joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003cbd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xd6
mov dword [ebp - 8], 0
jmp 0x1003cbf2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xd
jge 0x1003cc31
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x175b2]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003cc2c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003cbe9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xd], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1003cc50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xcf
mov dword [ebp - 8], 0
jmp 0x1003cc72
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 6
jge 0x1003ccb1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x6b0c6bde]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003ccac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003cc69
mov eax, dword [ebp - 0xc]
mov byte [eax + 6], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1003ccd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xdb
mov dword [ebp - 8], 0
jmp 0x1003ccf2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xb
jge 0x1003cd31
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x46574f3c]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003cd2c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003cce9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xb], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1003cd50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x73
mov dword [ebp - 8], 0
jmp 0x1003cd72
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 9
jge 0x1003cdb1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x53d2fa96]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003cdac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003cd69
mov eax, dword [ebp - 0xc]
mov byte [eax + 9], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1003cdd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xa8
mov dword [ebp - 8], 0
jmp 0x1003cdf2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xd
jge 0x1003ce31
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x549c9fbe]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003ce2c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003cde9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xd], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1003ce50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 7
mov dword [ebp - 8], 0
jmp 0x1003ce72
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xd
jge 0x1003ceb1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x5e6711d7]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003ceac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003ce69
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xd], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1003ced0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xd6
mov dword [ebp - 8], 0
jmp 0x1003cef2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 7
jge 0x1003cf31
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x77a9d550]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003cf2c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003cee9
mov eax, dword [ebp - 0xc]
mov byte [eax + 7], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1003cf50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x89
mov dword [ebp - 8], 0
jmp 0x1003cf72
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 7
jge 0x1003cfb1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x15f1a3b]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003cfac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003cf69
mov eax, dword [ebp - 0xc]
mov byte [eax + 7], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1003cfd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x6e
mov dword [ebp - 8], 0
jmp 0x1003cff2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xb
jge 0x1003d031
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x67038597]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003d02c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003cfe9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xb], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1003d050
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xac
mov dword [ebp - 8], 0
jmp 0x1003d072
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xf
jge 0x1003d0b1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x3fee76a8]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003d0ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003d069
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xf], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1003d0d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xbc
mov dword [ebp - 8], 0
jmp 0x1003d0f2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xe
jge 0x1003d131
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x3b534685]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003d12c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003d0e9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xe], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1003d150
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xa9
mov dword [ebp - 8], 0
jmp 0x1003d172
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 6
jge 0x1003d1b1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x906910]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003d1ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003d169
mov eax, dword [ebp - 0xc]
mov byte [eax + 6], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1003d1d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x15
mov dword [ebp - 8], 0
jmp 0x1003d1f2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x17
jge 0x1003d231
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x5b16eeed]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003d22c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003d1e9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x17], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1003d250
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xbb
mov dword [ebp - 8], 0
jmp 0x1003d272
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 6
jge 0x1003d2b1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x6c25646a]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003d2ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003d269
mov eax, dword [ebp - 0xc]
mov byte [eax + 6], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1003d2d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xaa
mov dword [ebp - 8], 0
jmp 0x1003d2f2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 8
jge 0x1003d331
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x35ed5b32]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003d32c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003d2e9
mov eax, dword [ebp - 0xc]
mov byte [eax + 8], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1003d350
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x69
mov dword [ebp - 8], 0
jmp 0x1003d372
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 8
jge 0x1003d3b1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x8df6d15]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003d3ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003d369
mov eax, dword [ebp - 0xc]
mov byte [eax + 8], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1003d3d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xcc
mov dword [ebp - 8], 0
jmp 0x1003d3f2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 7
jge 0x1003d431
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x67ba51ee]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003d42c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003d3e9
mov eax, dword [ebp - 0xc]
mov byte [eax + 7], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1003d450
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x64
mov dword [ebp - 8], 0
jmp 0x1003d472
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2c
jge 0x1003d4b1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x10984ca5]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003d4ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003d469
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x2c], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1003d4d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x36
mov dword [ebp - 8], 0
jmp 0x1003d4f2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x10
jge 0x1003d531
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0xa88dfb0]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003d52c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003d4e9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x10], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1003d8a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x38], ecx
call fcn.1003d6d0
movzx eax, al
test eax, eax
je 0x1003d9ac
mov byte [ebp - 0x34], 0x46
mov byte [ebp - 0x33], 0x61
mov byte [ebp - 0x32], 0x74
mov byte [ebp - 0x31], 0x61
mov byte [ebp - 0x30], 0x6c
mov byte [ebp - 0x2f], 0x20
mov byte [ebp - 0x2e], 0x45
mov byte [ebp - 0x2d], 0x72
mov byte [ebp - 0x2c], 0x72
mov byte [ebp - 0x2b], 0x6f
mov byte [ebp - 0x2a], 0x72
mov byte [ebp - 0x29], 0x20
mov byte [ebp - 0x28], 0x6f
mov byte [ebp - 0x27], 0x6e
mov byte [ebp - 0x26], 0x20
mov byte [ebp - 0x25], 0x70
mov byte [ebp - 0x24], 0x72
mov byte [ebp - 0x23], 0x6f
mov byte [ebp - 0x22], 0x63
mov byte [ebp - 0x21], 0x65
mov byte [ebp - 0x20], 0x73
mov byte [ebp - 0x1f], 0x73
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0x69
mov byte [ebp - 0x1c], 0x6e
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x74
mov byte [ebp - 0x19], 0x69
mov byte [ebp - 0x18], 0x6c
mov byte [ebp - 0x17], 0x69
mov byte [ebp - 0x16], 0x7a
mov byte [ebp - 0x15], 0x61
mov byte [ebp - 0x14], 0x74
mov byte [ebp - 0x13], 0x69
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x10], 0x21
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x45
mov byte [ebp - 0xd], 0x72
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 0xa], 0x72
mov byte [ebp - 9], 0x20
mov byte [ebp - 8], 0x63
mov byte [ebp - 7], 0x6f
mov byte [ebp - 6], 0x64
mov byte [ebp - 5], 0x65
mov byte [ebp - 4], 0x3a
mov byte [ebp - 3], 0x20
mov byte [ebp - 2], 0x38
mov byte [ebp - 1], 0
mov ecx, dword [0x1006b828]
call fcn.10001480
push eax
push 0
lea ecx, [ebp - 0x34]
push ecx
push 0
lea edx, [ebp - 0x34]
push edx
mov ecx, dword [0x1006b82c]
call fcn.10011490
mov esp, ebp
pop ebp
ret

Function at 0x1003f63c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1006ab44]
jne 0x1003f646
repz ret
jmp fcn.1003fc9c
Function at 0x10041330
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10041438
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x10041438
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x10041438
push 2
push ebx
lea eax, [ebp + 8]
push eax
push esi
call fcn.10040060
add esp, 0x10
cmp eax, 2
je 0x10041379
pop edi
pop esi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
cmp word [ebp + 8], ax
jne 0x1004136d
push 4
lea eax, [ebx + 0x3c]
push eax
lea eax, [ebp - 4]
push eax
push esi
call fcn.10040060
add esp, 0x10
cmp eax, 4
jne 0x1004136d
add ebx, dword [ebp - 4]
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x100413a8
mov dword [eax], ebx
push 2
lea eax, [ebx + 4]
push eax
lea eax, [ebp + 8]
push eax
push esi
call fcn.10040060
add esp, 0x10
cmp eax, 2
jne 0x1004136d
movzx eax, word [ebp + 8]
cmp eax, 0x14c
je 0x10041403
cmp eax, 0x8664
jne 0x1004136d
push 0x108
push ebx
push edi
push esi
call fcn.10040060
add esp, 0x10
cmp eax, 0x108
jne 0x1004136d
cmp dword [edi], 0x4550
mov eax, 0x40
pop edi
mov ecx, 0x80004005
pop esi
cmovne eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0xf8
push ebx
push edi
push esi
call fcn.10040060
add esp, 0x10
cmp eax, 0xf8
jne 0x1004136d
cmp dword [edi], 0x4550
mov eax, 0x20
pop edi
mov ecx, 0x80004005
pop esi
cmovne eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x80070057
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401940
Capabilities:
Get common file path
Get file system object information

Disassembly:
sub esp, 0x2d4
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x2d0], eax
push ebx
mov ebx, ecx
mov eax, dword [ebx]
test eax, eax
je 0x401a65
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x14b
push eax
call esi
lea eax, [esp + 8]
push eax
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
test eax, eax
jne 0x4019dc
push 0x4209
push 0x2b4
lea eax, [esp + 0x18]
push eax
push 0
push dword [esp + 0x18]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push eax
push 0
push 0x402
push dword [ebx]
call esi
mov eax, dword [0x5ac874]
push dword [esp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
push 0
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x28]
mov ecx, ebx
push eax
push dword [esp + 0x24]
push 0
push 1
push eax
call fcn.00401a80
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
test eax, eax
jne 0x401a04
push eax
push eax
push dword [esp + 0x14]
mov ecx, ebx
call fcn.004013f0
test al, al
jne 0x401a5d
push ebp
push edi
call fcn.004cc020
mov esi, 1
xor edi, edi
mov ebp, eax
rol esi, 0
test ebp, esi
je 0x401a53
lea eax, [edi + 0x41]
push eax
push str._c:_
lea eax, [esp + 0x2d4]
push 0xa
push eax
call fcn.00402720
add esp, 0x10
lea eax, [esp + 0x2cc]
mov ecx, ebx
push 1
push 0xffffffffffffffff
push 2
push 0
push 0xffffffffffffffff
push 0
push 0
push eax
call fcn.00401a80
inc edi
rol esi, 1
cmp edi, 0x20
jl 0x401a17
pop edi
pop ebp
mov ecx, ebx
call fcn.00401e80
pop esi
mov ecx, dword [esp + 0x2d4]
pop ebx
xor ecx, esp
call fcn.004f833c
add esp, 0x2d4
ret
Function at 0x401a80
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2e0
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x2dc], eax
push ebx
push ebp
mov ebp, dword [esp + 0x2ec]
push esi
push edi
mov edi, dword [esp + 0x304]
push 0x1008
mov dword [esp + 0x14], ecx
call fcn.004f80fc
mov ecx, dword [esp + 0x300]
add esp, 4
mov ebx, eax
mov eax, dword [esp + 0x2f8]
push 0x800
push ebp
mov dword [ebx], eax
mov dword [ebx + 4], ecx
call fcn.00494440
push eax
lea ecx, [ebx + 8]
push ecx
call fcn.004947d0
cmp byte [esp + 0x310], 0
mov esi, dword [esp + 0x300]
jne 0x401b34
cmp esi, 0xffffffff
je 0x401afb
test edi, edi
jne 0x401b34
xor eax, eax
cmp dword [esp + 0x2f8], 2
sete al
lea eax, [eax*2 + 0x4201]
push eax
push 0x2b4
lea eax, [esp + 0x40]
push eax
push 0
push ebp
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
cmp esi, 0xffffffff
jne 0x401b2c
mov esi, dword [esp + 0x3c]
test edi, edi
jne 0x401b34
lea edi, [esp + 0x44]
xor eax, eax
mov dword [esp + 0x14], 0x37
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x1c], edi
test edi, edi
jne 0x401b6e
mov dword [esp + 0x1c], 0xffffffff
mov eax, dword [esp + 0x30c]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x308]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
push 0
push 0x40b
mov dword [esp + 0x40], ebx
push dword [eax]
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x2ec]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004f833c
add esp, 0x2e0
ret 0x20
Function at 0x401d68
Capabilities:
Check if file exists
Get file attributes
Get graphical window text

Disassembly:
mov eax, 0x1004
call fcn.004f8350
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
mov esi, ecx
lea eax, [esp + 4]
push 0x800
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [esp + 4]
push eax
call fcn.00447550
lea eax, [esp + 4]
push eax
push 0xffffffffffffffff
push 0x158
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
je 0x401df8
push 0
push eax
push 0x14e
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, esi
call fcn.00401730
cmp byte [0x54ba54], 0
mov ecx, esi
je 0x401ddd
call fcn.004024d0
pop esi
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.004f833c
add esp, 0x1004
ret
call fcn.00402680
pop esi
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.004f833c
add esp, 0x1004
ret
cmp byte [0x54ba54], 0
je 0x401e0f
lea eax, [esp + 4]
push eax
call fcn.0047d1a0
test al, al
je 0x401e52
lea eax, [esp + 4]
push eax
call fcn.00494530
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401e52
test al, 0x10
jne 0x401e52
lea eax, [esp + 4]
mov ecx, 0x570db0
push eax
call fcn.004420d0
pop esi
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.004f833c
add esp, 0x1004
ret
push 1
lea eax, [esp + 8]
mov ecx, 0x570db0
push eax
call fcn.0043ef70
mov ecx, dword [esp + 0x1004]
pop esi
xor ecx, esp
call fcn.004f833c
add esp, 0x1004
ret
Function at 0x40a540
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x804
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x800], eax
push ebx
push esi
push edi
mov edi, dword [esp + 0x814]
xor eax, eax
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x400
lea ecx, [esp + 0x10]
xor esi, esi
push ecx
push eax
call fcn.00493f60
mov ebx, eax
test ebx, ebx
je 0x40a5d5
test esi, esi
jne 0x40a58c
mov esi, 1
jmp 0x40a5b7
movzx eax, word [esp + 0xc]
mov ecx, 0x5574c8
push eax
call fcn.0045f3b0
test al, al
jne 0x40a5b7
cmp esi, 1
jne 0x40a5b6
movzx eax, word [esp + 0xc]
mov word [edi], ax
movzx eax, word [esp + 0xe]
mov word [edi + 2], ax
inc esi
push 0x400
lea eax, [esp + 0x10]
push eax
push ebx
call fcn.00493f60
mov ebx, eax
test ebx, ebx
jne 0x40a581
cmp esi, 2
jne 0x40a5d5
mov word [edi], ax
mov ecx, dword [esp + 0x80c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004f833c
add esp, 0x804
ret 4