0x43b153
mov dword [esp], 0x45abe5
call sub.msvcrt.dll_getenv
mov dword [esp + 0x7c], eax
test eax, eax
mov eax, 0x45abe0
cmovne eax, dword [esp + 0x7c]
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp], eax
call sub.msvcrt.dll__strdup
mov dword [esp + 0x1c], eax
test eax, eax
je 0x43b30e
mov ebx, eax
mov dword [esp + 0x14], 0
mov dword [esp + 4], 0x3b
mov dword [esp], ebx
call sub.msvcrt.dll_strchr
test eax, eax
je 0x43b191
lea esi, [eax + 1]
mov byte [eax], 0
jmp 0x43b193
mov esi, eax
cmp byte [ebx], 0
jne 0x43b1b7
mov dword [esp], ebp
call sub.msvcrt.dll__strdup
mov edi, eax
test eax, eax
jne 0x43b221
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_free
jmp 0x43b30e
mov edi, ebx
mov eax, 0
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov edx, ecx
not edx
mov edi, ebp
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
add edx, ecx
mov dword [esp], edx
call sub.msvcrt.dll_malloc
mov edi, eax
test eax, eax
jne 0x43b201
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp], ebp
call sub.msvcrt.dll__strdup
mov dword [esp + 0x18], eax
jmp 0x43b30e
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 0x45abea
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.0043f320
mov dword [esp], 0
call fcn.0043f300
lea eax, [esp + 0x20]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.00445b90
test eax, eax
js 0x43b293
cmp dword [esp + 0x78], 0
je 0x43b257
movzx eax, word [esp + 0x26]
and ax, 0xf000
cmp ax, 0x8000
jne 0x43b280
mov eax, dword [esp + 0x74]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.0043f770
test eax, eax
js 0x43b280
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp + 0x18], edi
jmp 0x43b30e
call fcn.0043cd90
mov ebx, eax
test eax, eax
mov eax, 8
cmove ebx, eax
jmp 0x43b29a
call fcn.0043cd90
mov ebx, eax
mov dword [esp], edi
call sub.msvcrt.dll_free
cmp dword [esp + 0x14], 0
jne 0x43b2c8
cmp ebx, 0x14
je 0x43b2e1
cmp ebx, 2
je 0x43b2e1
mov eax, ebx
and eax, 0xffffffef
cmp eax, 5
mov eax, dword [esp + 0x14]
cmovne eax, ebx
mov dword [esp + 0x14], eax
jmp 0x43b2d2
cmp ebx, 0x14
je 0x43b2e1
cmp ebx, 2
je 0x43b2e1
mov eax, ebx
and eax, 0xfffffff7
cmp eax, 5
je 0x43b2e1
cmp ebx, 0x15
jne 0x43b2ec
test esi, esi
je 0x43b2ec
mov ebx, esi
jmp 0x43b175
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0043f300
jmp 0x43b30e
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x18]
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x442335
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
fld qword [esp + 0x54]
fst qword [esp + 0x18]
fstp qword [esp]
mov eax, dword [esp + 0x50]
call fcn.004422d0
mov edx, eax
test edx, edx
jg 0x442488
lea eax, [esp + 0x28]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x2c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x60]
add eax, 1
mov dword [esp + 8], eax
fld qword [esp + 0x18]
fstp qword [esp]
call sub.msvcrt.dll__ecvt
mov ebx, eax
mov eax, dword [esp + 0x2c]
lea ebp, [eax - 1]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x60]
add eax, 6
mov ecx, dword [esp + 0x60]
add ecx, 7
test edx, edx
cmovne eax, ecx
mov edi, dword [esp + 0x50]
cmp eax, dword [esp + 0x5c]
jge 0x4423c4
mov edi, dword [esp + 0x5c]
sub edi, eax
add edi, dword [esp + 0x50]
mov eax, dword [esp + 0x50]
add eax, 1
mov byte [eax - 1], 0x20
cmp eax, edi
jne 0x4423b9
test edx, edx
je 0x4423ce
mov byte [edi], 0x2d
lea edi, [edi + 1]
movzx eax, byte [ebx]
test al, al
je 0x4423dd
add ebx, 1
mov byte [edi], al
lea edi, [edi + 1]
lea esi, [edi + 1]
call dword [sym.imp.msvcrt.dll_localeconv]
mov eax, dword [eax]
movzx eax, byte [eax]
mov byte [edi], al
movzx eax, byte [ebx]
test al, al
je 0x442415
cmp dword [esp + 0x60], 0
jle 0x442415
mov edx, ebx
add edx, dword [esp + 0x60]
add esi, 1
add ebx, 1
mov byte [esi - 1], al
movzx eax, byte [ebx]
test al, al
je 0x442415
cmp ebx, edx
jne 0x442401
mov byte [esi], 0x65
mov eax, ebp
sar eax, 0x1f
and eax, 2
add eax, 0x2b
mov byte [esi + 1], al
mov eax, ebp
sar eax, 0x1f
xor ebp, eax
sub ebp, eax
lea ecx, [esi + 2]
cmp ebp, 0x63
jle 0x442458
lea ecx, [esi + 3]
mov edx, 0x51eb851f
mov eax, ebp
imul edx
sar edx, 5
mov eax, ebp
sar eax, 0x1f
sub edx, eax
lea eax, [edx + 0x30]
mov byte [esi + 2], al
imul edx, edx, 0x64
sub ebp, edx
mov edx, 0x66666667
mov eax, ebp
imul edx
sar edx, 2
mov eax, ebp
sar eax, 0x1f
sub edx, eax
lea eax, [edx + 0x30]
mov byte [ecx], al
lea eax, [edx + edx*4]
add eax, eax
sub ebp, eax
lea eax, [ebp + 0x30]
mov byte [ecx + 1], al
mov byte [ecx + 2], 0
lea eax, [ecx + 2]
sub eax, dword [esp + 0x50]
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x44359d
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, 1
push esi
push ebx
sub esp, 0x1c
cmp dword [0x496c34], 0
jne 0x443652
mov dword [esp], str.mlang.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
push ebx
mov ebx, eax
je 0x443650
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], str.ConvertINetString
mov dword [esp], eax
call esi
push edx
push edx
mov dword [0x496c34], eax
mov dword [esp + 4], str.ConvertINetMultiByteToUnicode
mov dword [esp], ebx
call esi
push ecx
push ecx
mov dword [0x496c30], eax
mov dword [esp + 4], str.ConvertINetUnicodeToMultiByte
mov dword [esp], ebx
call esi
push edx
push edx
mov dword [0x496c2c], eax
mov dword [esp + 4], str.IsConvertINetStringAvailable
mov dword [esp], ebx
call esi
push ecx
push ecx
mov dword [0x496c28], eax
mov dword [esp + 4], str.LcidToRfc1766A
mov dword [esp], ebx
call esi
push edx
push edx
mov dword [0x496c24], eax
mov dword [esp + 4], str.Rfc1766ToLcidA
mov dword [esp], ebx
call esi
push ecx
push ecx
mov dword [0x496c20], eax
jmp 0x443652
xor edi, edi
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x444020
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.00444080
Function at 0x444080
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x3c
mov eax, dword [0x496fa0]
test eax, eax
jle 0x444183
mov edx, dword [0x496fa4]
xor ebx, ebx
mov ecx, dword [edx + 4]
cmp ecx, esi
ja 0x4440b1
mov edi, dword [edx + 8]
add ecx, dword [edi + 8]
cmp esi, ecx
jb 0x444126
add ebx, 1
add edx, 0xc
cmp ebx, eax
jne 0x4440a0
mov dword [esp], esi
call fcn.00444960
test eax, eax
mov edi, eax
je 0x4441aa
lea esi, [ebx + ebx*2]
mov ebx, dword [0x496fa4]
shl esi, 2
add ebx, esi
mov dword [ebx + 8], eax
mov dword [ebx], 0
call fcn.00444a50
add eax, dword [edi + 0xc]
mov dword [ebx + 4], eax
lea eax, [ebp - 0x34]
mov dword [esp + 4], eax
mov eax, dword [0x496fa4]
mov dword [esp + 8], 0x1c
mov eax, dword [eax + esi + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x44418a
mov eax, dword [ebp - 0x20]
cmp eax, 0x40
jne 0x444130
add dword [0x496fa0], 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 4
je 0x44411f
cmp eax, 0x80
je 0x44411f
cmp eax, 8
je 0x44411f
mov eax, dword [ebp - 0x28]
add esi, dword [0x496fa4]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 0xc], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x44411f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00444020
xor ebx, ebx
jmp 0x4440bb
mov eax, dword [0x496fa4]
mov eax, dword [eax + esi + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00444020
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00444020
lea esi, [esi]

Function at 0x444880
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x4448b8
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x4448ae
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x4448ba
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x4448a0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x444f10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x13c
mov ebx, dword [ebp + 8]
call sub.msvcrt.dll__errno
test ebx, ebx
mov dword [eax], 0
jne 0x444f3e
call sub.msvcrt.dll__errno
mov dword [eax], 0xe
jmp 0x445066
cmp byte [ebx], 0
jne 0x444f45
jmp 0x444f6a
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
push edx
jne 0x444f66
call sub.msvcrt.dll__errno
mov dword [eax], 2
xor ebx, ebx
jmp 0x445066
test al, 0x10
jne 0x444f77
call sub.msvcrt.dll__errno
mov dword [eax], 0x14
jmp 0x444f5f
lea eax, [ebp - 0x11c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0x104
mov dword [esp], eax
mov dword [ebp - 0x12c], eax
call sub.msvcrt.dll__fullpath
mov edi, dword [ebp - 0x12c]
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
add ecx, 0x242
mov dword [esp], ecx
call sub.msvcrt.dll_malloc
test eax, eax
mov ebx, eax
jne 0x444fca
call sub.msvcrt.dll__errno
mov dword [eax], 0xc
jmp 0x445066
lea esi, [eax + 0x23c]
lea eax, [ebp - 0x11c]
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.msvcrt.dll_strcpy
cmp byte [ebx + 0x23c], 0
je 0x445015
xor eax, eax
or ecx, 0xffffffff
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
mov al, byte [ebx + ecx + 0x23a]
cmp al, 0x2f
je 0x445015
cmp al, 0x5c
je 0x445015
mov dword [esp + 4], str._unknown_
mov dword [esp], esi
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0x45d93e
mov dword [esp], esi
call sub.msvcrt.dll_strcat
lea edx, [ebx + 0x130]
mov ecx, 0x41
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebx + 0x234], 0xffffffff
mov dword [ebx + 0x238], 0
mov dword [ebx + 0x128], 0
mov word [ebx + 0x12c], 0
mov word [ebx + 0x12e], 0
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x5ccb2fe2
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
mov ecx, 0x5a0f2271
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219