joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ff30
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x47e1f3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00472007
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.0047769d
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.00478bb9
test eax, eax
je 0x44004c
mov ecx, dword [esp + 0x3c]
call fcn.004776ca
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x440010
push edi
mov ecx, esi
call fcn.00474d33
mov ecx, esi
call fcn.004401b0
cmp dword [esp + 0x38], 1
jne 0x440045
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.00474e6e
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x442a80
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x442ab3
push esi
call fcn.00450dd0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x442aac
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x442b39
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x442b22
mov eax, dword [esi + 8]
test eax, eax
je 0x442ad7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x442b1e
cmp eax, 2
je 0x442b22
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x442aca
cmp eax, 3
je 0x442afd
cmp eax, 1
jne 0x442aca
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x442aca
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x442aca
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00442b60
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x442b48
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00442b60
add esp, 4
pop esi
ret

Function at 0x4433e0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x443401
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x443401
mov eax, dword [eax + 0x44]
test eax, eax
je 0x443401
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x472dfd
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x472e35
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00470eb1
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00470e89
jmp 0x472e41
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4744eb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x47452d
call fcn.00479fa4
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
cmp eax, edi
je 0x47452d
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
cmp eax, edi
jne 0x474524
xor eax, eax
jmp 0x474535
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0047453b
pop edi
pop esi
pop ebx
ret 4
Function at 0x47a4d4
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x47a502
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
test eax, eax
je 0x47a520
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0047a43a
jmp 0x47a520
mov eax, dword [esi + 0x14]
test eax, eax
je 0x47a520
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0047a43a
test edi, edi
mov eax, edi
jne 0x47a50a
pop edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4022f0
Capabilities:
Manipulate console buffer

Disassembly:
sub esp, 0x1c
mov eax, dword [0x4f6e34]
xor eax, esp
mov dword [esp + 0x18], eax
cmp dword [0x514c20], 0x434f4e53
jne 0x402368
cmp dword [0x515468], 3
je 0x40234e
mov eax, dword [0x514c28]
test eax, eax
je 0x402325
push eax
call fcn.0046b1a0
add esp, 4
lea eax, [esp]
push eax
push dword [0x514c34]
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx edx, word [esp + 6]
sub edx, dword [esp + 0x20]
shl edx, 0x10
push edx
push dword [0x514c34]
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x18], 0
xor ecx, esp
cmp ecx, dword [0x4f6e34]
jne 0x402382
add esp, 0x1c
ret
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x18], 0
xor ecx, esp
cmp ecx, dword [0x4f6e34]
jne 0x402382
add esp, 0x1c
ret
call fcn.00466f40
nop word [eax + eax]
Function at 0x4055c0
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
push ebx
push ebp
sub esp, 0x1c
mov edx, dword [esp + 0x40]
mov esi, dword [esp + 0x30]
push esi
push 4
push 1
push str.RIFF
lea eax, [edx + 7]
sar eax, 2
shr eax, 0x1d
lea ebp, [eax + edx + 7]
sar ebp, 3
call fcn.0046b769
mov edx, dword [esp + 0x44]
lea edi, [esp + 0x10]
lea eax, [edx + 0x24]
mov byte [edi], al
mov ecx, eax
mov ebx, eax
shr ecx, 8
shr ebx, 0x10
shr eax, 0x18
mov byte [edi + 1], cl
mov byte [edi + 2], bl
mov byte [edi + 3], al
push esi
push 4
push 1
push edi
call fcn.0046b769
push esi
push 4
push 2
push str.WAVEfmt
call fcn.0046b769
xor eax, eax
lea edx, [esp + 0x34]
mov byte [edx], 0x10
mov byte [edx + 1], al
mov byte [edx + 2], al
mov byte [edx + 3], al
push esi
push 4
push 1
push edx
call fcn.0046b769
mov eax, 1
lea edx, [esp + 0x54]
mov byte [edx], al
mov byte [edx + 1], 0
push esi
push 2
push eax
push edx
call fcn.0046b769
mov eax, dword [esp + 0x8c]
lea edx, [esp + 0x66]
mov byte [edx], al
shr eax, 8
mov byte [edx + 1], al
push esi
push 2
push 1
push edx
call fcn.0046b769
mov ebx, dword [esp + 0x98]
mov eax, ebx
mov edx, ebx
mov ecx, ebx
shr eax, 8
lea edi, [esp + 0x68]
shr edx, 0x10
shr ecx, 0x18
mov byte [edi], bl
mov byte [edi + 1], al
mov byte [edi + 2], dl
mov byte [edi + 3], cl
push esi
push 4
push 1
push edi
call fcn.0046b769
add esp, 0x70
imul ebx, dword [esp + 0x3c]
lea ecx, [esp + 0xc]
imul ebx, ebp
mov eax, ebx
mov edx, ebx
mov byte [ecx], bl
shr eax, 8
shr edx, 0x10
shr ebx, 0x18
mov byte [ecx + 1], al
mov byte [ecx + 2], dl
mov byte [ecx + 3], bl
push esi
push 4
push 1
push ecx
call fcn.0046b769
mov eax, dword [esp + 0x4c]
lea edx, [esp + 0x28]
imul eax, ebp
mov byte [edx], al
shr eax, 8
mov byte [edx + 1], al
push esi
push 2
push 1
push edx
call fcn.0046b769
mov eax, dword [esp + 0x60]
lea edx, [esp + 0x3a]
mov byte [edx], al
shr eax, 8
mov byte [edx + 1], al
push esi
push 2
push 1
push edx
call fcn.0046b769
push esi
push 4
push 1
push str.data
call fcn.0046b769
mov ecx, dword [esp + 0x74]
mov eax, ecx
mov edx, ecx
lea ebx, [esp + 0x50]
mov byte [ebx], cl
shr eax, 8
shr edx, 0x10
shr ecx, 0x18
mov byte [ebx + 1], al
mov byte [ebx + 2], dl
mov byte [ebx + 3], cl
push esi
push 4
push 1
push ebx
call fcn.0046b769
push esi
call fcn.0046b506
xor edx, edx
cmp edx, eax
sbb edx, 0
mov eax, edx
add esp, 0x70
pop ebp
pop ebx
pop edi
pop esi
ret
Function at 0x406b50
Capabilities:
Read file on windows

Disassembly:
push esi
push ebx
mov eax, 0x1038
call fcn.00466f60
mov eax, dword [0x4f6e34]
mov ebx, dword [esp + 0x1044]
xor eax, esp
mov esi, dword [esp + 0x1048]
mov dword [esp + 0x1034], eax
push ebx
call fcn.0046c8cc
mov edx, eax
lea eax, [esp + 0x1008]
push eax
push edx
call fcn.0046c63a
add esp, 0xc
test eax, eax
jne 0x406c11
movzx eax, word [esp + 0x100a]
test eax, 0x1000
je 0x406c11
test esi, esi
jl 0x406ce3
jle 0x406be6
mov dword [esp], edi
lea eax, [esp + 4]
mov edi, ebx
mov ebx, eax
mov edx, 0x1000
cmp esi, 0x1000
push edi
cmovbe edx, esi
push edx
push 1
push ebx
call fcn.0046b3d5
add esp, 0x10
cmp eax, 1
jb 0x406cb6
sub esi, eax
test esi, esi
jg 0x406bb9
mov edi, dword [esp]
mov ecx, dword [esp + 0x1034]
mov dword [esp + 0x1034], 0
xor ecx, esp
cmp ecx, dword [0x4f6e34]
jne 0x406cb1
xor eax, eax
add esp, 0x1038
pop ebx
pop esi
ret
push 1
push esi
push ebx
call fcn.0046bfdd
add esp, 0xc
test eax, eax
je 0x406c8a
test esi, esi
jl 0x406d22
jle 0x406c63
mov dword [esp], edi
lea eax, [esp + 4]
mov edi, ebx
mov ebx, eax
mov edx, 0x1000
cmp esi, 0x1000
push edi
cmovbe edx, esi
push edx
push 1
push ebx
call fcn.0046b3d5
add esp, 0x10
cmp eax, 1
jb 0x406d01
sub esi, eax
test esi, esi
jg 0x406c36
mov edi, dword [esp]
mov ecx, dword [esp + 0x1034]
mov dword [esp + 0x1034], 0
xor ecx, esp
cmp ecx, dword [0x4f6e34]
jne 0x406cb1
xor eax, eax
add esp, 0x1038
pop ebx
pop esi
ret
mov ecx, dword [esp + 0x1034]
mov dword [esp + 0x1034], 0
xor ecx, esp
cmp ecx, dword [0x4f6e34]
jne 0x406cb1
xor eax, eax
add esp, 0x1038
pop ebx
pop esi
ret
call fcn.00466f40
mov ecx, dword [esp + 0x1034]
mov dword [esp + 0x1034], 0
xor ecx, esp
mov edi, dword [esp]
cmp ecx, dword [0x4f6e34]
jne 0x406cb1
mov eax, 0xffffffff
add esp, 0x1038
pop ebx
pop esi
ret
mov ecx, dword [esp + 0x1034]
mov dword [esp + 0x1034], 0
xor ecx, esp
cmp ecx, dword [0x4f6e34]
jne 0x406cb1
jmp 0x406cd5
mov ecx, dword [esp + 0x1034]
mov dword [esp + 0x1034], 0
xor ecx, esp
mov edi, dword [esp]
cmp ecx, dword [0x4f6e34]
jne 0x406cb1
jmp 0x406cd5
cmp dword [0x4f8e08], 0xa
jl 0x406d4d
mov ecx, dword [esp + 0x1034]
mov dword [esp + 0x1034], 0
xor ecx, esp
cmp ecx, dword [0x4f6e34]
jne 0x406cb1
jmp 0x406cd5
push str.fskip_problem:_Mostly_the_return_status_of_functions_is_not_evaluated__so_it_is_more_secure_to_pollute__stderr_._n
call fcn.004023b0
add esp, 4
jmp 0x406d2b
Function at 0x406d60
Capabilities:
Read file on windows

Disassembly:
push ebx
mov eax, 0x103c
call fcn.00466f60
mov eax, dword [0x4f6e34]
mov ebx, dword [esp + 0x1044]
xor eax, esp
mov dword [esp + 0x1038], eax
push ebx
call fcn.0046c8cc
mov edx, eax
lea eax, [esp + 0x100c]
push eax
push edx
call fcn.0046c63a
add esp, 0xc
test eax, eax
jne 0x406e21
movzx eax, word [esp + 0x100e]
test eax, 0x1000
je 0x406e21
mov edx, 0x7fffffff
lea eax, [esp + 8]
mov dword [esp + 4], esi
mov esi, ebx
mov dword [esp], edi
mov ebx, eax
mov edi, edx
mov ecx, 0x1000
cmp edi, 0x1000
push esi
cmovbe ecx, edi
push ecx
push 1
push ebx
call fcn.0046b3d5
add esp, 0x10
cmp eax, 1
jb 0x406ec9
sub edi, eax
test edi, edi
jg 0x406dc6
mov ecx, dword [esp + 0x1038]
mov dword [esp + 0x1038], 0
xor ecx, esp
mov esi, dword [esp + 4]
mov edi, dword [esp]
cmp ecx, dword [0x4f6e34]
jne 0x406ec4
xor eax, eax
add esp, 0x103c
pop ebx
ret
push 1
push 0x7fffffff
push ebx
call fcn.0046bfdd
add esp, 0xc
test eax, eax
jne 0x406e5b
mov ecx, dword [esp + 0x1038]
mov dword [esp + 0x1038], 0
xor ecx, esp
cmp ecx, dword [0x4f6e34]
jne 0x406ec4
xor eax, eax
add esp, 0x103c
pop ebx
ret
mov edx, 0x7fffffff
lea eax, [esp + 8]
mov dword [esp + 4], esi
mov esi, ebx
mov dword [esp], edi
mov ebx, eax
mov edi, edx
mov ecx, 0x1000
cmp edi, 0x1000
push esi
cmovbe ecx, edi
push ecx
push 1
push ebx
call fcn.0046b3d5
add esp, 0x10
cmp eax, 1
jb 0x406ef9
sub edi, eax
test edi, edi
jg 0x406e71
mov ecx, dword [esp + 0x1038]
mov dword [esp + 0x1038], 0
xor ecx, esp
mov esi, dword [esp + 4]
mov edi, dword [esp]
cmp ecx, dword [0x4f6e34]
jne 0x406ec4
xor eax, eax
add esp, 0x103c
pop ebx
ret
call fcn.00466f40
mov ecx, dword [esp + 0x1038]
mov dword [esp + 0x1038], 0
xor ecx, esp
mov esi, dword [esp + 4]
mov edi, dword [esp]
cmp ecx, dword [0x4f6e34]
jne 0x406ec4
mov eax, 0xffffffff
add esp, 0x103c
pop ebx
ret
mov ecx, dword [esp + 0x1038]
mov dword [esp + 0x1038], 0
xor ecx, esp
mov esi, dword [esp + 4]
mov edi, dword [esp]
cmp ecx, dword [0x4f6e34]
jne 0x406ec4
jmp 0x406eec
Function at 0x41c160
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
sub esp, 8
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jle 0x41c208
mov edx, dword [esp + 0x14]
mov ebx, ecx
shr ebx, 1
movzx eax, word [edx]
je 0x41c20e
mov dword [esp], esi
xor ebp, ebp
mov dword [esp + 4], edi
mov ecx, dword [esp + 0x18]
nop
movzx edi, ax
movzx esi, byte [ecx + ebp*2]
mov eax, edi
xor edi, esi
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x48acc0]
mov word [edx], ax
movzx edi, ax
movzx esi, byte [ecx + ebp*2 + 1]
mov eax, edi
xor edi, esi
inc ebp
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x48acc0]
mov word [edx], ax
cmp ebp, ebx
jb 0x41c190
mov ecx, dword [esp + 0x1c]
lea ebx, [ebp + ebp + 1]
mov esi, dword [esp]
mov edi, dword [esp + 4]
lea ebp, [ebx - 1]
cmp ebp, ecx
jae 0x41c208
mov ebp, dword [esp + 0x18]
movzx ecx, ax
mov eax, ecx
movzx ebx, byte [ebp + ebx - 1]
xor ecx, ebx
movzx ecx, cl
shr eax, 8
xor eax, dword [ecx*4 + 0x48acc0]
mov word [edx], ax
add esp, 8
pop ebp
pop ebx
ret
mov ebx, 1
jmp 0x41c1e1
Function at 0x423dc8
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push ebx
push esi
mov edi, eax
movzx ebx, byte [edx + 2]
mov eax, ebx
shl eax, 9
mov esi, ebx
xor eax, 0xfffffffe
mov ecx, 0x2fff6
test eax, 0x10000
mov eax, 0x3fffc
cmovne eax, ecx
shl esi, 0xa
mov ecx, eax
xor esi, eax
xor ecx, 0x8005
test esi, 0x10000
mov esi, ebx
cmovne eax, ecx
shl esi, 0xb
add eax, eax
mov ecx, eax
xor esi, eax
xor ecx, 0x8005
test esi, 0x10000
mov esi, ebx
cmovne eax, ecx
shl esi, 0xc
add eax, eax
mov ecx, eax
xor esi, eax
xor ecx, 0x8005
test esi, 0x10000
mov esi, ebx
cmovne eax, ecx
shl esi, 0xd
add eax, eax
mov ecx, eax
xor esi, eax
xor ecx, 0x8005
test esi, 0x10000
mov esi, ebx
cmovne eax, ecx
shl esi, 0xe
add eax, eax
mov ecx, eax
xor esi, eax
xor ecx, 0x8005
test esi, 0x10000
mov esi, ebx
cmovne eax, ecx
shl esi, 0xf
add eax, eax
mov ecx, eax
xor esi, eax
xor ecx, 0x8005
test esi, 0x10000
cmovne eax, ecx
shl ebx, 0x10
add eax, eax
mov esi, eax
xor ebx, eax
xor esi, 0x8005
test ebx, 0x10000
movzx ecx, byte [edx + 3]
mov ebx, ecx
cmovne eax, esi
shl ebx, 9
add eax, eax
mov esi, eax
xor ebx, eax
xor esi, 0x8005
test ebx, 0x10000
mov ebx, ecx
cmovne eax, esi
shl ebx, 0xa
add eax, eax
mov esi, eax
xor ebx, eax
xor esi, 0x8005
test ebx, 0x10000
mov ebx, ecx
cmovne eax, esi
shl ebx, 0xb
add eax, eax
mov esi, eax
xor ebx, eax
xor esi, 0x8005
test ebx, 0x10000
mov ebx, ecx
cmovne eax, esi
shl ebx, 0xc
add eax, eax
mov esi, eax
xor ebx, eax
xor esi, 0x8005
test ebx, 0x10000
mov ebx, ecx
cmovne eax, esi
shl ebx, 0xd
add eax, eax
mov esi, eax
xor ebx, eax
xor esi, 0x8005
test ebx, 0x10000
mov ebx, ecx
cmovne eax, esi
shl ebx, 0xe
add eax, eax
mov esi, eax
xor ebx, eax
xor esi, 0x8005
test ebx, 0x10000
mov ebx, ecx
cmovne eax, esi
shl ebx, 0xf
add eax, eax
mov esi, eax
xor ebx, eax
xor esi, 0x8005
test ebx, 0x10000
cmovne eax, esi
shl ecx, 0x10
add eax, eax
mov ebx, eax
xor ecx, eax
xor ebx, 0x8005
test ecx, 0x10000
mov esi, dword [edi + 0x1c]
cmovne eax, ebx
cmp esi, 6
jle 0x424063
mov dword [esp], ebp
add esi, 0xfffffffa
xor ebx, ebx
movzx ecx, byte [ebx + edx + 6]
mov ebp, ecx
shl ebp, 9
add eax, eax
mov edi, eax
xor ebp, eax
xor edi, 0x8005
test ebp, 0x10000
mov ebp, ecx
cmovne eax, edi
inc ebx
shl ebp, 0xa
add eax, eax
mov edi, eax
xor ebp, eax
xor edi, 0x8005
test ebp, 0x10000
mov ebp, ecx
cmovne eax, edi
shl ebp, 0xb
add eax, eax
mov edi, eax
xor ebp, eax
xor edi, 0x8005
test ebp, 0x10000
mov ebp, ecx
cmovne eax, edi
shl ebp, 0xc
add eax, eax
mov edi, eax
xor ebp, eax
xor edi, 0x8005
test ebp, 0x10000
mov ebp, ecx
cmovne eax, edi
shl ebp, 0xd
add eax, eax
mov edi, eax
xor ebp, eax
xor edi, 0x8005
test ebp, 0x10000
mov ebp, ecx
cmovne eax, edi
shl ebp, 0xe
add eax, eax
mov edi, eax
xor ebp, eax
xor edi, 0x8005
test ebp, 0x10000
mov ebp, ecx
cmovne eax, edi
shl ebp, 0xf
add eax, eax
mov edi, eax
xor ebp, eax
xor edi, 0x8005
test ebp, 0x10000
cmovne eax, edi
shl ecx, 0x10
add eax, eax
mov ebp, eax
xor ecx, eax
xor ebp, 0x8005
test ecx, 0x10000
cmovne eax, ebp
cmp ebx, esi
jb 0x423f84
mov ebp, dword [esp]
mov ecx, eax
shr ecx, 8
mov byte [edx + 4], cl
mov byte [edx + 5], al
pop ecx
pop ebx
pop edi
pop esi
ret
Function at 0x42bbd0
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
sub esp, 0xc
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
lea ecx, [ebx - 0x3e8]
cmp ecx, 7
ja 0x42bc70
movzx eax, byte [ecx + 0x48e140]
add eax, 0x42bbfa
mov ecx, dword [esp + 4]
xor edx, edx
mov eax, edx
cmp word [ecx], dx
je 0x42bc0c
inc eax
cmp word [ecx + eax*2], dx
jne 0x42bc05
ret
adc eax, sym.imp.KERNEL32.dll_LoadLibraryA
push dword [0x4f7c84]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
mov dword [esp + 0x1c], eax
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call ebp
push 0x104
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
call fcn.0042bc0d
mov esi, dword [0x4f7cac]
mov edi, eax
pop ecx
cmp dword [esi], 0
je 0x42bcdd
push edi
call 0x42bbf8
pop ecx
cmp al, byte [esi]
je 0x42bcc8
cmp al, byte [esi + 1]
jne 0x42bd8b
push edi
call fcn.0042bc36
pop ecx
cmp eax, dword [esi + 4]
je 0x42bcdd
cmp eax, dword [esi + 8]
jne 0x42bd8b
push dword [0x4f7c84]
and dword [esp + 0x14], 0
push 0
call ebx
push eax
call ebp
xor edx, edx
mov ecx, dword [str.VirtualProtect]
mov ecx, dword [ecx + edx]
mov dword [edx + eax], ecx
add edx, 4
cmp edx, 0x40
jl 0x42bcf1
push eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x42bd8b
mov esi, dword [0x4f7c68]
lea eax, [esp + 0x10]
push eax
push dword [0x4f7c90]
push 0x7000
push esi
call edi
mov edx, dword [0x4f7ca8]
lea ecx, [esi + 8]
add edx, dword [esp + 0x18]
mov ebx, 0x1bfe
mov eax, dword [edx + 4]
sub edx, esi
mov dword [esp + 0x18], eax
mov eax, dword [edx + ecx]
add eax, dword [esp + 0x18]
mov dword [ecx], eax
lea ecx, [ecx + 4]
sub ebx, 1
jne 0x42bd4a
mov eax, dword [0x4f7c94]
mov dword [esi + 8], eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 0x7000
push esi
call edi
mov eax, dword [0x4f7ca4]
mov ecx, dword [esi + 0xc]
add ecx, eax
mov eax, dword [0x4f7ca4]
add ecx, esi
add esi, eax
push esi
call ecx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x42bc55
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push dword [0x4f7ca0]
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
Function at 0x478667
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004784e6

Function at 0x47c026
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047b994

Function at 0x47c031
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047bbcf

Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
push ebx
sub esp, 0x44
mov eax, 0x401023
mov ecx, 0
mov bl, byte [eax]
add bl, 0x38
mov byte [eax], bl
add eax, 1
add ecx, 1
cmp ecx, 0xd137
jne 0x40100e
or al, 0xc8
or eax, ecx
or eax, 0x52c8c8c8
loopne 0x401078
mov esi, dword [eax - 0x76b41fb0]
leave
dec ebx
mov cl, cl
dec ecx
rol edi, 0xef
enter 0x3dc8, 0xffffffffffffffb3
or al, 0xd8
or al, cl
or dword [ebx + 0x518b8b8b], 0xffffffe0
sbb byte [ebp + 0x4bc808a2], 0x88
enter 0xffffffffffff8c4b, 0xc
invalid
not dword [ecx - 0x74de3738]
and dword [eax - 0x4e37f611], 0xc8c86da6
mov al, 0xcd
enter 0xffffffffffffc8c8, 0xffffffffffffffb1
ror al, cl
enter 0xffffffffffff81c8, 0xffffffffffffffd0
invalid
Function at 0x7001387
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x7001396
pop dword [ebp - 0x2c]
mov eax, 0xa22098b0
sub eax, 0x9b20851a
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xa8d2b01b
sub dword [ebp - 0x3c], 0x5a806ad0
mov dword [ebp - 0x38], 0x952f8fec
add dword [ebp - 0x38], 0x9d03bc59
mov dword [ebp - 0x34], 0xa28724ea
sub dword [ebp - 0x34], 0x563ae0bc
mov dword [ebp - 0x30], 0x2aa9f8f8
add dword [ebp - 0x30], 0xd5560708
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xef69883a
sub dword [ebp - 0x3c], 0x7af71ee4
mov dword [ebp - 0x38], 0x7882bbd2
add dword [ebp - 0x38], 0xc8e9a5a3
mov dword [ebp - 0x34], 0x46bce4d2
add dword [ebp - 0x34], 0x1cb2879a
mov dword [ebp - 0x30], 0x21c197c0
sub dword [ebp - 0x30], 0x21c197c0
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3ebf0
push 0
call eax
mov ecx, 0x7c7cdef
add ecx, 0xf8388ab4
xor ebx, ebx
add ebx, eax
mov esi, 0x70a2f9aa
add esi, 0x965ee656
add esi, dword [ebp - 0x2c]
mov edx, 0x8b2191da
sub edx, 0x6031bd70
mov edi, dword [esi]
sub dword [ebp - 0x24], ebx
sub edi, edx
xor dword [ebp - 0xc], 0x7f654952
mov dword [ebx], edi
sub dword [ebp - 4], eax
add ebx, 0x7aaef18
sub ebx, 0x7aaef14
add esi, 4
loop 0x70014b0
add eax, 0x1555f
mov ebx, eax
add eax, 0x6bf1064b
sub eax, 0x6bf10646
mov ecx, 0x7000000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x700c938
Capabilities:
Set current directory

Disassembly:
push 8
mov eax, 0x7010cdd
call fcn.07001ea6
mov edi, ecx
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
push esi
call fcn.0700cc00
xor ebx, ebx
mov dword [edi], vtable.FileSharedStream.0
mov dword [edi + 0xc], ebx
mov byte [edi + 0x10], bl
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [edi + 0x18]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0700d3f5
lea ecx, [ebp - 0x10]
call fcn.0700c8d5
mov eax, dword [edi + 0x14]
mov byte [ebp - 4], 2
push dword [eax + 0x14]
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov eax, dword [edi + 0x14]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x700c9a5
mov eax, dword [eax + 0x14]
jmp 0x700c9aa
mov eax, 0x70127b2
push 0x701411c
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov dword [edi + 0xc], eax
pop ecx
pop ecx
test eax, eax
je 0x700c9dc
mov ecx, dword [edi + 4]
call fcn.07007826
lea ecx, [ebp - 0x10]
mov dword [edi + 8], eax
call fcn.07001387
mov eax, edi
call fcn.07002b7f
ret 4
push str.file_does_not_exist
push ebx
call fcn.07001387
int3