joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44bc0b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x44bc2e
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x44bc2e
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x44bc38
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x44bc7a
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x44bcdc
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x44bcd7
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x44bcc2
test dl, dl
je 0x44bcbe
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x44bcc2
add ecx, 2
add eax, 2
test dl, dl
jne 0x44bca2
xor eax, eax
jmp 0x44bcc7
sbb eax, eax
or eax, 1
test eax, eax
je 0x44bce8
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x44bc8f
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x44bd7a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x44bd9d
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x44bd9d
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x44bda7
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x44bde9
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x44be4b
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x44be46
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x44be31
test dl, dl
je 0x44be2d
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x44be31
add ecx, 2
add eax, 2
test dl, dl
jne 0x44be11
xor eax, eax
jmp 0x44be36
sbb eax, eax
or eax, 1
test eax, eax
je 0x44be57
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x44bdfe
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x44bee4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x44bf07
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x44bf07
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x44bf11
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x44bf53
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x44bfb5
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x44bfb0
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x44bf9b
test dl, dl
je 0x44bf97
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x44bf9b
add ecx, 2
add eax, 2
test dl, dl
jne 0x44bf7b
xor eax, eax
jmp 0x44bfa0
sbb eax, eax
or eax, 1
test eax, eax
je 0x44bfc1
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x44bf68
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x44c05a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x44c07d
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x44c07d
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x44c087
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x44c0c9
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x44c12b
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x44c126
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x44c111
test dl, dl
je 0x44c10d
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x44c111
add ecx, 2
add eax, 2
test dl, dl
jne 0x44c0f1
xor eax, eax
jmp 0x44c116
sbb eax, eax
or eax, 1
test eax, eax
je 0x44c137
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x44c0de
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x44c1cb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x44c1ee
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x44c1ee
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x44c1f8
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x44c23a
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x44c29c
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x44c297
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x44c282
test dl, dl
je 0x44c27e
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x44c282
add ecx, 2
add eax, 2
test dl, dl
jne 0x44c262
xor eax, eax
jmp 0x44c287
sbb eax, eax
or eax, 1
test eax, eax
je 0x44c2a8
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x44c24f
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x44c33a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x44c35d
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x44c35d
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x44c367
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x44c3a9
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x44c40b
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x44c406
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x44c3f1
test dl, dl
je 0x44c3ed
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x44c3f1
add ecx, 2
add eax, 2
test dl, dl
jne 0x44c3d1
xor eax, eax
jmp 0x44c3f6
sbb eax, eax
or eax, 1
test eax, eax
je 0x44c417
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x44c3be
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x44c4a9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x44c4cc
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x44c4cc
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x44c4d6
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x44c518
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x44c57a
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x44c575
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x44c560
test dl, dl
je 0x44c55c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x44c560
add ecx, 2
add eax, 2
test dl, dl
jne 0x44c540
xor eax, eax
jmp 0x44c565
sbb eax, eax
or eax, 1
test eax, eax
je 0x44c586
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x44c52d
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8

Function at 0x4544f5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [esi]
mov edx, dword [esi + 4]
bswap eax
bswap edx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], esp
mov esp, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
xor eax, dword [ecx + edi*4]
mov edi, eax
mov esi, eax
shr edi, 0x18
shr esi, 0x10
and esi, 0xff
mov ebx, dword [esp + edi*4]
add ebx, dword [esp + esi*4 + 0x400]
movzx edi, ah
movzx esi, al
xor ebx, dword [esp + edi*4 + 0x800]
add ebx, dword [esp + esi*4 + 0xc00]
xor ebx, edx
inc dword [ebp - 4]
mov edx, eax
cmp dword [ebp - 4], 0x10
mov eax, ebx
jne 0x454518
mov esp, dword [ebp - 8]
xchg edx, eax
xor edx, dword [ecx + 0x40]
xor eax, dword [ecx + 0x44]
mov esi, dword [ebp + 8]
bswap eax
bswap edx
mov dword [esi], eax
mov dword [esi + 4], edx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4545f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [esi]
mov edx, dword [esi + 4]
bswap eax
bswap edx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], esp
mov esp, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
xor eax, dword [ecx + edi*4]
mov edi, eax
mov esi, eax
shr edi, 0x18
shr esi, 0x10
and esi, 0xff
mov ebx, dword [esp + edi*4]
add ebx, dword [esp + esi*4 + 0x400]
movzx edi, ah
movzx esi, al
xor ebx, dword [esp + edi*4 + 0x800]
add ebx, dword [esp + esi*4 + 0xc00]
xor ebx, edx
inc dword [ebp - 4]
mov edx, eax
cmp dword [ebp - 4], 0x10
mov eax, ebx
jne 0x454613
mov esp, dword [ebp - 8]
xchg edx, eax
xor edx, dword [ecx + 0x40]
xor eax, dword [ecx + 0x44]
mov esi, dword [ebp + 8]
bswap eax
bswap edx
mov dword [esi], eax
mov dword [esi + 4], edx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4547cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [esi]
mov edx, dword [esi + 4]
bswap eax
bswap edx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], esp
mov esp, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
xor eax, dword [ecx + edi*4]
mov edi, eax
mov esi, eax
shr edi, 0x18
shr esi, 0x10
and esi, 0xff
mov ebx, dword [esp + edi*4]
add ebx, dword [esp + esi*4 + 0x400]
movzx edi, ah
movzx esi, al
xor ebx, dword [esp + edi*4 + 0x800]
add ebx, dword [esp + esi*4 + 0xc00]
xor ebx, edx
inc dword [ebp - 4]
mov edx, eax
cmp dword [ebp - 4], 0x10
mov eax, ebx
jne 0x4547ef
mov esp, dword [ebp - 8]
xchg edx, eax
xor edx, dword [ecx + 0x40]
xor eax, dword [ecx + 0x44]
mov esi, dword [ebp + 8]
bswap eax
bswap edx
mov dword [esi], eax
mov dword [esi + 4], edx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x40193b
Capabilities:
Accept command line arguments

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push str._test:
push eax
call fcn.00401f48
pop ecx
test eax, eax
pop ecx
je 0x40196b
add eax, 6
push eax
push dword [esp + 8]
push str.test
push 0x406168
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
ret
push 0x10
push str.Extracting
push dword [esp + 0xc]
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
ret

Function at 0x40197f
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push 0x81
call fcn.00401e3f
xor ebx, ebx
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
mov byte [eax], bl
mov dword [esp], 0x4074a8
call fcn.00401883
mov eax, dword [0x407418]
cmp eax, ebx
je 0x4019e8
push ebx
lea ecx, [ebp - 8]
push ebx
push ecx
push 0x400
push eax
push ebx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push dword [ebp - 8]
lea ecx, [ebp - 4]
call fcn.00401883
push 0x4060bc
lea ecx, [ebp - 4]
call fcn.004018bd
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [0x40741c]
lea ecx, [ebp - 4]
push dword [eax]
call fcn.004018bd
push str._lerr:
lea ecx, [ebp - 4]
call fcn.004018bd
push dword [0x407418]
call fcn.00401ea3
pop ecx
push eax
lea ecx, [ebp - 4]
call fcn.004018bd
cmp dword [0x407314], ebx
je 0x401a4b
push str._uz:
lea ecx, [ebp - 4]
call fcn.004018bd
lea eax, [ebp - 0x30]
push 0xa
push eax
push dword [0x407314]
call fcn.00401e86
add esp, 0xc
lea ecx, [ebp - 4]
push eax
call fcn.004018bd
push 0x7f00
push dword [0x4074a4]
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
push dword [ebp - 4]
call fcn.0040193b
cmp dword [ebp - 4], ebx
pop ecx
pop ebx
je 0x401a7b
push dword [ebp - 4]
call fcn.00401e4a
pop ecx
push 1
pop eax
leave
ret

Function at 0x401a80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push 0
push 0x4060ac
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push dword [ebp + 0xc]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.00401aac
add esp, 0x10
pop ebp
ret
Function at 0x401aac
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
push dword [ebp + 0x14]
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, esi
mov dword [ebp - 0xc], eax
je 0x401bcf
cmp eax, 0xffffffff
je 0x401bcf
mov eax, dword [ebp + 0x10]
cmp eax, esi
jg 0x401afc
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
sub eax, dword [ebp + 0xc]
push ebx
push edi
push esi
push esi
push dword [ebp + 0xc]
mov dword [ebp + 0x10], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, 0x10000
push edi
call fcn.00401e3f
pop ecx
mov dword [ebp + 0xc], eax
mov ebx, dword [ebp + 0x10]
cmp ebx, esi
je 0x401bb6
cmp ebx, edi
jb 0x401b2f
mov ebx, edi
lea eax, [ebp - 8]
push esi
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 8]
cmp eax, ebx
jb 0x401b67
lea ecx, [ebp - 0x10]
push esi
sub dword [ebp + 0x10], eax
push ecx
push eax
push dword [ebp + 0xc]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 8]
jne 0x401b8a
jmp 0x401b1e
mov ecx, dword [0x40741c]
push str.CopyF__r____
call fcn.00401883
push dword [ebp + 0x14]
mov ecx, dword [0x40741c]
call fcn.004018bd
mov dword [ebp - 4], esi
jmp 0x401bb6
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x40741c]
push str.WrF
mov dword [0x407418], eax
call fcn.00401883
push dword [ebp + 0x14]
mov ecx, dword [0x40741c]
call fcn.004018bd
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0xc]
call fcn.00401e4a
mov eax, dword [ebp - 4]
pop ecx
pop edi
pop ebx
jmp 0x401bfa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x40741c]
push str.Creat
mov dword [0x407418], eax
call fcn.00401883
push dword [ebp + 0x14]
mov ecx, dword [0x40741c]
call fcn.00401883
xor eax, eax
pop esi
leave
ret

Function at 0x401dc8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
xor esi, esi
push 0x44
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.00402018
add esp, 0xc
lea eax, [ebp - 0x10]
mov dword [ebp - 0x54], 0x44
mov word [ebp - 0x24], 5
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp - 8]
call fcn.00401d45
pop ecx
pop esi
leave
ret
Function at 0x402237
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x402249
xor eax, eax
jmp 0x40235b
cmp dword [0x4061c0], 0
je 0x402257
call fcn.004021e6
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x10], 8
push edi
mov ecx, 0xff
not eax
jb 0x402337
mov edi, dword [ebp + 0x10]
push ebx
shr edi, 3
movzx ebx, byte [esi]
mov edx, eax
sub dword [ebp + 0x10], 8
and edx, ecx
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x4074ac]
xor eax, ebx
inc esi
mov edx, eax
movzx ebx, byte [esi]
and edx, ecx
xor edx, ebx
movzx ebx, byte [esi + 1]
mov edx, dword [edx*4 + 0x4074ac]
shr eax, 8
xor edx, eax
inc esi
mov eax, edx
and eax, ecx
xor eax, ebx
movzx ebx, byte [esi + 1]
mov eax, dword [eax*4 + 0x4074ac]
shr edx, 8
xor eax, edx
inc esi
mov edx, eax
and edx, ecx
xor edx, ebx
movzx ebx, byte [esi + 1]
mov edx, dword [edx*4 + 0x4074ac]
shr eax, 8
xor edx, eax
inc esi
mov eax, edx
and eax, ecx
xor eax, ebx
movzx ebx, byte [esi + 1]
mov eax, dword [eax*4 + 0x4074ac]
shr edx, 8
xor eax, edx
inc esi
mov edx, eax
and edx, ecx
xor edx, ebx
movzx ebx, byte [esi + 1]
mov edx, dword [edx*4 + 0x4074ac]
shr eax, 8
xor edx, eax
inc esi
mov eax, edx
and eax, ecx
xor eax, ebx
movzx ebx, byte [esi + 1]
mov eax, dword [eax*4 + 0x4074ac]
shr edx, 8
xor eax, edx
inc esi
mov edx, eax
and edx, ecx
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4074ac]
xor eax, edx
inc esi
dec edi
jne 0x402273
pop ebx
cmp dword [ebp + 0x10], 0
je 0x402358
movzx edi, byte [esi]
mov edx, eax
and edx, ecx
xor edx, edi
shr eax, 8
mov edx, dword [edx*4 + 0x4074ac]
xor eax, edx
inc esi
dec dword [ebp + 0x10]
jne 0x40233d
not eax
pop edi
pop esi
pop ebp
ret

Function at 0x403c24
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
xor eax, eax
push esi
push eax
push eax
push 3
push eax
push eax
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
shr eax, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
leave
ret
Function at 0x402f74
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x457020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40300c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402fec
xor eax, eax
push ebp
push 0x402fe5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403028
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402fec
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x457020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x457020], ax
mov esp, ebp
pop ebp
ret

Function at 0x403cd0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x459048], 0
je 0x403d31
cmp word [0x45921c], 0xd7b2
jne 0x403cf9
cmp dword [0x459224], 0
jbe 0x403cf9
mov eax, 0x459218
call dword [0x459234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x45706c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403d58
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x457030], 0
jne 0x403d4d
push 0
push 0x457064
push 0x45706c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret