joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45231c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x457bfc]
cmp dword [eax + 0x30], 0
je 0x4523c6
cmp dword [ebx + 0x94], 0
jne 0x4523c0
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4522ac
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4523c0
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x452386
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4523c0
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00413cd4
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x452395
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x452ea4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x452ed9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004045b8
jmp 0x452ee6
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040451c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x453ef4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x453f35
mov eax, esi
call fcn.0043a624
test al, al
je 0x453f35
mov eax, dword [ebx + 0x84]
call fcn.0043a320
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x453f35
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043a320
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x401302
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cmp dword [0x402020], 0
jne 0x401448
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0xc]
xor eax, eax
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x401369
mov ebx, dword [edx + 0x3c]
mov ebx, dword [edx + ebx + 0x78]
test ebx, ebx
je 0x401363
lea eax, [edx + ebx]
mov esi, dword [eax + 0xc]
add esi, edx
mov ebx, dword [esi]
or ebx, 0x20202020
cmp ebx, 0x6c64746e
jne 0x401363
mov ebx, dword [esi + 4]
or ebx, 0x20202020
cmp ebx, 0x6c642e6c
je 0x401372
mov ecx, dword [ecx]
mov edi, edx
jmp 0x401328
test eax, eax
jne 0x401374
jmp 0x40143e
mov edi, edx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x1c]
mov dword [0x55c014], edi
xor ebx, ebx
mov esi, dword [eax + 0x18]
add ecx, edi
add edx, edi
mov dword [ebp - 0x1c], ecx
mov ecx, dword [eax + 0x24]
dec esi
add ecx, edi
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx + esi*4]
add eax, edi
cmp word [eax], 0x775a
jne 0x4013dc
lea ecx, [ebx*8 + 0x402024]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], ecx
mov dword [esp], eax
call fcn.004012df
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [ebx*8 + 0x402024], eax
mov eax, dword [ebp - 0x20]
inc ebx
movzx eax, word [eax + esi*2]
mov eax, dword [edx + eax*4]
mov dword [ecx + 4], eax
cmp ebx, 0x1f4
je 0x4013e7
lea eax, [esi - 1]
test esi, esi
je 0x4013e7
mov esi, eax
jmp 0x401395
mov dword [0x402020], ebx
dec ebx
test ebx, ebx
jne 0x4013f9
mov edx, 1
jmp 0x40143e
xor eax, eax
mov edx, dword [eax*8 + 0x402028]
inc eax
mov ecx, dword [eax*8 + 0x402028]
cmp ecx, edx
jae 0x401438
mov esi, dword [eax*8 + 0x40201c]
mov edi, dword [eax*8 + 0x402024]
mov dword [eax*8 + 0x402020], ecx
mov dword [eax*8 + 0x402028], edx
mov dword [eax*8 + 0x40201c], edi
mov dword [eax*8 + 0x402024], esi
cmp eax, ebx
jb 0x4013fb
jmp 0x4013ed
add esp, 0x2c
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 1
ret
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x6eb842
Capabilities:
Encode data using xor

Disassembly:
xor eax, dword [esp + 0xc]
add bl, 0x97
pop ecx
and bh, 0x95
or bh, ah
pop ebx
xor eax, 0x51141a77
jne 0x6eb85b
sub ecx, 0xffffffef
not esi
add esp, 8
sbb esi, esp
not eax
push dword [ecx + 2]
pop edi
add edx, edx
add edi, ebx
nop
add edx, ebx
mov esi, dword [ecx + 0xa]
jmp 0x6eb58b
mov ax, word [edx + esi]
shl eax, 0x10
shr eax, 0xe
push dword [eax + edi]
add dword [esp], ebx
inc edx
mov eax, dword [esp - 4]
pop esi
jmp eax
ret
lea ecx, [ebx + 9]
push 0xffffffffffffffff
push dword [ecx + 0x33]
pop edx
add ah, 0x15
sub al, 6
add ecx, dword [edx + ebx + 0x78]
pop edx
sub ah, 0xc1
mov edi, dword [ecx + 0x17]
mov eax, dword [edi + ebx]
inc edx
add edi, 4
dec esi
lea esi, [eax + ebx - 3]
cmp edx, dword [ecx + 0xf]
mov eax, 0x9c9a01e7
xchg al, al
jae 0x6eb5bc
push ebx
xor eax, eax
push ecx
wait
imul eax, eax, 0xf
movzx ecx, byte [esi + 3]
lea ebx, [esi - 0xe793e15]
sub eax, ecx
sub esi, 0xffffffee
xor bl, bh
lea ebx, [ebx + edx*8 - 0x49]
lea esi, [esi - 0x11]
nop
cmp byte [esi + 3], 0xa
xchg bh, bl
jae 0x6eb87c
mov bh, dl
stc
nop
jmp 0x6eb553
Function at 0x1000e391
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov ebx, 0x149
mov dword [0x10016d44], 0
mov dword [0x10016d48], 0
mov dword [0x10016d50], 0
mov dword [0x10016d3c], 0x54d
mov dword [0x10016d40], 0x149
cmp eax, 0
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov eax, edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], edi
je 0x1000e502
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x14]
mov edi, 0x100
add ecx, 1
mov dword [ebp - 0x30], eax
mov eax, ecx
mov dword [ebp - 0x34], edx
cdq
idiv edi
mov dword [0x10016d44], edx
mov ecx, dword [ebp - 0x34]
add ecx, 0xffffff3b
mov dword [0x10016d3c], ecx
mov ecx, dword [ebp - 0x24]
movzx ebx, byte [ecx + edx]
add ebx, esi
mov eax, ebx
mov dword [ebp - 0x38], edx
cdq
idiv edi
mov dword [0x10016d48], edx
mov esi, dword [ebp - 0x34]
add esi, 0x2bc
mov dword [0x10016d3c], esi
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x10016d4c], cl
mov edi, dword [ebp - 0x34]
add edi, 0xffffecdd
mov dword [0x10016d40], edi
mov edi, dword [ebp - 0x24]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x10016d4c]
mov edx, dword [0x10016d48]
mov byte [edi + edx], cl
mov edx, dword [0x10016d44]
movzx edx, byte [edi + edx]
mov ebx, dword [0x10016d48]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x10016d50], ebx
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x30]
mov cl, byte [edx + ecx]
xor cl, byte [edi + ebx]
mov ebx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x30]
mov byte [ebx + edx], cl
add edx, 1
mov ecx, dword [ebp - 0x10]
cmp edx, ecx
mov dword [ebp - 0x3c], edx
je 0x1000e502
mov eax, dword [0x10016d44]
mov ecx, dword [0x10016d40]
mov edx, dword [0x10016d48]
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x2c], esi
jmp 0x1000e406
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000e50a
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10016d40]
add eax, 0x1700
mov dword [0x10016d3c], eax
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
je 0x1000e5e0
jmp 0x1000e5b1
mov dword [0x10016d3c], 0x882
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x20], eax
je 0x1000e67d
jmp 0x1000e666
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff4
mov dword [0x10016d3c], 0x2137
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x24]
cmp word [eax + ecx*2], 0x6f
je 0x1000e5f4
jmp 0x1000e666
mov eax, dword [ebp - 0x14]
add eax, 1
cmp eax, 0x104
setl cl
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x29], cl
mov al, byte [ebp - 0x29]
test al, 1
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], edx
jne 0x1000e543
jmp 0x1000e5e0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x1c], eax
je 0x1000e589
jmp 0x1000e666
mov dword [0x10016d3c], 0x949
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x1000e666
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff6
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x30]
cmp word [eax + ecx*2], 0x64
jne 0x1000e666
mov dword [0x10016d3c], 0x1996
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x1000e666
mov dword [0x10016d3c], 0x1a94
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
mov dx, word [eax + ecx*2 - 0x10]
mov word [ebp - 0x32], dx
mov ax, word [ebp - 0x32]
cmp ax, 0x6c
je 0x1000e55f
xor eax, eax
mov ecx, dword [0x10016d40]
add ecx, 0x109a
mov dword [0x10016d3c], ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
add esp, 0x34
pop ebp
ret
Function at 0x1000e909
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x10016d48], 0
mov dword [0x10016d3c], 0x25ca
mov byte [0x10016d4c], 0
mov dword [0x10016d44], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x10016d3c], 0x262f
mov eax, dword [0x10016d44]
add eax, 1
mov dword [0x10016d44], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1000e94e
xor eax, eax
mov dword [0x10016d44], 0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [ebp - 0x24], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov dword [0x10016d40], 0xfde
mov edi, dword [0x10016d48]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov eax, esi
cdq
idiv ecx
mov dword [0x10016d48], edx
mov dword [0x10016d40], 0xeda
mov ecx, dword [ebp - 0x24]
mov cl, byte [ebx + ecx]
mov byte [0x10016d4c], cl
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x24]
mov byte [ebx + edx], cl
mov cl, byte [0x10016d4c]
mov esi, dword [0x10016d48]
mov byte [ebx + esi], cl
mov dword [0x10016d3c], 0x1c74
mov esi, dword [0x10016d44]
add esi, 1
mov dword [0x10016d44], esi
cmp esi, 0x100
mov dword [ebp - 0x20], esi
jl 0x1000e98d
mov dword [0x10016d40], 0x1255
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000eaef
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
call fcn.1000e685
xor ecx, ecx
mov dword [0x10016d3c], 0x198d
mov edx, eax
mov esi, dword [eax + 0x3c]
mov dword [0x10016d40], 0x102
mov esi, dword [eax + esi + 0x78]
mov dword [0x10016d40], 0x29dd
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov dword [0x10016d3c], 0x1f1d
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ecx
je 0x1000ec37
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], eax
jmp 0x1000ebc2
xor eax, eax
mov ecx, dword [ebp - 0x30]
add ecx, 2
mov edx, dword [ebp - 0x34]
add edx, 1
mov esi, dword [ebp - 0x18]
cmp edx, esi
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], eax
jb 0x1000ebc2
jmp 0x1000ec37
mov eax, dword [ebp - 0x38]
mov ecx, eax
mov edx, dword [ebp - 0x3c]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x41], bh
mov byte [ebp - 0x42], cl
je 0x1000ec06
jmp 0x1000ebde
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov esi, dword [ebp - 0x14]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edx
jmp 0x1000eb97
mov eax, dword [ebp - 0x40]
add eax, 1
mov cl, byte [ebp - 0x41]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x42]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x38], eax
jne 0x1000eb97
mov al, byte [ebp - 0x42]
test al, 1
jne 0x1000ec12
jmp 0x1000eb6e
mov eax, dword [ebp - 0x30]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x1c]
mov ecx, dword [edx + ecx*4]
mov dword [0x10016d3c], 0x2880
mov edx, dword [ebp - 0x1c]
add edx, ecx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000eec9
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x28]
lea ecx, [esp + 0x38]
mov dword [0x10016d3c], 0x19be
mov dword [esp], eax
mov dword [esp + 0x24], ecx
call fcn.1000f5a7
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x50], ecx
mov dword [esp + 0x88], 0x123e00
mov ecx, dword [0x10016d28]
mov dword [esp + 0x84], ecx
mov ecx, dword [0x10016d2c]
mov dword [esp + 0x68], ecx
mov ecx, dword [0x10016d30]
mov dword [esp + 0x8c], ecx
mov ecx, dword [0x10016d34]
mov dword [esp + 0x38], ecx
mov ecx, dword [0x10016d38]
mov dword [esp + 0x6c], ecx
mov dword [0x10016d40], 0x26bb
mov dword [0x10016d3c], 0xa27
mov dword [esp + 0x20], eax
lea eax, [0x1000e7d1]
mov dword [esp + 0x1c], eax
jmp 0x1000efb4
lea eax, [esp + 0x38]
mov dword [0x10016d40], 0x10a4
mov ecx, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.1000f43d
mov ecx, dword [0x10016d3c]
add ecx, 0xc07
mov dword [0x10016d3c], ecx
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [0x10016d3c], 0x1087
mov dword [esp + 0x18], eax
jmp 0x1000f032
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0x14], eax
jne 0x1000efe0
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x3c]
mov edx, dword [eax + ecx]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
cmp eax, 0x4550
je 0x1000eff4
mov eax, dword [esp + 0x14]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x1c], eax
jmp 0x1000efb4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x78], eax
mov dword [0x10016d3c], 0xaa5
mov dword [0x10016d40], 0x102
mov ecx, dword [esp + 0x10]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x7c], edx
call fcn.1000e50a
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x18], ecx
je 0x1000ef62
mov eax, dword [esp + 0x18]
mov esp, ebp
pop ebp
ret
Function at 0x1000f43d
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [0x10016d3c], 0x11ee
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
xor eax, eax
mov dword [0x10016d40], 0x18a3
mov dword [ebp - 0x2c], eax
jmp 0x1000f4a7
lea eax, [ebp - 0x20]
mov dword [0x10016d3c], 0x13b0
mov dword [ebp - 0x30], eax
call fcn.1000f19e
mov dword [esp], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
call fcn.1000f2ba
mov dword [ebp - 0x34], eax
xor eax, eax
mov ecx, dword [ebp - 0x34]
cmp ecx, 0
mov dword [ebp - 0x38], eax
je 0x1000f584
jmp 0x1000f4cf
mov eax, dword [ebp - 0x2c]
mov cl, byte [eax + 0x100101c8]
mov dl, byte [eax + 0x10010199]
sub dl, cl
mov byte [ebp + eax - 0x20], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x2c], eax
je 0x1000f46a
jmp 0x1000f4a7
mov eax, dword [ebp - 0x34]
mov dword [0x10016d3c], 0xf37
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x10016d3c], 0x488
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
mov ecx, dword [ebp - 0x24]
mov dword [esp + 4], ecx
call fcn.1000ecea
xor eax, eax
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov dword [0x10016d40], 0x3137
mov edx, dword [ebp - 0x28]
mov dword [edx + 0x1c], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [edx + 8], ecx
mov dword [0x10016d3c], 0x25d3
cmp ecx, 0
mov dword [ebp - 0x38], eax
je 0x1000f584
mov eax, dword [0x10016d40]
mov ecx, dword [ebp - 0x3c]
add ecx, 0x209e
add eax, 0x1ce9
mov dword [0x10016d3c], eax
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
add esp, 0x4c
pop ebp
ret
Function at 0x4013fc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
test esi, esi
jbe 0x401429
test cl, 7
je 0x401429
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x420140]
dec esi
inc ecx
jmp 0x40140a
cmp esi, 8
jb 0x4014cc
mov edx, esi
shr edx, 3
mov dword [ebp + 8], edx
push ebx
mov edx, dword [ecx + 4]
xor eax, dword [ecx]
mov ebx, edx
shr ebx, 0x10
movzx edi, bl
mov edi, dword [edi*4 + 0x420540]
mov ebx, edx
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x420140]
mov ebx, edx
shr ebx, 8
movzx ebx, bl
xor edi, dword [ebx*4 + 0x420940]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x421140]
mov ebx, eax
shr ebx, 0x10
movzx ebx, bl
xor edi, dword [ebx*4 + 0x421540]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edi, dword [ebx*4 + 0x421940]
movzx edx, dl
xor edi, dword [edx*4 + 0x420d40]
movzx eax, al
xor edi, dword [eax*4 + 0x421d40]
sub esi, 8
add ecx, 8
dec dword [ebp + 8]
mov eax, edi
jne 0x40143b
pop ebx
jmp 0x4014cc
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x420140]
dec esi
inc ecx
test esi, esi
ja 0x4014b8
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x40156d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.0040d480
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x4015e3
push esi
push dword [ebp + 8]
call fcn.0040d40a
pop ecx
push dword [ebp + 8]
mov esi, eax
call fcn.00406524
test al, al
jne 0x4015c0
lea eax, [ebp - 0x1000]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x1000]
push eax
call fcn.0040d40a
pop ecx
lea esi, [esi + eax + 1]
mov eax, 0x104
cmp esi, eax
pop esi
jbe 0x4015e3
push eax
push 0xc3
call fcn.00408386
push eax
push 0x41a3a0
call fcn.0040994d
add esp, 0xc
leave
ret 4
Function at 0x4032e5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
cmp dword [ebp + 0xc], ebx
je 0x4033df
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x403314
dec eax
je 0x403309
dec eax
jne 0x403314
push 0xfffffffffffffff4
jmp 0x40330b
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
push edi
mov dword [ebp - 4], ebx
cmp dword [esi + 0xc], ebx
je 0x40335f
xor edi, edi
cmp dword [ebp + 0xc], ebx
jbe 0x40337e
mov eax, dword [ebp + 0xc]
sub eax, edi
mov ecx, 0x4000
cmp eax, ecx
jb 0x403334
mov eax, ecx
push ebx
lea ecx, [ebp - 4]
push ecx
push eax
mov eax, dword [ebp + 8]
add eax, edi
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
dec eax
neg eax
sbb al, al
inc al
je 0x40337e
add edi, 0x4000
cmp edi, dword [ebp + 0xc]
jb 0x403324
jmp 0x40337a
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
dec eax
neg eax
sbb al, al
inc al
cmp al, bl
jne 0x4033da
cmp byte [esi + 0x14], bl
je 0x4033da
cmp dword [esi + 0xc], ebx
jne 0x4033da
push ebx
lea eax, [esi + 0x1e]
mov edi, 0x43f61c
push eax
mov ecx, edi
call fcn.004016c5
test al, al
je 0x4033ce
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jae 0x403315
cmp eax, ebx
jbe 0x403315
mov edi, dword [esi]
push ebx
mov ecx, esi
call dword [edi + 0xc]
mov ecx, dword [ebp - 4]
xor ebx, ebx
sub eax, ecx
sbb edx, ebx
push edx
push eax
mov ecx, esi
call dword [edi + 8]
jmp 0x403315
lea eax, [esi + 0x1e]
push eax
push ebx
mov ecx, edi
call fcn.0040182d
mov byte [esi + 8], 1
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4034e8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0xc], 1
push edi
mov edi, 0x4e20
jne 0x40350f
cmp dword [ebp + 0xc], edi
jbe 0x403504
mov dword [ebp + 0xc], edi
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x403578
mov ecx, esi
call fcn.00403476
test al, al
je 0x403545
cmp dword [ebp + 0xc], edi
jbe 0x403545
push edi
push dword [ebp + 8]
mov ecx, esi
call fcn.004034e8
jmp 0x40357b
cmp dword [esi + 0xc], 1
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x40355c
call ebx
cmp eax, 0x6d
jne 0x40355c
xor eax, eax
jmp 0x40357b
cmp dword [esi + 0xc], 0
jne 0x403573
mov edi, 0x8000
cmp dword [ebp + 0xc], edi
jbe 0x403573
call ebx
cmp eax, 0x21
je 0x403538
or eax, 0xffffffff
jmp 0x40357b
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8