joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405a31
Capabilities:
Get graphical window text

Disassembly:
push 0x30
mov eax, 0x47ff5c
call fcn.0046a39a
mov esi, ecx
mov dword [ebp - 0x3c], esi
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
sub eax, 0xfd
je 0x405a8a
sub eax, 1
je 0x405a5a
xor al, al
jmp 0x405b32
push 0
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebx + 8]
call fcn.004015c9
cmp dword [ebp - 0x24], 7
lea eax, [ebp - 0x38]
cmova eax, dword [ebp - 0x38]
push eax
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea ecx, [ebp - 0x38]
call fcn.00402b27
jmp 0x405b30
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
xor ecx, ecx
mov esi, eax
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00469b8a
pop ecx
mov edi, eax
mov eax, dword [ebp - 0x3c]
push esi
push edi
push dword [eax + 0x10]
call dword [sym.imp.USER32.dll_GetWindowTextW]
call fcn.00401ae2
mov ecx, dword [eax + 0x204]
lea eax, [ebp - 0x20]
push eax
call ecx
xor ecx, ecx
test esi, esi
jne 0x405ae3
mov eax, edi
mov esi, ecx
cmp word [edi], cx
je 0x405ae3
lea eax, [eax + 2]
inc esi
cmp word [eax], cx
jne 0x405ada
call fcn.00401ae2
push 0
push esi
push edi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x20]
push ecx
call eax
and dword [ebp - 4], 0
lea esi, [ebx + 8]
call fcn.00401ae2
lea ecx, [ebp - 0x20]
push ecx
push esi
mov eax, dword [eax + 0x210]
call eax
mov dword [ebp - 4], 1
call fcn.00401ae2
lea edx, [ebp - 0x20]
push edx
mov ecx, dword [eax + 0x208]
call ecx
push edi
call fcn.00469952
pop ecx
mov al, 1
call fcn.0046a349
ret 8

Function at 0x407613
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x4804a4
call fcn.0046a367
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, dword [ebp + 8]
push 8
call fcn.00469a37
mov esi, eax
pop ecx
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 1
mov dword [esi], 0x407392
mov dword [esi + 4], ebx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x407658
mov dword [esi + 4], ecx
xor eax, eax
lea ecx, [edi + 4]
mov eax, dword [ecx]
push ecx
mov eax, dword [eax]
call eax
pop ecx
lea eax, [ebp - 0x14]
push eax
push ebx
push esi
push 0x407690
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 2
mov eax, dword [ebp + 8]
test eax, eax
je 0x40768a
lea ecx, [eax + 4]
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
pop ecx
call fcn.0046a335
ret

Function at 0x407ad8
Capabilities:
Create thread

Disassembly:
push 4
mov eax, 0x480571
call fcn.0046a367
mov edi, ecx
push 8
xor ebx, ebx
call fcn.00469a37
mov esi, eax
pop ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], ebx
mov ecx, dword [ebp + 0xc]
mov dword [esi], ebx
mov ecx, dword [ecx]
test ecx, ecx
je 0x407b10
mov dword [esi], ecx
add ecx, 4
push ecx
mov eax, dword [ecx]
mov eax, dword [eax]
call eax
pop ecx
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
mov dword [ebp + 0xc], esi
xor eax, eax
mov dword [ebp - 4], 1
lea ebx, [edi + 4]
push ebx
push eax
push esi
push 0x407c89
push eax
push eax
call fcn.0046f959
add esp, 0x18
mov dword [edi], eax
test eax, eax
je 0x407b47
mov eax, edi
call fcn.0046a335
ret 8
and dword [ebx], 0
push 6
call fcn.00469565
int3
Function at 0x40802c
Capabilities:
Accept command line arguments

Disassembly:
push 0x20
mov eax, 0x4805c5
call fcn.0046a39a
mov eax, dword fs:[0x2c]
xor ebx, ebx
mov ecx, dword [eax]
mov eax, dword [0x5460a4]
cmp eax, dword [ecx + 4]
jle 0x408088
mov esi, 0x5460a4
push esi
call fcn.004699d3
cmp dword [0x5460a4], 0xffffffff
pop ecx
jne 0x408088
push 0x480b96
mov dword [0x546098], ebx
mov dword [0x54609c], ebx
mov dword [0x5460a0], ebx
call fcn.00469fef
push esi
call fcn.00469982
pop ecx
pop ecx
mov eax, dword [0x54609c]
sub eax, dword [0x546098]
push 0x18
cdq
pop ecx
idiv ecx
test eax, eax
jne 0x408111
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
je 0x408111
mov esi, ebx
cmp dword [ebp - 0x2c], ebx
jle 0x40810a
push dword [edi + esi*4]
lea ecx, [ebp - 0x28]
call fcn.00402987
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x28]
mov eax, dword [0x54609c]
push ecx
cmp eax, dword [0x5460a0]
je 0x4080ed
mov ecx, eax
call fcn.0040400c
add dword [0x54609c], 0x18
jmp 0x4080f8
push eax
mov ecx, 0x546098
call fcn.00406fcf
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402b27
inc esi
cmp esi, dword [ebp - 0x2c]
jl 0x4080be
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 0x546098
call fcn.0046a349
ret

Function at 0x40db2e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov eax, ecx
mov edi, edx
push 0
push 0x14
mov dword [ebp - 4], edi
and dword [eax], 0
mov dword [ebp - 8], eax
call fcn.0040bb82
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x40db58
push 7
pop eax
jmp 0x40dbc8
cmp byte [0x542ae4], 0
push ebx
je 0x40db9a
mov ecx, 0xc8
call fcn.0040e1c9
test eax, eax
jne 0x40db9a
mov eax, dword [ebp + 8]
lea ebx, [esi + 8]
mov dword [ebx], edi
lea edi, [esi + 4]
push edi
mov dword [esi + 0xc], eax
xor eax, eax
push eax
push esi
push 0x40db0e
push eax
push eax
call fcn.0046f959
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x40dba9
jmp 0x40db9d
lea ebx, [esi + 8]
mov edi, esi
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea edi, [esi + 4]
cmp dword [ebx], 0
pop ebx
jne 0x40dbc1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push dword [ebp + 8]
mov dword [edi], eax
call dword [ebp - 4]
pop ecx
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 8]
mov dword [eax], esi
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x411bfc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ecx + 8]
mov eax, edx
push edi
mov edi, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 4], eax
test edi, edi
jle 0x411c30
push ebx
mov ebx, dword [ecx]
mov al, byte [edx + eax]
xor byte [ebx + esi], al
lea eax, [esi + 1]
xor esi, esi
cmp eax, dword [ecx + 4]
cmovl esi, eax
mov eax, dword [ebp - 4]
inc edx
cmp edx, edi
jl 0x411c16
pop ebx
add dword [ecx + 0xc], edi
pop edi
mov dword [ecx + 8], esi
pop esi
leave
ret
Function at 0x415199
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, dword [edi + 0x88]
test esi, esi
je 0x4151cd
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, dword [esi + 0x10]
mov dword [edi + 0x88], eax
mov eax, dword [esi + 8]
and dword [esi + 0x10], 0
and dword [eax], 0
and dword [eax + 4], 0
jmp 0x41522e
movzx eax, word [edi + 0x8c]
cdq
add eax, 0x28
adc edx, 0
push edx
push eax
call fcn.0040beb2
pop ecx
pop ecx
mov ecx, dword [ebp + 0xc]
mov esi, eax
mov dword [ecx], esi
test esi, esi
jne 0x415217
mov ecx, dword [ebp - 4]
mov eax, dword [edi + 0x98]
dec ecx
push esi
cdq
push ecx
push edx
push eax
call fcn.0047d240
mov ecx, dword [edi + 0x3c]
push edx
mov edx, dword [ebp + 8]
push eax
call fcn.0040b3c9
pop ecx
pop ecx
push 7
pop eax
jmp 0x41523f
lea eax, [esi + 0x28]
mov dword [esi + 0x14], edi
mov dword [esi + 8], eax
push 0x20
pop eax
mov word [esi + 0x1c], ax
xor eax, eax
inc eax
mov word [esi + 0x1e], ax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dword [esi + 4], eax
mov dword [esi + 0x18], ecx
inc dword [edi + 0x78]
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x437aa1
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 8]
mov esi, edx
mov ebx, str.sqlite_master
push esi
push ebx
push esi
mov edi, ecx
push str.SELECT_1_FROM___w_._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
push edi
call fcn.0043b470
add esp, 0x18
cmp dword [ebp + 8], 0
jne 0x437ada
push esi
push ebx
push str.SELECT_1_FROM_temp._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
push edi
call fcn.0043b470
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x46a7d0
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x46a80f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x46a80f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x46a80f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x46a80f
cmp dword [ecx + 0x74], 0xe
jbe 0x46a80f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x473360
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4842cc
push 0x4842c4
push str.FlsAlloc
push 0x1f
call fcn.004731df
mov esi, eax
add esp, 0x10
test esi, esi
je 0x473394
push dword [ebp + 8]
mov ecx, esi
call dword [0x48125c]
call esi
jmp 0x47339a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4733de
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4842dc
push 0x4842d4
push str.FlsGetValue
push 0x21
call fcn.004731df
mov esi, eax
add esp, 0x10
test esi, esi
je 0x473415
push dword [ebp + 8]
mov ecx, esi
call dword [0x48125c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x47341d
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4842e4
push 0x4842dc
push str.FlsSetValue
push 0x22
call fcn.004731df
mov esi, eax
add esp, 0x10
test esi, esi
je 0x473457
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x48125c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x474d43
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x542040]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x474d8e
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.00474ede
test al, al
jne 0x474d88
sub edx, 2
cmp edx, edi
jne 0x474d6e
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x474db0
lea eax, [edi + 2]
cmp edx, eax
je 0x474db0
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.00474c8f
add esp, 0x10
jmp 0x474eaa
push esi
lea ecx, [ebp - 0x255]
call fcn.00474ede
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x474df3
push dword [ebp - 0x25c]
jmp 0x474da0
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x474e30
cmp word [ebp - 0x226], 0
je 0x474e51
cmp word [ebp - 0x226], ax
jne 0x474e30
cmp word [ebp - 0x224], 0
je 0x474e51
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.00474c8f
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x474e9d
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x474e0a
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x474e85
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x474eaa
push 0x474abf
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00479ea0
add esp, 0x10
jmp 0x474e7a
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00469944
leave
ret

Function at 0x475a63
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x475a74
pop esi
ret
push ebx
push edi
push esi
call fcn.00475a2c
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00471d66
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x475a9c
push ebx
push esi
push edi
call fcn.0046b220
add esp, 0xc
push 0
call fcn.00471d2c
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x475e6c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00475ab1
Function at 0x47cff0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x47d01d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x47d01d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x413a34
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x413a43
pop dword [ebp - 0x4c]
mov eax, 0x413a43
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xbfd3102f
sub dword [ebp - 0x5c], 0x7180cae4
mov dword [ebp - 0x58], 0x29256a46
add dword [ebp - 0x58], 0x90de1ff
mov dword [ebp - 0x54], 0x3b3537a0
sub dword [ebp - 0x54], 0xeee8f372
mov dword [ebp - 0x50], 0x6649c5a1
add dword [ebp - 0x50], 0x99b63a5f
lea eax, [ebp - 0x5c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x8fd40ab8
sub dword [ebp - 0x5c], 0x1b61a162
mov dword [ebp - 0x58], 0xdf3a2746
sub dword [ebp - 0x58], 0x9dcdc5d1
mov dword [ebp - 0x54], 0x751e538c
add dword [ebp - 0x54], 0xee5118e0
mov dword [ebp - 0x50], 0x5aebad09
sub dword [ebp - 0x50], 0x5aebad09
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3fc17
push 0
call eax
mov ecx, 0xa3a3a791
sub ecx, 0xa3a34e9c
xor esi, esi
add esi, eax
mov edx, 0x931071ac
sub edx, 0x92cd47ac
add edx, dword [ebp - 0x4c]
mov ebx, 0xf51cc962
sub ebx, 0x1555ca14
sub dword [ebp - 0x14], edi
mov edi, dword [edx]
sub dword [ebp - 0x3c], ebx
xor edi, ebx
sub dword [ebp - 0xc], ecx
mov dword [esi], edi
sub dword [ebp - 0x3c], 0xabf1fb3f
add esi, 4
add edx, 0xa85038cc
sub edx, 0xa85038c8
loop 0x413b58
add eax, 0xc3b0e5ea
add eax, 0x3c5070bd
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x33d6ab30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x33d6ab3f
pop dword [ebp - 0x44]
mov eax, 0x2245c05b
sub eax, 0xee6f151c
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xe2310f95
add dword [ebp - 0x54], 0x6c2135b6
mov dword [ebp - 0x50], 0xbd7286ff
add dword [ebp - 0x50], 0x74c0c546
mov dword [ebp - 0x4c], 0xbfb7fd2e
sub dword [ebp - 0x4c], 0x736bb900
mov dword [ebp - 0x48], 0xb1f2d6d
sub dword [ebp - 0x48], 0xb1f2d6d
lea eax, [ebp - 0x54]
push eax
mov eax, 0x9f86470
add eax, 0x29d7ac98
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xd3c2b51e
add dword [ebp - 0x54], 0xa0afb438
mov dword [ebp - 0x50], 0x319d8219
sub dword [ebp - 0x50], 0xf03120a4
mov dword [ebp - 0x4c], 0xe9d980c5
sub dword [ebp - 0x4c], 0x866a1459
mov dword [ebp - 0x48], 0xa63a21ef
add dword [ebp - 0x48], 0x59c5de11
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xf0ea272d
add eax, 0x42e5e9f7
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3798e
push 0
call eax
mov ecx, 0x194cf202
sub ecx, 0x194cacbd
xor edx, edx
add edx, eax
mov edi, 0x9fff8e05
sub edi, 0x6c287e05
add edi, dword [ebp - 0x44]
mov esi, 0x392e070f
sub esi, 0x30f5df83
mov ebx, dword [edi]
xor ebx, esi
mov dword [ebp - 0x20], 0x8562913e
mov dword [edx], ebx
mov dword [ebp - 0x30], 0x1e0a6ccf
add edx, 4
add edi, 4
loop 0x33d6ac63
add eax, 0xd0ce1c07
add eax, 0x2f32ebe0
mov ebx, eax
add eax, 0xb9b99469
sub eax, 0xb9b99464
mov ecx, 0x2f9cf82c
add ecx, 0x43307d4
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x1001ec1a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x1001ec29
pop dword [ebp - 0x14]
mov eax, 0x22b0f4d4
add eax, 0xed50f755
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xd286b225
sub dword [ebp - 0x24], 0x84346cda
mov dword [ebp - 0x20], 0xe4f359bc
sub dword [ebp - 0x20], 0xb2c00d77
mov dword [ebp - 0x1c], 0xe4792b69
sub dword [ebp - 0x1c], 0x982ce73b
mov dword [ebp - 0x18], 0xc861e702
sub dword [ebp - 0x18], 0xc861e702
lea eax, [ebp - 0x24]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xac426580
add dword [ebp - 0x24], 0xc83003d6
mov dword [ebp - 0x20], 0x65657e5f
sub dword [ebp - 0x20], 0x23f91cea
mov dword [ebp - 0x1c], 0xdf57e952
sub dword [ebp - 0x1c], 0x7be87ce6
mov dword [ebp - 0x18], 0xddede9d9
sub dword [ebp - 0x18], 0xddede9d9
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xca157764
add eax, 0x45ec889c
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3c262
push 0
call eax
mov ecx, 0x87f9ee1f
sub ecx, 0x87f9a7e3
mov esi, eax
mov edx, 0x1002bc00
add edx, dword [ebp - 0x14]
mov ebx, 0x7896131f
sub dword [ebp - 8], 0xc79ae06d
mov edi, dword [edx]
add edi, ebx
xor dword [ebp - 8], edi
mov dword [esi], edi
add dword [ebp - 4], 0x9c5d80be
add esi, 0x6a4b428a
add esi, 0x95b4bd7a
add edx, 0xe0e10059
add edx, 0x1f1effab
loop 0x1001ed3a
add eax, 0x10bc3
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xe45d0a37
add ecx, 0x2ba2f5c9
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x403992
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
xor esi, esi
cmp dword [esp + 0x10], esi
jbe 0x4039e2
push ebx
mov ebx, dword [esp + 0x14]
and ebx, 1
mov al, byte [esi + ebp]
mov ecx, 0x47d758
xor al, 0x73
sub al, 0x58
push ebx
mov byte [esi + ebp], al
call fcn.00402696
push eax
call fcn.00401e6b
mov al, byte [esi + ebp]
sub al, 0x14
xor al, 0x74
add al, 0x4e
xor al, 0x70
sub al, 0x65
xor al, 0x22
sub al, 0x73
xor al, 0x2a
mov byte [esi + ebp], al
inc esi
pop ecx
cmp esi, dword [esp + 0x14]
jb 0x4039a8
pop ebx
pop esi
pop ebp
ret

Function at 0x4046c6
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x47c500]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x425390
lea ecx, [ebp - 0x1c]
call fcn.00402057
push 0xc
call fcn.00407dde
pop ecx
test eax, eax
je 0x4046fd
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, eax
call fcn.00402109
jmp 0x4046ff
xor eax, eax
mov eax, dword [eax + 4]
shl eax, 2
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push 0x40
push 0x4ac
push 0x47c040
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
call dword [sym.imp.KERNEL32.DLL_FreeConsole]
call fcn.00403969
mov edx, 0x47c040
add edx, 0x188
mov esi, 0x430040
push esi
call edx
lea ecx, [ebp - 0x1c]
call fcn.00403767
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.00407e1c
leave
ret

Function at 0x408a22
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test eax, eax
je 0x408a61
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x408a61
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x408a61
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x408a61
cmp dword [ecx + 0x74], 0xe
jbe 0x408a61
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x417ced
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4292d0
push 0x4292c8
push 0x426e14
push 0x1e
call fcn.00417b5a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x417d21
push dword [ebp + 8]
mov ecx, esi
call dword [0x425138]
call esi
jmp 0x417d27
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x419f56
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00419bf8

Function at 0x419f61
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00419d87

Function at 0x41a35b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00408b90
mov eax, dword [0x47c500]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00417566
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x41a39d
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x41a4f9
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00424250
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x47e008]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.0041b52b
mov ecx, dword [esi*4 + 0x47e008]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x41a4f2
cmp eax, dword [edi + ecx + 0x24]
jne 0x41a4f2
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x41a4f2
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041b52b
add esp, 0x14
test edx, edx
jl 0x41a4f2
jg 0x41a468
test eax, eax
jb 0x41a4f2
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x41a4f2
jl 0x41a482
cmp dword [ebp - 0x1008], eax
ja 0x41a4f2
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x41a4a0
test ebx, ebx
je 0x41a4d9
cmp ecx, edi
jae 0x41a4d9
mov al, byte [ecx]
cmp al, 0xd
jne 0x41a4ba
lea eax, [edi - 1]
cmp ecx, eax
jae 0x41a4c6
cmp byte [ecx + 1], 0xa
jne 0x41a4c6
inc ecx
jmp 0x41a4c6
movzx eax, al
movsx eax, byte [eax + 0x47c7c8]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x41a4a0
cmp edx, ebx
jne 0x41a4a0
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x41a4f7
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00407e1c
leave
ret