joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416280
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44a3b0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x460df4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x18], esi
cmp dword [esi + 4], 0
jne 0x416379
xor ebx, ebx
mov ecx, dword [esi + 0xc]
test ecx, ecx
mov dword [ebp - 0x14], ebx
jne 0x4162ca
xor eax, eax
jmp 0x4162d2
mov eax, dword [esi + 0x10]
sub eax, ecx
sar eax, 2
cmp ebx, eax
jge 0x416345
push 8
mov dword [ebp - 4], 0
call fcn.004169f4
add esp, 4
lea ecx, [eax + 4]
push ecx
push 4
push eax
push 0x416070
push 0
push 0
mov dword [eax], esi
call fcn.004342a9
mov edi, eax
add esp, 0x18
test edi, edi
je 0x416325
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x41631a
mov eax, dword [esi + 0x10]
sub eax, ecx
sar eax, 2
cmp ebx, eax
jb 0x41631f
call fcn.0043364c
mov edx, dword [esi + 0xc]
mov dword [edx + ebx*4], edi
mov dword [ebp - 4], 0xffffffff
add ebx, 1
jmp 0x4162bc
mov ebx, dword [esi + 0x10]
cmp ecx, ebx
jbe 0x416351
call fcn.0043364c
mov edi, dword [esi + 0xc]
cmp edi, dword [esi + 0x10]
jbe 0x41635e
call fcn.0043364c
cmp edi, ebx
je 0x416372
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
add edi, 4
cmp edi, ebx
jne 0x416362
mov dword [esi + 4], 1
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x416394
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x10]
sub eax, ecx
sar eax, 2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416790
Capabilities:
Terminate thread

Disassembly:
push ebx
push ebp
push esi
mov ebp, ecx
mov esi, dword [ebp + 0xc]
cmp esi, dword [ebp + 0x10]
push edi
lea edi, [ebp + 8]
jbe 0x4167a6
call fcn.0043364c
mov ebx, dword [edi + 8]
cmp dword [edi + 4], ebx
jbe 0x4167b3
call fcn.0043364c
test edi, edi
je 0x4167bb
cmp edi, edi
je 0x4167c0
call fcn.0043364c
cmp esi, ebx
je 0x416800
push 4
call fcn.004169f4
add esp, 4
test eax, eax
je 0x4167da
mov dword [eax], vtable.DOWNANT::CThreadPool::SuicidePill.0
jmp 0x4167dc
xor eax, eax
push eax
mov ecx, ebp
call fcn.004166b0
test eax, eax
je 0x416800
test edi, edi
jne 0x4167f1
call fcn.0043364c
cmp esi, dword [edi + 8]
jb 0x4167fb
call fcn.0043364c
add esi, 4
jmp 0x4167a6
mov dword [ebp + 4], 0
mov esi, dword [edi + 4]
cmp esi, dword [edi + 8]
jbe 0x416814
call fcn.0043364c
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ebx, [ebx]
mov ebx, dword [edi + 8]
cmp dword [edi + 4], ebx
jbe 0x41682d
call fcn.0043364c
test edi, edi
je 0x416835
cmp edi, edi
je 0x41683a
call fcn.0043364c
cmp esi, ebx
je 0x416896
test edi, edi
jne 0x416847
call fcn.0043364c
cmp esi, dword [edi + 8]
jb 0x416851
call fcn.0043364c
mov eax, dword [esi]
push 0xa
push eax
call ebp
cmp eax, 0x102
jne 0x416874
cmp esi, dword [edi + 8]
jb 0x416869
call fcn.0043364c
mov ecx, dword [esi]
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
cmp esi, dword [edi + 8]
jb 0x41687e
call fcn.0043364c
mov edx, dword [esi]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, dword [edi + 8]
jb 0x416891
call fcn.0043364c
add esi, 4
jmp 0x416820
mov ebx, dword [edi + 8]
cmp dword [edi + 4], ebx
jbe 0x4168a3
call fcn.0043364c
mov esi, dword [edi + 4]
cmp esi, dword [edi + 8]
jbe 0x4168b0
call fcn.0043364c
cmp esi, ebx
je 0x4168d9
mov eax, dword [edi + 8]
sub eax, ebx
sar eax, 2
test eax, eax
lea ecx, [eax*4]
lea ebp, [ecx + esi]
jle 0x4168d6
push ecx
push ebx
push ecx
push esi
call fcn.00432797
add esp, 0x10
mov dword [edi + 8], ebp
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4168e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44a406
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x460df4]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea ecx, [esi + 8]
xor edi, edi
mov dword [esi], vtable.DOWNANT::CThreadPool.0
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
mov dword [ecx + 0xc], edi
mov dword [esp + 0x24], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov eax, dword [esp + 0x2c]
push edi
push eax
mov byte [esp + 0x2c], 1
mov dword [esi + 4], edi
call fcn.004165f0
mov eax, dword [esp + 0x30]
push edi
push eax
push edi
push edi
mov dword [esi + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
cmp eax, edi
mov dword [esi + 0x30], eax
jne 0x41697f
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], str.Cant_Create_QueueAccessSemaphone
call fcn.004333f3
push 0x459d08
lea edx, [esp + 0x14]
push edx
call fcn.004334d8
lea eax, [esi + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
cmp eax, edi
mov dword [esi + 0x4c], eax
jne 0x4169c0
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], str.Cant_Create_QueueNotFullEvent
call fcn.004333f3
push 0x459d08
lea edx, [esp + 0x14]
push edx
call fcn.004334d8
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret 8

Function at 0x41b1b7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x41b1fd
call fcn.0041d0bf
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x41b1fd
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x41b240
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x41b229
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x41b229
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x41b23d
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x420771
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x4207aa
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00418c87
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00418c62
pop esi
ret 4
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
pop esi
jmp dword [eax + 0x8c]

Function at 0x4222cb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x42230e
call fcn.0041d0bf
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x42230e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x422329
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.00421e82
test ebx, ebx
mov esi, eax
je 0x422327
test edi, edi
je 0x422327
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4235ba
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4235e8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x423606
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00423524
jmp 0x423606
mov eax, dword [esi + 0x14]
test eax, eax
je 0x423606
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00423524
test edi, edi
mov eax, edi
jne 0x4235f0
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x464724]
test ecx, ecx
je 0x4236c9
jmp 0x4235b9
ret 8

Function at 0x432bb9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x460df4]
jne 0x432bc3
repz ret
jmp fcn.0043cbdc

Function at 0x434f2d
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x434f5a
call fcn.00435014
mov dword [eax], esi
call fcn.00435001
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00433628
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x434f78
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00435027
pop ecx
jmp 0x434f55
test byte [esp + 0xc], 0x80
je 0x434f84
and eax, 0xfffffffe
jmp 0x434f87
or eax, 1
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x434f69
xor eax, eax
pop esi
ret
Function at 0x435045
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x435072
call fcn.00435014
mov dword [eax], esi
call fcn.00435001
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00433628
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x43504e
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4350a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00435027
pop ecx
call fcn.00435001
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x4350c8
test al, 1
je 0x4350c8
test byte [esp + 0xc], 2
je 0x4350c8
call fcn.00435014
mov dword [eax], 5
call fcn.00435001
mov dword [eax], 0xd
jmp 0x435098
xor eax, eax
pop esi
ret
Function at 0x44592f
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0043b091
xor ebx, ebx
cmp dword [0x4654e0], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x445a04
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x44596f
xor eax, eax
jmp 0x445ac8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x455280
push edi
call esi
cmp eax, ebx
je 0x445968
push eax
call fcn.0043b02e
mov dword [esp], 0x455270
push edi
mov dword [0x4654e0], eax
call esi
push eax
call fcn.0043b02e
mov dword [esp], 0x45525c
push edi
mov dword [0x4654e4], eax
call esi
push eax
call fcn.0043b02e
mov dword [0x4654e8], eax
lea eax, [ebp - 8]
push eax
call fcn.004372ce
test eax, eax
pop ecx
pop ecx
je 0x4459d2
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0043352c
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x445a04
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0043b02e
cmp eax, ebx
pop ecx
mov dword [0x4654f0], eax
je 0x445a04
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0043b02e
pop ecx
mov dword [0x4654ec], eax
mov eax, dword [0x4654ec]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x445a7d
cmp dword [0x4654f0], esi
je 0x445a7d
push eax
call fcn.0043b09a
pop ecx
call eax
cmp eax, ebx
je 0x445a4a
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4654f0]
call fcn.0043b09a
pop ecx
call eax
test eax, eax
je 0x445a4a
test byte [ebp - 0x18], 1
jne 0x445a7d
lea eax, [ebp - 0xc]
push eax
call fcn.00437305
test eax, eax
pop ecx
je 0x445a65
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0043352c
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x445a74
or dword [ebp + 0x10], 0x200000
jmp 0x445aae
or dword [ebp + 0x10], 0x40000
jmp 0x445aae
mov eax, dword [0x4654e4]
cmp eax, esi
je 0x445aae
push eax
call fcn.0043b09a
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x445aae
mov eax, dword [0x4654e8]
cmp eax, esi
je 0x445aae
push dword [ebp - 4]
push eax
call fcn.0043b09a
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x4654e0]
call fcn.0043b09a
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x448de8
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x460df4]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00448d7d
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00432bd0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x448e37
cmp dword [ebp - 0x1c], 5
jb 0x448e4f
jmp 0x448e4b
cmp dword [ebp - 0x10], 1
jne 0x448e4f
cmp dword [ebp - 0x1c], 4
ja 0x448e4b
jne 0x448e4f
cmp dword [ebp - 0x18], 0
jbe 0x448e4f
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x455b2c
call fcn.00448c6e
test eax, eax
jge 0x448e70
mov byte [0x462354], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00432bb9
add ebp, 0x78
leave
ret
Function at 0x40b275
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.0041cec0
push esi
mov esi, dword [ebp + 8]
cmp word [esi], 0
jne 0x40b293
xor al, al
jmp 0x40b3fd
push ebx
push edi
push esi
call fcn.0040b40f
push esi
call fcn.004220b3
pop ecx
push esi
mov edi, eax
call fcn.0040b43b
test al, al
je 0x40b325
push esi
call fcn.0040b40f
test al, al
je 0x40b2dc
lea eax, [edi + 4]
cmp dword [ebp + 0x10], eax
jbe 0x40b3f9
push dword [ebp + 0x10]
push str.__
push dword [ebp + 0xc]
call fcn.0040f10e
push dword [ebp + 0x10]
jmp 0x40b3ec
push 0x5c
pop eax
cmp word [esi], ax
jne 0x40b3f9
lea ebx, [esi + 2]
cmp word [ebx], ax
jne 0x40b3f9
mov esi, dword [ebp + 0x10]
lea eax, [edi + 6]
cmp esi, eax
jbe 0x40b3f9
push esi
push str.__
push dword [ebp + 0xc]
call fcn.0040f10e
push esi
push 0x4305ec
push dword [ebp + 0xc]
call fcn.0040f0e6
push esi
push ebx
jmp 0x40b3ed
lea eax, [ebp - 0x1000]
mov ebx, 0x7ff
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x40b3f9
cmp eax, ebx
ja 0x40b3f9
movzx eax, word [esi]
push eax
call fcn.0040b516
test al, al
je 0x40b38c
lea eax, [edi + 6]
mov edi, dword [ebp + 0x10]
cmp edi, eax
jbe 0x40b3f9
push edi
push str.__
push dword [ebp + 0xc]
call fcn.0040f10e
xor eax, eax
mov word [ebp - 0xffc], ax
lea eax, [ebp - 0x1000]
push edi
push eax
push dword [ebp + 0xc]
call fcn.0040f0e6
jmp 0x40b3eb
push 0x800
lea eax, [ebp - 0x1000]
push eax
call fcn.0040adf5
lea eax, [ebp - 0x1000]
push eax
call fcn.004220b3
add edi, 4
add eax, edi
mov edi, dword [ebp + 0x10]
pop ecx
cmp edi, eax
jbe 0x40b3f9
push edi
push str.__
push dword [ebp + 0xc]
call fcn.0040f10e
push edi
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 0xc]
call fcn.0040f0e6
cmp word [esi], 0x2e
jne 0x40b3eb
movzx eax, word [esi + 2]
push eax
call fcn.0040b516
test al, al
je 0x40b3eb
add esi, 4
push edi
push esi
push dword [ebp + 0xc]
call fcn.0040f0e6
mov al, 1
jmp 0x40b3fb
xor al, al
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40c033
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
push ebx
push esi
mov esi, dword [esp + 0x10]
xor ebx, ebx
inc eax
mov cl, bl
cmp esi, eax
jbe 0x40c050
xor cl, byte [eax + edx]
inc eax
cmp eax, esi
jb 0x40c048
cmp cl, byte [edx]
jne 0x40c08b
push esi
push edx
push 0xffffffffffffffff
call fcn.00405e96
not eax
mov ecx, ebx
cmp dword [ecx + 0x43a02c], eax
jne 0x40c071
cmp dword [ecx + 0x43a028], esi
je 0x40c07c
add ecx, 0xc
inc ebx
cmp ecx, 0x48
jb 0x40c061
jmp 0x40c08b
imul eax, ebx, 0xc
mov ecx, dword [eax + 0x43a030]
mov eax, dword [esp + 0x14]
mov dword [eax], ecx
pop esi
pop ebx
ret 0xc
Function at 0x419410
Capabilities:
Get disk information

Disassembly:
sub esp, 8
mov eax, dword [0x4d1030]
mov edx, dword [0x4d1034]
invalid
inc esp
and al, 4
add byte [eax], al

Function at 0x4c6ecd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4d1398
cmp edx, dword [eax]
je 0x4c6eef
add eax, 8
inc ecx
cmp eax, 0x4d1428
jl 0x4c6ee0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4d1398]
jne 0x4c701d
mov eax, dword [0x4d6dc0]
cmp eax, 1
je 0x4c6ff7
test eax, eax
jne 0x4c6f20
cmp dword [0x4d12c4], 1
je 0x4c6ff7
cmp edx, 0xfc
je 0x4c701d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4c6f57
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004c78b0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004c7d40
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4c6f9a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004c7d40
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4cce24
push edi
call fcn.004c9c10
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004c78b0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004c78c0
lea eax, [ebp - 0xa0]
push 0x4cce04
push eax
call fcn.004c78c0
push dword [esi + 0x4d139c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004c78c0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004c9b84
add esp, 0x2c
pop edi
jmp 0x4c701d
lea eax, [ebp + 8]
lea esi, [esi + 0x4d139c]
push 0
push eax
push dword [esi]
call fcn.004c7d40
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401380
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x404
movsx eax, byte [0x404099]
mov ecx, dword [0x4040bc]
push esi
push edi
push eax
push ecx
mov byte [0x40409a], 0xff
call fcn.004011d0
mov edi, dword [esp + 0x420]
mov dword [0x4040d4], eax
or ecx, 0xffffffff
xor eax, eax
mov word [0x4040a2], 0xffff
mov byte [0x40409a], 1
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov eax, ecx
mov esi, edi
mov edi, edx
mov byte [esp + 0x14], 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov edx, dword [0x4040cc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
movsx ecx, byte [0x4040a0]
or ecx, edx
mov edx, dword [0x4040d0]
push edx
push 0x9a9fffff
mov word [0x4040b2], 0xffff
mov dword [0x4040d4], ecx
call fcn.00401150
add esp, 0x10
mov byte [0x404098], al
lea eax, [esp + 0xc]
push 0
push 0
push 1
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0x17fdffff
push 0x810bffff
mov esi, eax
call fcn.00401040
add esp, 8
cmp esi, 0xffffffff
mov byte [0x40409d], al
jne 0x4014d3
push 0xc8e3ffff
push 0xdd5fffff
call fcn.00401200
movsx cx, byte [0x40409d]
add esp, 8
dec ecx
mov word [0x4040a2], ax
mov word [0x4040a8], cx
call dword [sym.imp.KERNEL32.dll_GetLastError]
movsx edx, word [0x4040a8]
movsx eax, word [0x4040b2]
movsx ecx, byte [0x404099]
and edx, eax
push ecx
mov dword [0x4040b8], edx
movsx edx, word [0x4040ac]
push edx
call fcn.004010d0
mov ecx, dword [0x4040b8]
mov dword [0x4040d0], eax
add esp, 8
xor eax, eax
test ecx, ecx
setne al
mov word [0x4040ae], ax
pop edi
xor al, al
pop esi
add esp, 0x404
ret
movsx ecx, byte [0x404098]
mov edx, dword [0x4040d0]
push 0x3787ffff
add ecx, edx
mov edx, dword [0x4040c8]
push edx
mov dword [0x4040bc], ecx
call fcn.00401000
mov edx, dword [esp + 0x41c]
mov dword [0x4040c4], eax
mov ax, word [0x4040bc]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
add ax, word [0x4040aa]
add esp, 8
lea ecx, [esp + 8]
mov word [0x4040a6], ax
mov eax, dword [esp + 0x410]
push 0
push ecx
push edx
push eax
push esi
call edi
mov ecx, dword [0x4040cc]
push ecx
push 0xe997ffff
call fcn.00401150
mov dx, word [0x4040cc]
add esp, 8
add dx, word [0x4040a4]
mov dword [0x4040c8], eax
lea eax, [esp + 8]
push 0
push eax
lea ecx, [esp + 0x424]
push 4
push ecx
push esi
mov word [0x4040ac], dx
call edi
mov dx, word [0x4040b0]
mov ax, word [0x4040ae]
movsx ecx, byte [0x40409b]
and dx, ax
movsx eax, ax
push eax
push ecx
mov word [0x4040a2], dx
call fcn.00401000
movsx edx, byte [0x40409c]
mov word [0x4040ae], ax
push edx
movsx eax, word [0x4040b0]
push eax
call fcn.00401150
add esp, 0x10
mov byte [0x40409d], al
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movsx ecx, word [0x4040a8]
push 0xa30dffff
push ecx
call fcn.00401090
mov dx, word [0x4040aa]
mov word [0x4040ac], ax
movsx eax, word [0x4040b0]
and word [0x4040a8], dx
push 0x8ca9ffff
push eax
call fcn.00401000
xor ecx, ecx
add esp, 0x10
cmp word [0x4040a6], cx
mov dword [0x4040c0], eax
pop edi
mov al, 1
setne cl
mov dword [0x4040c8], ecx
pop esi
add esp, 0x404
ret
Function at 0xd24a60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [0xd4b010]
push edi
push 0xd549f0
call esi
push 0xd549f0
call esi
push 0xd549f0
call esi
push 0xd549f0
call esi
push 0xd549f0
call esi
mov edi, dword [ebp + 0x10]
lea eax, [edi + 1]
push eax
push 0
call 0x5590393
nop
push eax
nop
call 0x77e45da0
mov ebx, eax
push 0xd549f0
mov dword [ebp - 4], ebx
call esi
push 0xd549f0
call esi
push 0xd549f0
call esi
push 0xd549f0
call esi
push 0xd549f0
call esi
push 0xd549f0
mov byte [ebx + edi], 0
call esi
push 0xd549f0
call esi
push 0xd549f0
call esi
push 0xd549f0
call esi
push 0xd549f0
call esi
xor edi, edi
cmp dword [ebp + 0x10], edi
jbe 0xd24b7a
mov eax, dword [ebp + 8]
sub eax, ebx
mov dword [ebp - 8], eax
push 0xd549f0
call esi
push 0xd549f0
call esi
push 0xd549f0
call esi
push 0xd549f0
call esi
push 0xd549f0
call esi
mov ecx, dword [ebp + 0xc]
push ecx
add ebx, edi
call 0x779397f0
nop
mov ecx, eax
xor edx, edx
mov eax, edi
div ecx
mov eax, dword [ebp + 0xc]
add esp, 4
push 0xd549f0
mov cl, byte [edx + eax]
mov edx, dword [ebp - 8]
xor cl, byte [edx + ebx]
mov byte [ebx], cl
call esi
push 0xd549f0
call esi
push 0xd549f0
call esi
push 0xd549f0
call esi
push 0xd549f0
call esi
mov ebx, dword [ebp - 4]
inc edi
cmp edi, dword [ebp + 0x10]
jb 0xd24b06
push 0xd549f0
call esi
push 0xd549f0
call esi
push 0xd549f0
call esi
push 0xd549f0
call esi
push 0xd549f0
call esi
lea eax, [ebp - 0xc]
push eax
push 0x100
push 4
push ebx
mov dword [ebp - 0xc], 0
call 0x5590399
nop
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xd26ef0
Capabilities:
Parse pe header

Disassembly:
cmp dword [ebx + 4], 0x40
jb 0xd26f91
mov eax, dword [ebx]
push 0x40
push eax
push esi
call 0x77938cf0
nop
mov ecx, 0x5a4d
add esp, 0xc
cmp word [esi], cx
jne 0xd26fc0
mov eax, dword [esi + 0x3c]
test eax, eax
je 0xd26fc0
lea edx, [eax + 0xf8]
cmp edx, dword [ebx + 4]
ja 0xd26f91
mov ecx, dword [ebx]
push edi
push 0xf8
add ecx, eax
push ecx
lea edi, [esi + 0x40]
push edi
nop
call 0x77938cf0
add esp, 0xc
cmp dword [edi], 0x4550
pop edi
jne 0xd26fc0
mov edx, 0x10b
cmp word [esi + 0x58], dx
jne 0xd26fc0
movzx eax, word [esi + 0x46]
test ax, ax
je 0xd26fc0
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
add eax, eax
push eax
push 8
mov dword [esi + 0x140], eax
call dword [fcn.00f590f4]
push eax
call dword [fcn.00f59088]
mov dword [esi + 0x138], eax
test eax, eax
jne 0xd26f97
mov eax, 3
ret
mov eax, 1
ret
movzx ecx, word [esi + 0x54]
mov edx, dword [esi + 0x3c]
lea ecx, [ecx + edx + 0x18]
mov edx, dword [esi + 0x140]
push ebx
push edx
push ecx
push eax
mov dword [esi + 0x13c], ecx
call fcn.00d27590
add esp, 0x10
neg eax
sbb eax, eax
inc eax
ret
mov eax, 2
ret