joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7003f91
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x7003fa0
pop dword [ebp - 0x20]
mov eax, 0x474c3c60
sub eax, 0x404bfcc0
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x9e21863
sub dword [ebp - 0x30], 0xbb8fd318
mov dword [ebp - 0x2c], 0xe3316e18
sub dword [ebp - 0x2c], 0xb0fe21d3
mov dword [ebp - 0x28], 0x1f0022d3
sub dword [ebp - 0x28], 0xd2b3dea5
mov dword [ebp - 0x24], 0x4e98dff8
add dword [ebp - 0x24], 0xb1672008
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x7b4f1931
sub dword [ebp - 0x30], 0x6dcafdb
mov dword [ebp - 0x2c], 0xdc988385
add dword [ebp - 0x2c], 0x64d3ddf0
mov dword [ebp - 0x28], 0x4a9be213
add dword [ebp - 0x28], 0x18d38a59
mov dword [ebp - 0x24], 0xb54dcfbc
sub dword [ebp - 0x24], 0xb54dcfbc
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x2b2837d6
sub eax, 0x242717a2
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x37711
push 0
call eax
mov ecx, 0x3b41
mov ebx, eax
mov esi, 0xbfd762ce
sub esi, 0xb8d582ce
add esi, dword [ebp - 0x20]
mov edi, 0x1f7f11ef
add dword [ebp - 0x10], 0x3b6d9b14
mov edx, dword [esi]
xor dword [ebp - 0x10], 0x987196b1
add edx, edi
xor dword [ebp - 4], 0x27bf62e1
mov dword [ebx], edx
sub dword [ebp - 0x1c], 0x29109f57
add ebx, 0x983360a6
add ebx, 0x67cc9f5e
add esi, 0x257b236f
add esi, 0xda84dc95
loop 0x70040b1
add eax, 0xdfd7
xor ebx, ebx
add ebx, eax
add eax, 0x601401d9
add eax, 0x9febfe2c
mov ecx, 0x713680d8
add ecx, 0x95c97f28
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x700c938
Capabilities:
Set current directory

Disassembly:
push 8
mov eax, 0x7010cdd
call fcn.07001ea6
mov edi, ecx
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
push esi
call fcn.0700cc00
xor ebx, ebx
mov dword [edi], vtable.FileSharedStream.0
mov dword [edi + 0xc], ebx
mov byte [edi + 0x10], bl
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [edi + 0x18]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0700d3f5
lea ecx, [ebp - 0x10]
call fcn.0700c8d5
mov eax, dword [edi + 0x14]
mov byte [ebp - 4], 2
push dword [eax + 0x14]
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov eax, dword [edi + 0x14]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x700c9a5
mov eax, dword [eax + 0x14]
jmp 0x700c9aa
mov eax, 0x70127b2
push 0x701411c
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov dword [edi + 0xc], eax
pop ecx
pop ecx
test eax, eax
je 0x700c9dc
mov ecx, dword [edi + 4]
call fcn.07007826
lea ecx, [ebp - 0x10]
mov dword [edi + 8], eax
call fcn.07003f91
mov eax, edi
call fcn.07002b7f
ret 4
push str.file_does_not_exist
push ebx
call fcn.07003f91
int3
Function at 0x40632d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x40633c
pop dword [ebp - 0x40]
mov eax, 0xdec35eb8
add eax, 0x217d0484
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xf474aae2
add dword [ebp - 0x50], 0x59dd9a69
mov dword [ebp - 0x4c], 0xd971cb3d
add dword [ebp - 0x4c], 0x58c18108
mov dword [ebp - 0x48], 0x31ba494f
sub dword [ebp - 0x48], 0xe56e0521
mov dword [ebp - 0x44], 0xb639002a
sub dword [ebp - 0x44], 0xb639002a
lea eax, [ebp - 0x50]
push eax
mov eax, 0xb2fa09cb
sub eax, 0xb2b9996b
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xb9d8519b
sub dword [ebp - 0x50], 0x4565e845
mov dword [ebp - 0x4c], 0x5184ddd8
sub dword [ebp - 0x4c], 0x10187c63
mov dword [ebp - 0x48], 0x89f1a4c3
sub dword [ebp - 0x48], 0x26823857
mov dword [ebp - 0x44], 0x6d71ded4
sub dword [ebp - 0x44], 0x6d71ded4
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x38201
push 0
call eax
mov ecx, 0x4e07
xor edx, edx
add edx, eax
mov esi, 0x2431743f
add esi, 0xdc0f8bc1
add esi, dword [ebp - 0x40]
mov ebx, 0xffe269e1
add ebx, 0x8227045a
sub dword [ebp - 8], 0x6553fbc1
mov edi, dword [esi]
xor dword [ebp - 0x30], edx
xor edi, ebx
xor dword [ebp - 0x20], eax
mov dword [edx], edi
sub dword [ebp - 0x2c], ecx
add edx, 0x3ada51a9
add edx, 0xc525ae5b
add esi, 4
loop 0x406455
add eax, 0x12aef
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x40556c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
das
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
invalid
mov ch, 0x80
cld
invalid

Function at 0x4058f3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0x18]
push esi
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
sbb eax, eax
mov esi, dword [ebp + 0x14]
and eax, 0x100
or eax, 0x20019
mov byte [esi], bl
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405964
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x400
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405953
cmp dword [ebp + 0x14], 1
je 0x405955
cmp dword [ebp + 0x14], 2
je 0x405955
mov byte [esi], bl
push dword [ebp + 0x18]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x7f5f8a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x18], 0x2215443e
lea esp, [esp + 0x1c]
jmp fcn.00b0e334
Function at 0xb41044
Capabilities:
Resolve function by parsing pe exports

Disassembly:
ret
jne 0xb7a881
mov edi, dword [eax + esi + 4]
xor edi, edx
cmp ax, sp
cmp edi, dword [ecx + 0x20]
jmp 0xb7112f
mov esp, edi
pop esi
popfd
movsx ebx, cx
call fcn.00cb4a83
jae 0xb7a881
mov edi, dword [eax + esi]
test esp, edx
test eax, 0xc3af1119
xor edi, edx
jmp 0xc4d8e8
jae 0xb71370
mov ebx, dword [eax + esi]
xor ebx, edx
jmp 0xb4a324
cmp edi, dword [ecx + 0x38]
jmp 0xbba7f8
neg al
push 0x11114db7
ror al, 1
xor bl, al
sal byte [esp + 0x11], 0x82
lea eax, [esp + eax + 0x14]
jns 0xc3c8f4
cmp ebx, dword [ecx + 0x28]
jmp 0xc4f5a2
cmp edi, dword [ecx + 0x24]
jmp 0xb7a87b
jae 0xbba7fe
mov edi, dword [eax + esi]
xor edi, edx
stc
jmp 0xc0c652
jne 0xb7a881
movzx edi, word [eax + esi + 8]
cmp cl, dh
cmp di, 0x41b7
xor edi, edx
jmp 0xb52532
je 0xc0dc1b
mov ebx, dword [ebp + 8]
test ax, di
stc
lea edi, [edi + 3]
cmp ecx, 0x3092123f
cmp edi, ebx
jmp 0xb5a8cb
jne 0xbba7fe
movzx edi, byte [eax + esi + 8]
test eax, 0x3435ff34
jmp 0xc651d3
je 0xc0dc1b
mov edi, dword [ebp - 8]
cmp edi, ebx
jmp 0xb08019
je 0xc0dc1b
inc eax
cmp bl, 0x18
stc
cmp eax, ebx
jmp 0xbddf89
mov esp, ebp
cmova ebp, edx
xchg ebp, ebp
pop ebp
jmp 0x7f446e
jb 0xc8a12f
pop edi
rcl bh, 0x33
dec ebx
sub bh, 0xb4
sub al, al
not ebx
setg bh
movzx bx, bl
pop ebx
jmp 0xbcc3a8
cmp edi, dword [ecx + 0x30]
jmp 0xc6167b
mov word [eax], dx
js 0xaebba3
push 0xa1288833
lea esp, [esp + 0x18]
jae fcn.00c7e82a
cmp edi, dword [ecx + 0x1c]
jmp 0x7f48c1
jne 0xb71369
movzx ebx, word [eax + esi + 4]
cmp dh, 0xd
jmp 0xcb60b4
jne 0xbba7fe
mov edi, dword [eax + esi + 4]
stc
test sp, si
cmc
xor edi, edx
cmp edi, dword [ecx + 0x34]
jmp 0xb743af
xor edi, edx
stc
cmc
jmp 0xb0d6aa
mov ebx, dword [ebp - 4]
lea edi, [eax + esi]
stc
add edi, ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], edi
lea edi, [edi + 4]
cmp ah, 0x14
cmp edi, ebx
jmp 0xaebbaf
xor ebx, edx
cmp ebx, dword [ecx + 0x2c]
jmp 0xb71363

Function at 0xb68591
Capabilities:
Encode data using xor

Disassembly:
pop ecx
pop ecx
pop eax
call fcn.00b8d5ec
mov ecx, 0x992ee8d
movsx edx, cx
lea edx, [edx*4 + 0x711338a9]
mov dx, word [edi + ecx*2 - 0x1325dd1a]
bt ecx, ecx
dec cx
mov cl, byte [edi + ecx - 0x992ee8a]
push 0x9b9d078d
rol dword [esp], 0x2e
adc edi, 1
push 0xda1c1da9
sal byte [esp + 1], 0x46
jb 0xca2423
dec esi
sahf
adc eax, dword [eax]
adc byte [edx], 0xb3
push es
loopne 0xb68612
and al, bh
mov dword [0x56f3173f], eax
or edi, dword [edx + 0x5f7ee11f]
mov dl, 0xda
fiadd word [edi + 0x5c]
in al, dx
movsb byte es:[edi], byte [esi]
test dword [edi], 0x9d5c2140
aaa
xchg ebp, eax
pop edx
mov eax, 0x4ba81d3e
push ds
imul eax, dword [edx], 0x63
xor cl, byte [esi + 0x1c]
lodsb al, byte [esi]
push edx
test al, 0xb8
std
stosd dword es:[edi], eax
dec ebp
inc ebx
out 0xf4, al
push ecx
ja 0xb685d1
mov esi, 0xc3aa5d0c
outsd dx, dword [esi]
leave
in al, dx
nop
sub eax, 0x328873bc
dec ebp
shl byte [ebp - 0x7e], 0xe8
xchg edi, eax
add byte es:[eax + 0x42], cl
xchg ebp, eax
mov byte [0x54436963], al
lds ecx, [ebx + 0x66cbd628]
pop ds
invalid
or al, 0x5d
stosb byte es:[edi], al
ret
sal dx, cl
mov word [edi], dx
not byte [esp + 5]
call fcn.00afe966
Function at 0xbdd153
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov word [edx], ax
setae byte [esp + 0x1c]
ja 0xb5f911
mov ebp, 0xd991fc0f
mov bp, word [esi]
mov cl, byte [esi + 2]
jmp 0x816d96
jmp 0xc4b356
lea esp, [esp + 0x24]
ja fcn.00c4d992
jp 0x80d2ca
lea esp, [esp + 0x10]
jge fcn.00b0e334
mov edx, 0xf02bc522
mov edx, dword [edi]
mov ebp, 0x329b5800
mov ebp, dword [ebp + edi - 0x329b57fc]
call fcn.00b83e1c
add esi, 2
push 0x4db9ca0e
sal bp, cl
call fcn.007e089e
xlatb
xor bl, al
adc ebp, dword [eax + 0x78]
jnp 0xc4b39c
cwde
mov byte [ebx - 0xc4757ad], al
mov dword [0x13038898], eax
push eax
xor bl, 0x23
inc eax
adc byte [ebx], bh
sub edi, dword [eax]
sub byte [ebx + 0x2b], bh
or byte [ebp + 0x88903f5], ah
xor byte [eax + 0x6b], dh
add byte [eax - 0x3894bf6e], ch
invalid
dec ecx
scasd eax, dword es:[edi]
dec edx
pop eax
ljmp 0xae2d

Function at 0xcbb9f1
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 4], 0x160557a5
adc edi, 2
push 0xf704d115
call fcn.00b182fc
call fcn.00bb01f0
push 0x2f09dfba
rol bp, 1
dec dword [esp + 0xc]
jp 0x803dc4
neg dword [esp + 9]
not bp
mov word [esp + 1], 0xa781
xor bx, bp
sub esi, 2
call fcn.00c1d312
jg 0x80c5da
inc bp
jmp 0xc0c624

Function at 0xcc8400
Capabilities:
Get number of processors

Disassembly:
mov edx, 0x316c11e
movzx dx, byte [eax + edx*2 - 0x62d823c]
jmp 0xb0465f
mov word [esi], dx
lea esp, [esp + 0x14]
jmp fcn.00b743a5
jg 0xc98dcd
inc dl
push 0x5aadf603
mov dword [esp + 4], 0x722dba19
xor dl, 0x2f
sar dword [esp + 8], 0xd6
jns 0xb8017d
daa
jecxz 0x81345f
or byte [ebx + 0x73f8e8db], 0x63
invalid
call fcn.007dfd81
add edi, 2
jmp 0xc24b0b
ja 0xaffa19
not dl
xor dl, 0x2f
sar dword [esp + 4], 0x3b
add dword [esp], 0x6f0bde89
xor bl, dl
inc word [esp + 8]
lea edx, [esp + edx + 0xc]
mov byte [edx], al
call fcn.007f8dec
mov esi, 0x7d3c248f
mov ecx, dword [edi + esi - 0x7d3c248f]
inc esi
mov eax, esi
movzx ebp, si
lea edi, [esi + edi - 0x7d3c248c]
sar ebp, 0xc
cdq
mov ebp, ecx
add al, 0xa4
jbe 0xc858c5
mov dword [esp], 0xca32e8b4
lea esp, [esp + 4]
jmp fcn.00c6e754
shr word [esp + 6], 0x43
ror dl, 1
inc dl
shl dword [esp + 3], 0x56
not dl
neg dl
jmp 0xbab386
rol dword [esp + 2], 0xc6
jae 0xb525b3
jmp 0x80b7de
mov word [edi], dx
jmp 0xc79237
jmp 0xcc1276
xor dl, bl
push 0x172ffbb9
not dl
shr word [esp + 4], 0x42
jns 0x8134af
mov eax, dword [edi]
jmp 0x804c3a
not cl
jge 0xb069f4
jmp fcn.00c4d992
mov dword [esp], 0x1b7fe15
jmp 0xc86816

Function at 0x402ca8
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x402ce7
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x402ce7
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x402ce7
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x402ce7
cmp dword [ecx + 0x74], 0xe
jbe 0x402ce7
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x2983d943
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x2983d952
pop dword [ebp - 0x18]
mov eax, 0x2983d952
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x4ecd1cc0
sub dword [ebp - 0x28], 0x7ad775
mov dword [ebp - 0x24], 0xdf152d29
add dword [ebp - 0x24], 0x531e1f1c
mov dword [ebp - 0x20], 0xcb45c863
sub dword [ebp - 0x20], 0x7ef98435
mov dword [ebp - 0x1c], 0xdf10dcc1
add dword [ebp - 0x1c], 0x20ef233f
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x498c0922
add dword [ebp - 0x28], 0x2ae66034
mov dword [ebp - 0x24], 0x16c881e
add dword [ebp - 0x24], 0x3fffd957
mov dword [ebp - 0x20], 0xa8757142
add dword [ebp - 0x20], 0xbaf9fb2a
mov dword [ebp - 0x1c], 0xb1c5c3bc
add dword [ebp - 0x1c], 0x4e3a3c44
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x48547
push 0
call eax
mov ecx, 0x7444ee27
add ecx, 0x8bbb5ade
xor esi, esi
add esi, eax
mov edx, 0x4d71f121
sub edx, 0x23e88d21
add edx, dword [ebp - 0x18]
mov edi, 0x865eecc0
xor dword [ebp - 8], 0x81f35003
mov ebx, dword [edx]
xor dword [ebp - 0xc], 0x196e39a3
xor ebx, edi
sub dword [ebp - 0xc], 0x52ed4f96
mov dword [esi], ebx
add esi, 4
add edx, 0xf58f7587
add edx, 0xa708a7d
loop 0x2983da61
add eax, 0x116e7
mov ebx, eax
add eax, 0x85857330
sub eax, 0x8585732b
mov ecx, 0xa1395ea5
add ecx, 0x8846a15b
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x10001f50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10008004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, 0xffff
mov esi, ecx
cmp bx, di
jne 0x10001f87
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100030bd
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x10001fbd
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
lea edx, [ecx + edx*2]
cmp ecx, edx
jae 0x10001fbd
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_protected:_wchar_t____thiscall_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::_Pninc_void_]
mov word [eax], di
mov ax, di
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100030bd
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x10002092
mov ecx, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [ecx], eax
jne 0x10001fea
mov eax, dword [esi + 0xc]
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
sar edx, 1
mov dword [eax], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1000201f
push dword [esi + 0x4c]
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
add esp, 8
cmp ax, bx
movzx eax, di
jne 0x10002095
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100030bd
mov esp, ebp
pop ebp
ret 4
movzx eax, di
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_wchar_t__char__struct__Mbstatet_::out_struct__Mbstatet___wchar_t_const___wchar_t_const___wchar_t_const____char___char___char___const]
sub eax, 0
je 0x1000205e
sub eax, 1
je 0x1000205e
sub eax, 2
jne 0x10002092
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x10001ff5
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x34], eax
je 0x10002082
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0x34], eax
jne 0x10002092
lea ecx, [ebp - 0x28]
movzx eax, di
cmp dword [ebp - 0x30], ecx
mov byte [esi + 0x3e], 1
cmovne ebx, eax
mov ax, bx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100030bd
mov esp, ebp
pop ebp
ret 4
Function at 0x10002400
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10008004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x100024c4
cmp byte [esi + 0x3e], 0
je 0x100024c4
mov eax, dword [esi]
push edi
push 0xffff
call dword [eax + 0xc]
mov ecx, 0xffff
cmp cx, ax
je 0x100024b2
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10002479
sub eax, 1
je 0x1000247d
sub eax, 2
jne 0x100024b2
mov byte [esi + 0x3e], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100030bd
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3e], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1000249b
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100024b2
cmp byte [esi + 0x3e], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100030bd
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100030bd
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100030bd
mov esp, ebp
pop ebp
ret
Function at 0x40c3a3
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40c440
push ebx
push esi
call fcn.0040c36c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040c300
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40c3ed
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40c43f
push edi
push eax
call fcn.0040cfc0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40c40d
call fcn.0040ae61
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40c43e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040c300
add esp, 0x20
test eax, eax
jne 0x40c42c
push edi
call fcn.0040ae61
jmp 0x40c434
push ebx
call fcn.0040ae61
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40d73d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x46fd30
push 0x46fd28
push str.FlsAlloc
push 0x1f
call fcn.0040d5fc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d771
push dword [ebp + 8]
mov ecx, esi
call dword [0x42114c]
call esi
jmp 0x40d777
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40d7bb
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x46fd40
push 0x46fd38
push str.FlsGetValue
push 0x21
call fcn.0040d5fc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d7f2
push dword [ebp + 8]
mov ecx, esi
call dword [0x42114c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40d7fa
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x46fd48
push 0x46fd40
push str.FlsSetValue
push 0x22
call fcn.0040d5fc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d834
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x42114c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x7001387
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x7001396
pop dword [ebp - 0x1c]
mov eax, 0x7001396
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xe0ca1831
add dword [ebp - 0x2c], 0x6d882d1a
mov dword [ebp - 0x28], 0xefd861a3
sub dword [ebp - 0x28], 0xbda5155e
mov dword [ebp - 0x24], 0x5c14fc6b
add dword [ebp - 0x24], 0xf03747c3
mov dword [ebp - 0x20], 0x373bf026
sub dword [ebp - 0x20], 0x373bf026
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x485a2953
add eax, 0xbea6f6dd
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xa197be73
sub dword [ebp - 0x2c], 0x2d25551d
mov dword [ebp - 0x28], 0xe4bf617f
add dword [ebp - 0x28], 0x5cacfff6
mov dword [ebp - 0x24], 0x8745c9ce
sub dword [ebp - 0x24], 0x23d65d62
mov dword [ebp - 0x20], 0xe25a95d0
add dword [ebp - 0x20], 0x1da56a30
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3a48c
push 0
call eax
mov ecx, 0x43adfc78
sub ecx, 0x43adb5ae
mov edx, eax
mov esi, 0x701e000
add esi, dword [ebp - 0x1c]
mov ebx, 0x86d3c02d
add ebx, 0x7fc7f909
mov dword [ebp - 8], 0x54b0cb27
mov edi, dword [esi]
xor dword [ebp - 0x18], esi
add edi, ebx
sub dword [ebp - 0x18], ebx
mov dword [edx], edi
add dword [ebp - 0x18], 0xf45e3818
add edx, 0xec434b54
add edx, 0x13bcb4b0
add esi, 0xb6cb0d95
add esi, 0x4934f26f
loop 0x70014a8
add eax, 0x5334d8a4
add eax, 0xaccc3557
xor ebx, ebx
add ebx, eax
add eax, 0xcfa467f9
sub eax, 0xcfa467f4
mov ecx, 0x7000000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x700c938
Capabilities:
Set current directory

Disassembly:
push 8
mov eax, 0x7010cdd
call fcn.07001ea6
mov edi, ecx
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
push esi
call fcn.0700cc00
xor ebx, ebx
mov dword [edi], vtable.FileSharedStream.0
mov dword [edi + 0xc], ebx
mov byte [edi + 0x10], bl
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [edi + 0x18]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0700d3f5
lea ecx, [ebp - 0x10]
call fcn.0700c8d5
mov eax, dword [edi + 0x14]
mov byte [ebp - 4], 2
push dword [eax + 0x14]
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov eax, dword [edi + 0x14]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x700c9a5
mov eax, dword [eax + 0x14]
jmp 0x700c9aa
mov eax, 0x70127b2
push 0x701411c
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov dword [edi + 0xc], eax
pop ecx
pop ecx
test eax, eax
je 0x700c9dc
mov ecx, dword [edi + 4]
call fcn.07007826
lea ecx, [ebp - 0x10]
mov dword [edi + 8], eax
call fcn.07001387
mov eax, edi
call fcn.07002b7f
ret 4
push str.file_does_not_exist
push ebx
call fcn.07001387
int3
Function at 0x402a40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x402a99
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402a99
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x402a8a
cmp esi, edx
jae 0x402a99
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x402a78
cmp esi, edx
jae 0x402a99
cmp word [esi], 0
je 0x402a99
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x405060
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.00409c90