joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413fa0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xf0
mov edi, dword [0x41d234]
mov esi, dword [ebp + 8]
test edi, edi
je 0x414160
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x41d234]
movzx eax, al
bt eax, esi
jae 0x4141c0
mov ecx, dword [0x41d224]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x414066
test byte [0x415a28], 8
jne 0x414100
lea ebx, [esp + 0x28]
mov edi, ebx
test byte [0x415a38], 8
jne 0x4140b0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x414035
cmp esi, 3
jbe 0x414070
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x4192e8]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x414035
mov ecx, dword [0x41d234]
test ecx, ecx
je 0x4141a0
mov dword [esp], 0x415a38
call dword [0x41d234]
test al, 8
je 0x41400c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x41400c
mov ebx, dword [0x41d234]
test ebx, ebx
je 0x414180
mov dword [esp], 0x415a28
call dword [0x41d234]
test al, 8
je 0x413ff9
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [esp + 0x28]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x413fff
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x41d234
call sym._load_func.part.0
jmp 0x413fc0
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x41d234
call sym._load_func.part.0
jmp 0x41410a
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x41d234
call sym._load_func.part.0
jmp 0x4140be
mov eax, 0xffffffff
jmp 0x414066
Function at 0x4143a0
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_narrow_argv
call sym.__initialize_narrow_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___argv
mov edi, dword [eax]
call sym.__get_initial_narrow_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call dbg.main
mov dword [esp], eax
call sym._exit

Function at 0x4144b0
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
call dbg.__main
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov ebx, eax
movzx eax, byte [eax]
test al, al
je 0x41453f
cmp al, 9
je 0x414530
cmp al, 0x20
je 0x414530
mov dword [ebp - 0x6c], 0
xor esi, esi
lea esi, [esi]
cmp al, 0x5c
je 0x414598
cmp al, 0x22
je 0x4145a8
mov dword [ebp - 0x6c], 0
movzx eax, byte [ebx + 1]
add ebx, 1
test al, al
je 0x41453f
cmp al, 9
sete dl
cmp al, 0x20
sete cl
or dl, cl
je 0x4144f0
test esi, 1
jne 0x4144f0
lea esi, [esi]
nop
movzx eax, byte [ebx + 1]
add ebx, 1
cmp al, 9
je 0x414530
cmp al, 0x20
je 0x414530
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
sub esp, 4
test byte [ebp - 0x30], 1
jne 0x41455a
mov word [ebp - 0x2c], 1
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call dbg.WinMain@16
sub esp, 0x10
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
add dword [ebp - 0x6c], 1
jmp 0x414507
and dword [ebp - 0x6c], 1
jne 0x414500
xor esi, 1
jmp 0x414507
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408e84
nop
mov ecx, 0x3d7a2aa6
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x430024
nop
nop
nop
nop
mov eax, str.__c
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x247c07d3
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push 0x44
push 0
lea eax, [ebp - 0x60]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x10
push 0
lea ecx, [ebp - 0x14]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 1
mov edx, 5
mov word [ebp - 0x30], dx
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x60]
push ecx
push 0
push 0
push 0x20
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 1
jne 0x401071
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0x4010a8
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x64], ecx
cmp dword [ebp - 0x64], 0x20
jle 0x4010a6
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0x4010a8
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x4010b0
Capabilities:
Create http request
Get http content length
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov byte [ebp - 5], 0
push 0
push 0
push 0
push 1
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_110.0.0.0_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x401148
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40113e
mov dword [ebp - 0x14], 4
push 0
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x10]
push eax
push 0x20000005
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
cmp dword [ebp - 0x10], 0x1388
jbe 0x401134
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
cmp eax, dword [edx]
je 0x401134
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
mov dword [ecx], edx
mov byte [ebp - 5], 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x401410
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x40448c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x418]
push eax
push str._temp_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ebp - 0x418]
push ecx
push str._s3552526.jpg
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40146d
xor al, al
jmp 0x4014a7
push 0
push 2
push 1
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0xffffffff
je 0x4014a5
mov edx, dword [ebp - 0x41c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402026
mov esp, ebp
pop ebp
ret
Function at 0x402026
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40448c]
jne 0x402030
repz ret
jmp fcn.00402357
Function at 0x406290
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x42dd6b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x40419c
call fcn.0040747b
push 4
mov dword [esp + 0x18], 0
call fcn.00408619
mov edi, eax
add esp, 4
test edi, edi
je 0x406304
push ebx
call fcn.00407276
mov dword [edi], eax
call fcn.00407035
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.0040743c
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4062f8
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.00407464
pop ebx
jmp 0x406306
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x4091eb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x431354]
jne 0x4091f5
repz ret
jmp fcn.0040d7dc
Function at 0x411727
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x431354]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040b413
and dword [ebp - 0x14], 0
cmp dword [0x436aa4], 0
mov dword [ebp - 0x18], eax
jne 0x4117da
push 0x403e88
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x411882
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403e7c
push ebx
call edi
test eax, eax
je 0x411882
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403e6c
push ebx
mov dword [0x436aa4], eax
call edi
push eax
call esi
push 0x403e58
push ebx
mov dword [0x436aa8], eax
call edi
push eax
call esi
push 0x403e3c
push ebx
mov dword [0x436aac], eax
call edi
push eax
call esi
mov dword [0x436ab4], eax
test eax, eax
je 0x4117da
push 0x403e24
push ebx
call edi
push eax
call esi
mov dword [0x436ab0], eax
mov eax, dword [0x436ab0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x411833
cmp dword [0x436ab4], ecx
je 0x411833
push eax
call esi
push dword [0x436ab4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x411833
test ebx, ebx
je 0x411833
call edi
test eax, eax
je 0x41182a
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41182a
test byte [ebp - 8], 1
jne 0x411833
or dword [ebp + 0x10], 0x200000
jmp 0x411866
mov eax, dword [0x436aa8]
cmp eax, dword [ebp - 0x18]
je 0x411866
push eax
call esi
test eax, eax
je 0x411866
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x411866
mov eax, dword [0x436aac]
cmp eax, dword [ebp - 0x18]
je 0x411866
push eax
call esi
test eax, eax
je 0x411866
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x436aa4]
call esi
test eax, eax
je 0x411882
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x411884
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004091eb
leave
ret
Function at 0x428080
Capabilities:
Get common file path

Disassembly:
sub esp, 0xd38
cmp dword [0x7ba80c], 0x37
jne 0x428116
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommModemStatus]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push 0
lea eax, [esp + 0x53c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExA]
lea edx, [esp + 4]
push edx
push 0
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
lea ecx, [esp + 0x13c]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringA]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReplaceFileA]
mov edx, dword [0x7bb800]
mov dword [esp], edx
mov eax, 0x5d1
add dword [esp], eax
mov eax, dword [esp]
mov cl, byte [eax + esi]
mov edx, dword [0x7ba774]
mov byte [edx + esi], cl
add esp, 0xd38
ret
Function at 0x428360
Capabilities:
Accept command line arguments
Manipulate console buffer
Move file

Disassembly:
mov eax, dword [0x7ba80c]
sub esp, 0x28c
push ebx
push ebp
push esi
mov esi, dword [0x7ba774]
push edi
shr eax, 3
xor edi, edi
cmp eax, edi
jbe 0x428557
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], eax
jmp 0x428396
mov esi, dword [esp + 0x20]
xor edi, edi
cmp dword [0x7ba80c], 0x1c
jne 0x4283ad
lea eax, [esp + 0x40]
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
mov ecx, dword [esi + 4]
mov edx, dword [0x4322d4]
mov eax, dword [esi]
mov ebp, dword [0x4322d0]
mov dword [esp + 0x14], ecx
mov ecx, dword [0x4322d8]
mov dword [esp + 0x30], edx
mov edx, dword [0x4322dc]
mov dword [esp + 0x18], eax
mov esi, 0xc6ef3720
mov dword [esp + 0x34], ecx
mov dword [esp + 0x28], edx
mov ebx, 0x20
jmp 0x4283f6
mov eax, dword [esp + 0x18]
xor edi, edi
mov edx, eax
mov ecx, eax
shl edx, 4
add edx, dword [esp + 0x34]
shr ecx, 5
add ecx, dword [esp + 0x28]
add eax, esi
xor edx, eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x10], edx
mov dword [0x7ba778], edi
mov eax, dword [esp + 0x1c]
add dword [0x7ba778], eax
mov ecx, dword [0x7ba778]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x1c], edi
mov eax, dword [esp + 0x2c]
add dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
xor eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x1c]
sub dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov ecx, eax
shl ecx, 4
add ecx, ebp
cmp dword [0x7ba80c], 0x1be
mov dword [esp + 0x10], ecx
lea edi, [esi + eax]
jne 0x4284b8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
lea eax, [esp + 0x44]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
xor eax, eax
lea ecx, [esp + 0x38]
push ecx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
call dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
shr eax, 5
add eax, dword [esp + 0x30]
xor ecx, edi
mov dword [0x7ba780], 0xff6b3619
mov dword [0x7ba784], 0xffffffff
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x1c]
xor dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
sub dword [esp + 0x18], eax
add esi, 0x61c88647
dec ebx
jne 0x4283f0
cmp dword [0x7ba80c], 0x8d4
jne 0x42850c
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov dword [esi], edx
mov dword [esi + 4], eax
cmp dword [0x7ba80c], 0x17
jne 0x428546
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
lea ecx, [esp + 0x48]
push ecx
push 0x403f08
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
add esi, 8
dec dword [esp + 0x24]
mov dword [esp + 0x20], esi
jne 0x428390
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28c
ret
Function at 0x4017d0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45d61e
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4750bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], 0
mov edi, dword [ebp + 8]
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov ebx, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 1
test ebx, ebx
je 0x40199e
mov ecx, dword [ebp + 0xc]
mov al, byte [ecx]
dec ebx
mov byte [ebp + esi - 0x14], al
inc ecx
mov ah, byte [ebp - 0x12]
inc esi
mov dl, byte [ebp - 0x13]
mov dh, byte [ebp - 0x14]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0xe], ah
mov byte [ebp + 0x13], dl
mov byte [ebp - 0xd], dh
cmp esi, 3
jne 0x4018d5
mov al, dh
mov cl, dh
shr al, 2
and cl, 3
mov byte [ebp - 0x18], al
mov al, dl
shl cl, 4
shr al, 4
add cl, al
mov al, ah
mov byte [ebp - 0x17], cl
and ah, 0x3f
mov cl, dl
shr al, 6
and cl, 0xf
mov byte [ebp - 0x15], ah
shl cl, 2
add cl, al
xor esi, esi
mov byte [ebp - 0x16], cl
nop dword [eax]
cmp dword [0x475014], 0x10
mov ecx, section..data
movzx eax, byte [ebp + esi - 0x18]
cmovae ecx, dword [section..data]
movzx eax, byte [eax + ecx]
mov ecx, edi
push eax
call fcn.004019c0
inc esi
cmp esi, 4
jl 0x4018a0
mov ecx, dword [ebp + 0xc]
xor esi, esi
mov dl, byte [ebp + 0x13]
mov dh, byte [ebp - 0xd]
test ebx, ebx
jne 0x401845
mov dword [ebp + 0x10], esi
test esi, esi
je 0x40199e
mov eax, esi
cmp esi, 3
jge 0x40190e
cmp eax, 3
jae 0x4019b2
mov byte [ebp + eax - 0x14], 0
inc eax
cmp eax, 3
jl 0x4018f2
mov cl, byte [ebp - 0x12]
mov dl, byte [ebp - 0x13]
mov dh, byte [ebp - 0x14]
jmp 0x401911
mov cl, byte [ebp - 0xe]
mov al, dh
shr cl, 6
shr al, 2
and dh, 3
mov byte [ebp - 0x18], al
xor ebx, ebx
mov al, dl
shl dh, 4
shr al, 4
and dl, 0xf
add dh, al
shl dl, 2
lea eax, [esi + 1]
mov byte [ebp - 0x17], dh
add dl, cl
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x16], dl
test eax, eax
jle 0x40197c
mov esi, eax
nop word [eax + eax]
cmp dword [0x475014], 0x10
mov ecx, section..data
movzx eax, byte [ebp + ebx - 0x18]
cmovae ecx, dword [section..data]
movzx eax, byte [eax + ecx]
mov ecx, edi
push eax
call fcn.004019c0
inc ebx
cmp ebx, esi
jl 0x401950
mov esi, dword [ebp + 0x10]
cmp esi, 3
jge 0x40199e
mov ebx, 3
sub ebx, esi
nop dword [eax + eax]
push 0x3d
mov ecx, edi
call fcn.004019c0
sub ebx, 1
jne 0x401990
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0045c2ec
int3
Function at 0x402f70
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
cmp eax, 0x270
jne 0x402fc0
lea edx, [edi + 8]
mov esi, eax
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x402f82
mov eax, dword [edi]
jmp 0x4030a7
cmp eax, 0x4e0
jb 0x4030a7
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
push ebp
mov ebp, 0xe3
nop
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub ebp, 1
jne 0x402fe0
mov eax, dword [edi + 0xd50]
lea ebx, [edi + 0xd50]
mov ebp, 0x18c
nop word [eax + eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub ebp, 1
jne 0x403030
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop ebp
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
pop ebx
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
ret