joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a2b7
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
lea eax, [ebp - 0x1c]
lea edi, [esi + 0x10]
push eax
mov ecx, edi
call fcn.0040ec85
lea eax, [ebp - 0x1c]
push eax
push 0x47c8a0
push 0x5098d8
call fcn.00410699
pop ecx
pop ecx
push eax
call fcn.0041a0ba
push eax
call fcn.0041a283
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.004064d9
lea ebx, [esi + 4]
test ebx, ebx
je 0x41a30c
lea eax, [esi + 0xc]
jmp 0x41a30e
xor eax, eax
push 0x47c89c
push eax
call fcn.00410699
pop ecx
pop ecx
lea eax, [ebp - 0x1c]
push eax
mov ecx, edi
call fcn.0040ec85
cmp dword [ebp - 4], 8
mov eax, dword [ebp - 0x18]
jae 0x41a332
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.004064d9
mov ecx, ebx
call fcn.00419feb
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41b3c8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
call fcn.0041b201
and byte [esi + 0x24], 0xf8
xor eax, eax
push 0x10
mov dword [esi], 0x47ca48
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x28], eax
call dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [esi + 0x24]
mov edi, 0x4000000
push edi
shr eax, 8
test al, al
seta al
xor cl, al
and cl, 1
xor byte [esi + 0x24], cl
call fcn.0041a66d
add al, al
xor al, byte [esi + 0x24]
mov ebx, 0x8000000
and al, 2
xor byte [esi + 0x24], al
push ebx
call fcn.0041a66d
shl al, 2
xor al, byte [esi + 0x24]
pop ecx
and al, 4
xor byte [esi + 0x24], al
mov al, byte [esi + 0x24]
pop ecx
test al, 1
je 0x41b43d
and dword [esi + 0x28], 0x2000000
test al, 2
je 0x41b444
and dword [esi + 0x28], edi
test al, 4
je 0x41b44b
and dword [esi + 0x28], ebx
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x42ebc1
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 8

Function at 0x42ec12
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x42ec23
push 0xd
pop eax
jmp 0x42ec50
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x42ec26
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
ret 8
Function at 0x42f1af
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x501f8c]
xor eax, ebp
mov dword [ebp + 0x198], eax
mov eax, dword [ebp + 0x1a4]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.0042eb80
mov ebx, eax
cmp ebx, esi
je 0x42f21f
lea ecx, [ebp - 0x70]
call fcn.0042eb0b
mov eax, ebx
mov ecx, dword [ebp + 0x198]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044fa41
add ebp, 0x19c
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x42f237
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x70]
call fcn.0042f1af
cmp eax, esi
jne 0x42f269
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x68]
push eax
push esi
push dword [ebp - 0x70]
mov dword [ebp - 0x74], 0x100
call ebx
test eax, eax
je 0x42f227
lea ecx, [ebp - 0x70]
call fcn.0042eb0b
push dword [ebp - 0x78]
mov ecx, edi
call fcn.0042eab0
lea ecx, [ebp - 0x70]
mov esi, eax
call fcn.0042eb0b
mov eax, esi
jmp 0x42f205
Function at 0x4304e3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x398]
sub esp, 0x418
mov eax, dword [0x501f8c]
xor eax, ebp
mov dword [ebp + 0x394], eax
mov eax, dword [ebp + 0x3a0]
push ebx
mov ebx, dword [ebp + 0x3a8]
push esi
mov esi, dword [ebp + 0x3a4]
push edi
xor edi, edi
push 2
push edi
push eax
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x70], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x74], eax
cmp eax, edi
jne 0x43053e
call fcn.0042e9d3
mov esi, eax
jmp 0x430604
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, edi
jne 0x430557
call fcn.0042e9d3
jmp 0x4305f9
push esi
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
cmp ebx, edi
je 0x43054d
push esi
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x4305b3
lea eax, [ebp - 0x6c]
cmp dword [ebp - 0x70], eax
je 0x43058a
lea ecx, [ebp - 0x70]
call fcn.0042f160
mov esi, 0x8007000e
lea ecx, [ebp - 0x78]
call fcn.0042f09a
mov ecx, dword [ebp + 0x394]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044fa41
add ebp, 0x398
leave
ret 0x10
push eax
lea ecx, [ebp - 0x70]
call fcn.0042f6fa
cmp dword [ebp - 0x70], edi
jne 0x4305c8
mov esi, 0x8007000e
jmp 0x4305fb
push esi
push dword [ebp - 0x70]
push esi
push ebx
push edi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, edi
je 0x43054d
mov edx, dword [ebp - 0x70]
push dword [ebp + 0x3ac]
xor ecx, ecx
mov word [edx + eax*2], cx
push dword [ebp - 0x70]
lea ecx, [ebp - 0x80]
call fcn.004301fa
mov esi, eax
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x6c]
cmp dword [ebp - 0x70], eax
je 0x43058f
lea ecx, [ebp - 0x70]
call fcn.0042f160
jmp 0x43058f
Function at 0x4450b4
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x4450cb
inc eax
jmp 0x44516d
push esi
mov esi, dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
push 1
call esi
test eax, eax
jne 0x4450e8
push 0xd
call esi
test eax, eax
jne 0x4450e8
inc eax
jmp 0x44516c
mov esi, dword [sym.imp.USER32.dll_GetClipboardData]
push edi
push 0xd
call esi
mov edi, eax
test edi, edi
jne 0x445131
push 1
call esi
mov esi, eax
test esi, esi
je 0x445163
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x445163
push 0xffffffffffffffff
push eax
lea eax, [ebp - 4]
push eax
call fcn.00418a02
mov ecx, dword [ebp + 8]
add esp, 0xc
push eax
call fcn.0041871e
lea ecx, [ebp - 4]
call fcn.00418710
push esi
jmp 0x44515d
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x445163
push 0xffffffffffffffff
push eax
lea eax, [ebp - 4]
push eax
call fcn.00418a1a
mov ecx, dword [ebp + 8]
add esp, 0xc
push eax
call fcn.0041871e
lea ecx, [ebp - 4]
call fcn.00418710
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
pop edi
pop esi
leave
ret 4

Function at 0x4451e3
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x4451f6
inc eax
jmp 0x445281
push ebx
mov ebx, dword [esp + 8]
mov eax, dword [ebx]
cmp dword [eax + 8], 0
jne 0x445213
mov bl, 1
call dword [sym.imp.USER32.dll_EmptyClipboard]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x445279
push esi
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [ebx]
mov eax, dword [eax + 8]
lea esi, [eax + eax]
lea eax, [esi + 2]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
jne 0x44523f
call dword [sym.imp.USER32.dll_CloseClipboard]
xor bl, bl
jmp 0x445277
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebp, eax
mov eax, dword [ebx]
push esi
push dword [eax + 0xc]
push ebp
call fcn.0044fa50
add esp, 0xc
xor eax, eax
push edi
mov word [esi + ebp], ax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov bl, 1
pop ebp
pop edi
pop esi
xor eax, eax
test bl, bl
sete al
pop ebx
ret 4

Function at 0x44af09
Capabilities:
Check os version

Disassembly:
push esi
push edi
mov esi, ecx
mov edi, 0x509a08
push edi
lea ecx, [esi + 4]
call fcn.0040863f
push edi
lea ecx, [esi + 8]
call fcn.0040863f
call dword [sym.imp.KERNEL32.dll_GetVersion]
and dword [esi], 0
mov ecx, eax
shr ecx, 8
cmp al, 5
jne 0x44af3d
cmp cl, 1
jb 0x44af4d
jmp 0x44af41
cmp al, 6
jb 0x44af49
mov dword [esi], 0x44c14f
jmp 0x44af53
cmp al, 5
ja 0x44af53
mov dword [esi], 0x44c058
push dword [esi]
movzx ecx, cl
movzx eax, al
push ecx
push eax
push str.OS_main_version_is__d__sub_version_is__d__install_func_is__p
call fcn.0044f300
add esp, 0x10
pop edi
mov eax, esi
pop esi
ret
Function at 0x44b4aa
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x501f8c]
xor eax, ebp
mov dword [ebp + 0x198], eax
mov eax, dword [ebp + 0x1a4]
push ebx
push esi
mov esi, dword [ebp + 0x1a8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x78], eax
call edi
push esi
mov ebx, eax
call edi
cmp ebx, 0xffffffff
je 0x44b5ab
cmp eax, 0xffffffff
je 0x44b5ab
test bl, 0x10
je 0x44b5ab
test al, 0x10
jne 0x44b5ab
mov ebx, 0x20a
push ebx
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.00450020
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
mov edi, 0x104
push edi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
call esi
mov ecx, dword [ebp - 0x7c]
lea eax, [ebp - 0x74]
push eax
add ecx, 4
call fcn.004091fa
push ebx
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.00450020
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
push edi
push dword [ebp - 0x78]
call esi
mov esi, dword [ebp - 0x7c]
lea eax, [ebp - 0x74]
add esi, 8
push eax
mov ecx, esi
call fcn.004091fa
push 0x5c
push 1
lea eax, [ebp - 0x78]
push eax
mov ecx, esi
call fcn.00408d88
push eax
call fcn.0044ae65
pop ecx
pop ecx
mov ecx, dword [ebp - 0x78]
add ecx, 0xfffffff0
mov bl, al
call fcn.00408309
test bl, bl
je 0x44b5a7
push 0x477d7c
mov ecx, esi
call fcn.0044b08c
mov al, 1
jmp 0x44b5ad
xor al, al
mov ecx, dword [ebp + 0x198]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044fa41
add ebp, 0x19c
leave
ret 8
Function at 0x44bf3a
Capabilities:
Copy file
Enumerate files on windows
Get file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x1e8]
sub esp, 0x268
mov eax, dword [0x501f8c]
xor eax, ebp
mov dword [ebp + 0x1e4], eax
mov eax, dword [ebp + 0x1f4]
push ebx
push esi
mov esi, dword [ebp + 0x1f0]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.0044bef7
push 0x4803e8
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.0041639a
and dword [ebp - 0x6c], 0
push 0x24c
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.00450020
add esp, 0x20
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x7c]
mov bl, 1
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x78], eax
cmp eax, 0xffffffff
je 0x44c029
test byte [ebp - 0x6c], 0x10
jne 0x44c00f
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x74]
push esi
push eax
call fcn.0041639a
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.0041639a
add esp, 0x18
push 0
push dword [ebp - 0x74]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp - 0x80]
add ecx, 0xfffffff0
call fcn.00408309
test bl, bl
je 0x44c002
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x44c002
mov bl, 1
jmp 0x44c004
xor bl, bl
mov ecx, dword [ebp - 0x74]
add ecx, 0xfffffff0
call fcn.00408309
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x44bfad
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x7c]
add ecx, 0xfffffff0
call fcn.00408309
mov ecx, dword [ebp - 0x70]
add ecx, 0xfffffff0
call fcn.00408309
mov ecx, dword [ebp + 0x1e4]
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0044fa41
add ebp, 0x1e8
leave
ret

Function at 0x44cfb1
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x18c]
sub esp, 0x20c
mov eax, dword [0x501f8c]
xor eax, ebp
mov dword [ebp + 0x188], eax
push esi
push edi
mov edi, dword [ebp + 0x194]
push 0x206
lea eax, [ebp - 0x7e]
push 0
push eax
call fcn.00450020
xor eax, eax
add esp, 0xc
mov word [ebp - 0x80], ax
mov esi, 0x104
push esi
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x80]
push eax
call fcn.004503fe
pop ecx
test eax, eax
jle 0x44d026
cmp word [ebp + eax*2 - 0x82], 0x5c
je 0x44d026
push 0x5c
pop ecx
mov word [ebp + eax*2 - 0x80], cx
inc eax
xor ecx, ecx
mov word [ebp + eax*2 - 0x80], cx
sub esi, eax
push str.WinSxs_
lea eax, [ebp + eax*2 - 0x80]
push esi
push eax
call fcn.00451911
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov ecx, edi
call fcn.00406c25
mov ecx, dword [ebp + 0x188]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0044fa41
add ebp, 0x18c
leave
ret
Function at 0x44f406
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x1a8]
sub esp, 0x228
mov eax, dword [0x501f8c]
xor eax, ebp
mov dword [ebp + 0x1a4], eax
push ebx
push esi
push edi
mov edi, ecx
call fcn.0044f7a9
lea ecx, [edi + 0x24]
call fcn.00406606
lea esi, [edi + 0x40]
mov ecx, esi
call fcn.00406606
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp - 0x64], ax
lea eax, [ebp - 0x62]
push ebx
push eax
mov dword [edi + 0x20], ebx
call fcn.00450020
add esp, 0xc
push ebx
push 0x1a
lea eax, [ebp - 0x64]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x80]
push str._sduowanyy_setup_
push eax
call fcn.0044f812
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
call fcn.004067b7
push ebx
push 1
lea ecx, [ebp - 0x80]
call fcn.004064d9
cmp dword [esi + 0x18], 8
jb 0x44f49e
mov eax, dword [esi + 4]
jmp 0x44f4a1
lea eax, [esi + 4]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
cmp dword [esi + 0x18], 8
jb 0x44f4b4
mov esi, dword [esi + 4]
jmp 0x44f4b7
add esi, 4
push str.setupV2.log
push esi
lea eax, [ebp - 0x80]
push str._s_s
push eax
call fcn.0044f812
add esp, 0x10
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [edi + 0x24]
call fcn.004067b7
push ebx
push 1
lea ecx, [ebp - 0x80]
call fcn.004064d9
mov ecx, dword [ebp + 0x1a4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044fa41
add ebp, 0x1a8
leave
ret

Function at 0x44fa41
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x501f8c]
jne 0x44fa4b
repz ret
jmp fcn.00456443
Function at 0x45ff18
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004567e4
and dword [ebp - 4], 0
cmp dword [0x5095cc], 0
mov ebx, eax
jne 0x45ffc9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x46007a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x46007a
push eax
call fcn.00456772
mov dword [esp], 0x48293c
push edi
mov dword [0x5095cc], eax
call esi
push eax
call fcn.00456772
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x5095d0], eax
call esi
push eax
call fcn.00456772
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x5095d4], eax
call esi
push eax
call fcn.00456772
pop ecx
mov dword [0x5095dc], eax
test eax, eax
je 0x45ffc9
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00456772
pop ecx
mov dword [0x5095d8], eax
mov eax, dword [0x5095d8]
cmp eax, ebx
je 0x460021
cmp dword [0x5095dc], ebx
je 0x460021
push eax
call fcn.004567ed
push dword [0x5095dc]
mov esi, eax
call fcn.004567ed
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x460021
test edi, edi
je 0x460021
call esi
test eax, eax
je 0x460018
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x460018
test byte [ebp - 0xc], 1
jne 0x460021
or dword [ebp + 0x10], 0x200000
jmp 0x46005a
mov eax, dword [0x5095d0]
cmp eax, ebx
je 0x46005a
push eax
call fcn.004567ed
pop ecx
test eax, eax
je 0x46005a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x46005a
mov eax, dword [0x5095d4]
cmp eax, ebx
je 0x46005a
push eax
call fcn.004567ed
pop ecx
test eax, eax
je 0x46005a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x5095cc]
call fcn.004567ed
pop ecx
test eax, eax
je 0x46007a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x46007c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x469569
Capabilities:
Write file on windows

Disassembly:
push 0x48
mov eax, 0x46e4d9
call fcn.0046c62e
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x3c], ebx
je 0x46967b
cmp byte [esi + 0x42], bl
je 0x46967b
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 4]
movzx eax, ax
cmp di, ax
jne 0x4695a5
xor al, al
jmp 0x46967d
push ebx
push 8
lea ecx, [ebp - 0x2c]
call fcn.0046953f
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0046931b
mov ecx, eax
call fcn.00468cc5
mov edi, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0046931b
mov ecx, eax
call fcn.00468cc5
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x30]
push eax
add edi, ebx
push edi
push dword [ebp - 0x34]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x469615
dec eax
je 0x469619
dec eax
dec eax
je 0x469677
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040893c
mov al, bl
jmp 0x46967d
mov byte [esi + 0x42], 0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0046931b
mov ecx, eax
call fcn.00468cc5
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x469659
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0046931b
mov ecx, eax
call fcn.00468cc5
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004514f6
add esp, 0x10
cmp edi, eax
jne 0x469603
cmp byte [esi + 0x42], 0
je 0x469677
test edi, edi
jne 0x4695b3
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00408e03
jmp 0x4695b3
mov bl, 1
jmp 0x469605
mov al, 1
call fcn.0046c678
ret
Function at 0x469724
Capabilities:
Write file on windows

Disassembly:
push 0x54
mov eax, 0x46e547
call fcn.0046c62e
mov edi, dword [ebp + 8]
mov eax, 0xffff
mov esi, ecx
cmp ax, di
jne 0x46974e
lea eax, [ebp + 8]
push eax
call fcn.0040e125
pop ecx
jmp 0x4698c9
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
xor ebx, ebx
cmp ecx, ebx
je 0x46977c
mov eax, dword [esi + 0x34]
mov edx, dword [eax]
lea edx, [ecx + edx*2]
cmp ecx, edx
jae 0x46977c
dec dword [eax]
mov esi, dword [esi + 0x24]
mov eax, dword [esi]
lea ecx, [eax + 2]
mov dword [esi], ecx
mov word [eax], di
mov ax, di
jmp 0x4698c9
mov eax, dword [esi + 0x4c]
cmp eax, ebx
je 0x4698c4
cmp dword [esi + 0x3c], ebx
jne 0x4697a5
push eax
push edi
call fcn.00468e6b
pop ecx
test al, al
pop ecx
movzx eax, di
jne 0x4698c9
jmp 0x4698c4
movzx eax, di
push ebx
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
call fcn.0046953f
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call fcn.0046931b
mov ecx, eax
call fcn.00468cc5
mov edi, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0046931b
mov ecx, eax
call fcn.00468cc5
lea edx, [ebp - 0x38]
add edi, ebx
push edx
lea ebx, [esi + 0x44]
jmp 0x469896
cmp eax, 1
jg 0x4698d1
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0046931b
mov ecx, eax
call fcn.00468cc5
mov edi, dword [ebp - 0x38]
sub edi, eax
je 0x46983b
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0046931b
mov ecx, eax
call fcn.00468cc5
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004514f6
add esp, 0x10
cmp edi, eax
jne 0x4698b8
lea eax, [ebp - 0x30]
mov byte [esi + 0x42], 1
cmp dword [ebp - 0x3c], eax
jne 0x469901
test edi, edi
ja 0x469861
cmp dword [ebp - 0x18], 0x20
push 0
lea ecx, [ebp - 0x2c]
jae 0x4698bd
push 8
call fcn.00408e03
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0046931b
mov ecx, eax
call fcn.00468cc5
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0046931b
mov ecx, eax
call fcn.00468cc5
lea edx, [ebp - 0x38]
push edx
mov edx, dword [ebp - 0x40]
add edi, edx
mov ecx, dword [esi + 0x3c]
push edi
push eax
lea edx, [ebp - 0x3c]
push edx
lea edx, [ebp - 0x2e]
push edx
lea edx, [ebp - 0x30]
push edx
mov dword [ebp - 0x34], eax
mov eax, dword [ecx]
push ebx
call dword [eax + 0x14]
test eax, eax
jge 0x4697f2
push 0
lea ecx, [ebp - 0x2c]
push 1
call fcn.0040893c
mov eax, 0xffff
call fcn.0046c678
ret 4
cmp eax, 3
jne 0x4698b8
push dword [esi + 0x4c]
push dword [ebp - 0x30]
call fcn.00468e6b
movzx esi, word [ebp + 8]
pop ecx
pop ecx
test al, al
jne 0x4698f0
mov esi, 0xffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040893c
mov ax, si
jmp 0x4698c9
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040893c
mov ax, word [ebp + 8]
jmp 0x4698c9
Function at 0x46a104
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x509a24], 0
push esi
jne 0x46a077
call fcn.00469f9d
test eax, eax
je 0x46a0ba
mov eax, dword [0x509a24]
cmp eax, 1
jne 0x46a098
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x46a0ba
pop esi
ret
push eax
call dword [0x509a2c]
test eax, eax
jne 0x46a102
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x46a0be
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x509a24]
call dword [0x509a2c]
mov edi, eax
test edi, edi
je 0x46a0e3
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x46a0ff
mov edi, esi
add esi, 0xff0
push edi
push dword [0x509a24]
call dword [0x509a28]
add edi, 0x10
cmp edi, esi
jb 0x46a0eb
mov eax, edi
pop edi
pop esi
ret
jmp 0x46a064

Function at 0x46b925
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax]
push dword [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
ret

Function at 0x100afd08
Capabilities:
Encode data using xor

Disassembly:
dec esi
mov bl, 0xe2
add al, 0x85
test esi, edi
pop es
test dword [ebp - 0x5a7af7fe], ebx
push es
invalid
cmp byte [edx], dl
salc
invalid
add byte [eax], al
jmp 0x100afcdf
popal
clc
jmp 0x100afd03
jmp 0x1008ff55
cmp al, 0xc5
stosd dword es:[edi], eax
mov ecx, 0xf6617cb5
das
or dword [ebx + 0x2c3d3c09], esi
jg 0x100afcce
adc ebp, dword [ebx + 0x31f8b9b9]
loope 0x100afcbe
test dword [ebx], ebp
dec ecx
xor ah, ch
movsb byte es:[edi], byte [esi]
invalid