joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102c8c80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102f50fe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea edx, [esi + 0xc]
mov eax, dword [ebp + 0x10]
push edi
mov dword [esi], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 8], eax
mov dword [edx], vtable.google::protobuf::TextFormat::Parser::ParserImpl::ParserErrorCollector.0
mov dword [edx + 4], esi
lea edi, [esi + 0x14]
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [ebp + 0x14], edi
movups xmmword [edi + 4], xmm0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0xf
mov byte [edi + 4], 0
movups xmmword [edi + 0x2c], xmm0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0xf
mov byte [edi + 0x2c], 0
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 2
mov dword [edi + 0x54], edx
lea edx, [edi + 0x60]
mov dword [edi + 0x50], eax
mov dword [edx], 0
mov byte [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x74], 0
mov dword [edi + 0x78], 0xffffffff
mov byte [edi + 0x7c], 0
mov dword [edi + 0x80], 0
mov word [edi + 0x84], 1
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi], 0
mov dword [ebp + 0x10], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x64], 0
mov ecx, dword [edi + 0x50]
push edx
lea edx, [ebp + 0x10]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
test al, al
je 0x102c8d9c
cmp dword [edi + 0x60], 0
lea edx, [edi + 0x60]
je 0x102c8d76
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x5c], eax
mov al, byte [eax]
jmp 0x102c8da9
mov dword [edi + 0x60], 0
xor al, al
mov byte [edi + 0x68], 1
cmp byte [ebp + 0x30], 0
mov byte [ebp - 4], 3
mov byte [edi + 0x58], al
mov eax, dword [ebp + 8]
mov dword [esi + 0x9c], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0xa0], eax
mov al, byte [ebp + 0x20]
mov byte [esi + 0xa4], al
mov al, byte [ebp + 0x24]
mov byte [esi + 0xa5], al
mov al, byte [ebp + 0x28]
mov byte [esi + 0xa6], al
mov al, byte [ebp + 0x2c]
mov byte [esi + 0xa7], al
mov byte [esi + 0xa8], 0
mov byte [esi + 0x90], 1
mov dword [esi + 0x94], 1
je 0x102c8e0d
mov word [esi + 0x98], 0x100
lea ecx, [esi + 0x14]
call fcn.102c63d0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x2c
Function at 0x102d1d40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x102d1f19
cmp dword [esi + 0x20], 0
je 0x102d1f19
cmp dword [esi + 0x24], 0
je 0x102d1f19
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x102d1f19
cmp dword [eax], esi
jne 0x102d1f19
mov eax, dword [eax + 4]
cmp eax, 0x2a
je 0x102d1da3
cmp eax, 0x39
je 0x102d1da3
cmp eax, 0x45
je 0x102d1da3
cmp eax, 0x49
je 0x102d1da3
cmp eax, 0x5b
je 0x102d1da3
cmp eax, 0x67
je 0x102d1da3
cmp eax, 0x71
je 0x102d1da3
cmp eax, 0x29a
jne 0x102d1f19
push edi
mov edi, dword [esi + 0x1c]
mov dword [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x2c], 2
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 8]
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], eax
test ecx, ecx
jns 0x102d1ddc
neg ecx
mov dword [edi + 0x18], ecx
cmp ecx, 2
mov eax, 0x2a
mov edx, 0x39
cmove eax, edx
mov dword [edi + 4], eax
push 0
jne 0x102d1dfe
xor edx, edx
xor ecx, ecx
call fcn.102d1650
jmp 0x102d1e07
xor edx, edx
xor ecx, ecx
call fcn.102d13d0
mov dword [esi + 0x30], eax
add esp, 4
lea eax, [edi + 0x94]
mov dword [edi + 0x28], 0xfffffffe
mov dword [edi + 0xb18], eax
mov ecx, edi
lea eax, [edi + 0x988]
mov dword [edi + 0xb20], 0x102fd70c
mov dword [edi + 0xb24], eax
lea eax, [edi + 0xa7c]
mov dword [edi + 0xb30], eax
xor eax, eax
mov dword [edi + 0xb2c], 0x102fd6e4
mov dword [edi + 0xb38], 0x102fdc18
mov word [edi + 0x16b8], ax
mov dword [edi + 0x16bc], eax
call fcn.102d5c40
mov esi, dword [esi + 0x1c]
xor edx, edx
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x4c]
add eax, eax
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call sub.VCRUNTIME140.dll_memset
mov eax, dword [esi + 0x84]
add esp, 0xc
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x102fc9fa]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x102fc9f8]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x102fc9fc]
mov dword [esi + 0x90], eax
xor eax, eax
movzx ecx, word [ecx*4 + 0x102fc9fe]
pop edi
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x16b4], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
ret
mov eax, 0xfffffffe
pop esi
ret
Function at 0x102d7f10
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102f595d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x64], 0xc15730e2
mov dword [ebp - 0x60], 0x7f0725e3
mov byte [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
mov byte [ebp - 0x54], 0
mov eax, dword [0x103c1bb8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, dword [ebp - 0x64]
je 0x102d80ab
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov ecx, dword [ebp - 0x60]
mov edx, 0x103c1bb8
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x102d7fed
cmp byte [ebp - 0x5c], 0
jne 0x102d7fd0
lock inc dword [0x103c1bbc]
mov eax, dword [0x103c1bb8]
mov byte [ebp - 0x5c], 1
cmp eax, dword [ebp - 0x64]
je 0x102d80ab
mov eax, dword [ebp - 0x58]
test eax, eax
jne 0x102d7fd3
cmp byte [ebp - 0x54], al
jne 0x102d7faa
lea ecx, [ebp - 0x54]
call fcn.102d7e00
lea eax, [ebp - 0x54]
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [ebp - 0x58]
mov esi, eax
test ecx, ecx
je 0x102d7fcb
cmp ecx, 0xffffffff
je 0x102d7fcb
push ecx
call edi
mov dword [ebp - 0x58], esi
jmp 0x102d7fda
mov eax, dword [ebp - 0x58]
push 0
push 0xffffffffffffffff
push eax
call ebx
mov eax, dword [0x103c1bb8]
cmp eax, dword [ebp - 0x64]
je 0x102d80ab
jmp 0x102d7f65
mov esi, dword [ebp - 0x58]
test esi, esi
jne 0x102d802b
cmp byte [ebp - 0x54], 0
jne 0x102d8002
lea ecx, [ebp - 0x54]
call fcn.102d7e00
lea eax, [ebp - 0x54]
push eax
push 0
push 0x100002
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov esi, eax
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x102d8024
cmp eax, 0xffffffff
je 0x102d8024
push eax
call edi
mov dword [ebp - 0x58], esi
test esi, esi
je 0x102d8032
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp byte [ebp - 0x5c], 0
mov dword [0x1038f740], eax
jne 0x102d804e
lock inc dword [0x103c1bbc]
mov byte [ebp - 0x5c], 1
mov eax, dword [ebp - 0x64]
mov ecx, 0x103c1bb8
xchg dword [ecx], eax
mov esi, dword [ebp - 0x58]
test esi, esi
jne 0x102d80a4
mov eax, dword [0x103c1bbc]
cmp eax, 1
jle 0x102d809d
cmp byte [ebp - 0x54], 0
jne 0x102d8077
lea ecx, [ebp - 0x54]
call fcn.102d7e00
lea eax, [ebp - 0x54]
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x102d8098
cmp eax, 0xffffffff
je 0x102d8098
push eax
call edi
mov dword [ebp - 0x58], esi
jmp 0x102d80a0
mov esi, dword [ebp - 0x58]
test esi, esi
je 0x102d80ba
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov esi, dword [ebp - 0x58]
test esi, esi
je 0x102d80ba
cmp esi, 0xffffffff
je 0x102d80ba
push esi
call edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x102d80f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102f597d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x1038f740]
push ebx
cmp eax, 0xffffffff
jne 0x102d8118
xor ebx, ebx
jmp 0x102d8121
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x102d81f9
push esi
push edi
cmp dword [ebx + 0x18], 0
jne 0x102d8141
cmp dword [ebx + 0xc], 0
je 0x102d81bd
mov esi, dword [ebx + 0xc]
test esi, esi
je 0x102d818a
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x102d8173
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x102d8148
cmp dword [ebx + 0x18], 0
je 0x102d813b
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x102d81a9
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x102d81a9
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
lea ecx, [ebx + 0x14]
call fcn.102d8250
cmp dword [ebx + 0x18], 0
jne 0x102d8190
jmp 0x102d8135
call fcn.102d7f10
mov eax, dword [0x1038f740]
pop edi
pop esi
cmp eax, 0xffffffff
je 0x102d81d7
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x102d81f9
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x408992
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x4089a1
pop dword [ebp - 0x4c]
mov eax, 0x45948916
sub eax, 0x4553ff75
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x385c9
push 0
mov eax, 0xbf1b4292
sub eax, 0xbeda61ba
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x4496
xor edi, edi
add edi, eax
mov esi, 0x413bc4
add esi, dword [ebp - 0x4c]
mov ebx, 0xcf5a34b
add dword [ebp - 0x20], 0xe07fa21a
mov edx, dword [esi]
add dword [ebp - 0x24], 0xb6aaccd2
xor edx, ebx
add dword [ebp - 0x10], 0x497f63b3
mov dword [edi], edx
xor dword [ebp - 4], esi
add edi, 0x272f0a11
add edi, 0xd8d0f5f3
add esi, 4
loop 0x4089f0
add eax, 0x4d18fadf
sub eax, 0x4d17f5b4
xor ebx, ebx
add ebx, eax
add eax, 0x3eed20d6
add eax, 0xc112df2f
mov ecx, 0x400000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x1000e1bc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x1000e1cb
pop dword [ebp - 0x14]
mov eax, 0x8a434981
sub eax, 0x7a4267b6
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x3f671
push 0
mov eax, 0x626c6612
add eax, 0xad94da52
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x11a0e7af
sub ecx, 0x11a08619
xor ebx, ebx
add ebx, eax
mov edi, 0xdc6b4d94
sub edi, 0xcc69c794
add edi, dword [ebp - 0x14]
mov edx, 0x308e1ab3
sub edx, 0x79bda31
xor dword [ebp - 8], 0x3d153832
mov esi, dword [edi]
add dword [ebp - 8], esi
sub esi, edx
mov dword [ebp - 0x10], 0x832a9fd9
mov dword [ebx], esi
sub dword [ebp - 0x10], 0x8be15adf
add ebx, 0x1e7d3178
sub ebx, 0x1e7d3174
add edi, 0xaf99222c
sub edi, 0xaf992228
loop 0x1000e22c
add eax, 0x1792b
xor ebx, ebx
add ebx, eax
add eax, 0x10fd5468
sub eax, 0x10fd5463
mov ecx, 0xb5a8caa5
sub ecx, 0xa5a8caa5
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x401171
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push 0x44
push 0
lea eax, [ebp - 0x54]
push eax
call fcn.00401ae0
add esp, 0xc
mov dword [ebp - 0x54], 0x44
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x54]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
je 0x4011b9
mov eax, 1
jmp 0x4011bb
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4027a5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4061f8
cmp edx, dword [eax]
je 0x4027c7
add eax, 8
inc ecx
cmp eax, 0x406288
jl 0x4027b8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4061f8]
jne 0x4028f5
mov eax, dword [0x4066e4]
cmp eax, 1
je 0x4028cf
test eax, eax
jne 0x4027f8
cmp dword [0x406148], 1
je 0x4028cf
cmp edx, 0xfc
je 0x4028f5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
test eax, eax
jne 0x40282f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00402d50
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00402ec0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x402872
lea eax, [ebp - 0x1a4]
push eax
call fcn.00402ec0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4053b8
push edi
call fcn.00403b50
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00402d50
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00402d60
lea eax, [ebp - 0xa0]
push 0x405398
push eax
call fcn.00402d60
push dword [esi + 0x4061fc]
lea eax, [ebp - 0xa0]
push eax
call fcn.00402d60
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00403abe
add esp, 0x2c
pop edi
jmp 0x4028f5
lea eax, [ebp + 8]
lea esi, [esi + 0x4061fc]
push 0
push eax
push dword [esi]
call fcn.00402ec0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
pop esi
leave
ret
Function at 0x10008790
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x1000879f
pop dword [ebp - 0x3c]
mov eax, 0x6894ac75
add eax, 0xa76bdb2a
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x86562807
sub dword [ebp - 0x4c], 0x3803e2bc
mov dword [ebp - 0x48], 0x9fbf1f35
sub dword [ebp - 0x48], 0x6d8bd2f0
mov dword [ebp - 0x44], 0x4b799775
add dword [ebp - 0x44], 0xd2acb9
mov dword [ebp - 0x40], 0x231fabd2
add dword [ebp - 0x40], 0xdce0542e
lea eax, [ebp - 0x4c]
push eax
mov eax, 0xa51008fc
add eax, 0x6af11744
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xaf1017fa
sub dword [ebp - 0x4c], 0x3a9daea4
mov dword [ebp - 0x48], 0xc06daa32
sub dword [ebp - 0x48], 0x7f0148bd
mov dword [ebp - 0x44], 0x151acb48
sub dword [ebp - 0x44], 0xb1ab5edc
mov dword [ebp - 0x40], 0x13eb67b2
add dword [ebp - 0x40], 0xec14984e
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0xbc993bcd
add eax, 0x5367e477
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x39bbd
push 0
call eax
mov ecx, 0xbc3abb8
sub ecx, 0xbc363c6
xor esi, esi
add esi, eax
mov edx, 0x1001b000
add edx, dword [ebp - 0x3c]
mov edi, 0x4586aeb
add dword [ebp - 0x2c], 0xdbc9614c
mov ebx, dword [edx]
mov dword [ebp - 0x24], 0x86fd68f2
add ebx, edi
mov dword [esi], ebx
xor dword [ebp - 0x38], eax
add esi, 4
add edx, 0xbc164634
add edx, 0x43e9b9d0
loop 0x100088b7
add eax, 0x3373c44e
add eax, 0xcc8d4e4d
mov ebx, eax
add eax, 5
mov ecx, 0x7b88613e
sub ecx, 0x6b88613e
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x1000f721
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x1000f730
pop dword [ebp - 0x34]
mov eax, 0x1000f730
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x58c50700
sub dword [ebp - 0x44], 0xa72c1b5
mov dword [ebp - 0x40], 0x847564a5
sub dword [ebp - 0x40], 0x52421860
mov dword [ebp - 0x3c], 0xb086307d
sub dword [ebp - 0x3c], 0x6439ec4f
mov dword [ebp - 0x38], 0xdaf9707
sub dword [ebp - 0x38], 0xdaf9707
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x7e80f9ed
sub dword [ebp - 0x44], 0xa0e9097
mov dword [ebp - 0x40], 0x887b50d8
add dword [ebp - 0x40], 0xb8f1109d
mov dword [ebp - 0x3c], 0xa7c31b9e
sub dword [ebp - 0x3c], 0x4453af32
mov dword [ebp - 0x38], 0x6d80a33b
sub dword [ebp - 0x38], 0x6d80a33b
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xa1c66f90
sub eax, 0x91c52f98
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x32b72
push 0
call eax
mov ecx, 0x1fb1dbd0
add ecx, 0xe04e5cca
xor edi, edi
add edi, eax
mov esi, 0x10019a00
add esi, dword [ebp - 0x34]
mov ebx, 0x559e92ca
add dword [ebp - 0x14], 0xb75f4a55
mov edx, dword [esi]
add dword [ebp - 0x18], 0x19c2ec33
add edx, ebx
xor dword [ebp - 4], ecx
mov dword [edi], edx
add dword [ebp - 0x20], 0x9dbbf698
add edi, 0x7b9c8e26
sub edi, 0x7b9c8e22
add esi, 4
loop 0x1000f83e
add eax, 0xd53b
mov ebx, eax
add eax, 0x4709667a
add eax, 0xb8f6998b
mov ecx, 0x68728554
sub ecx, 0x58728554
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x403e59
pop dword [ebp - 0x18]
mov eax, 0x403e59
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x951f7a15
sub dword [ebp - 0x28], 0x46cd34ca
mov dword [ebp - 0x24], 0xb62c1fd8
add dword [ebp - 0x24], 0x7c072c6d
mov dword [ebp - 0x20], 0x1800becb
add dword [ebp - 0x20], 0x344b8563
mov dword [ebp - 0x1c], 0x8baa6632
add dword [ebp - 0x1c], 0x745599ce
lea eax, [ebp - 0x28]
push eax
mov eax, 0x6307ed3
sub eax, 0x5effe47
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x4157d36b
add dword [ebp - 0x28], 0x331a95eb
mov dword [ebp - 0x24], 0xc5a9013
sub dword [ebp - 0x24], 0xcaee2e9e
mov dword [ebp - 0x20], 0x267f36e5
add dword [ebp - 0x20], 0x3cf03587
mov dword [ebp - 0x1c], 0xbff965a0
sub dword [ebp - 0x1c], 0xbff965a0
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x4c84bea8
sub eax, 0x4c443dd4
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x30ef9
push 0
call eax
mov ecx, 0xcecf592f
add ecx, 0x3130d792
xor edi, edi
add edi, eax
mov ebx, 0x3909312c
add ebx, 0xc737ded4
add ebx, dword [ebp - 0x18]
mov esi, 0xfe8094ce
add esi, 0x99ccc5ea
add dword [ebp - 4], 0x2e3d650b
mov edx, dword [ebx]
xor dword [ebp - 4], esi
add edx, esi
add dword [ebp - 0x10], edx
mov dword [edi], edx
mov dword [ebp - 0xc], 0xe25e9383
add edi, 4
add ebx, 4
loop 0x403f78
add eax, 0x99fb269f
sub eax, 0x99fa70c8
mov ebx, eax
add eax, 0xf2518e35
sub eax, 0xf2518e30
mov ecx, 0xf5b0afcc
add ecx, 0xa8f5034
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x40bdb9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x40bdc8
pop dword [ebp - 0x18]
mov eax, 0xd41b7866
sub eax, 0xd3daba9e
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x42fe1aeb
add dword [ebp - 0x28], 0xb542a60
mov dword [ebp - 0x24], 0x49bff488
sub dword [ebp - 0x24], 0x178ca843
mov dword [ebp - 0x20], 0xb915b8df
add dword [ebp - 0x20], 0x93368b4f
mov dword [ebp - 0x1c], 0xad0b3d6f
sub dword [ebp - 0x1c], 0xad0b3d6f
lea eax, [ebp - 0x28]
push eax
mov eax, 0x404ed625
add eax, 0xbff1fa2f
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x2860a452
sub dword [ebp - 0x28], 0xb3ee3afc
mov dword [ebp - 0x24], 0x3300ff8d
add dword [ebp - 0x24], 0xe6b61e8
mov dword [ebp - 0x20], 0x8c9d934f
sub dword [ebp - 0x20], 0x292e26e3
mov dword [ebp - 0x1c], 0xbafe4ca0
sub dword [ebp - 0x1c], 0xbafe4ca0
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x7b052fbb
sub eax, 0x7ac45f6f
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3da36
push 0
call eax
mov ecx, 0x5879
xor edi, edi
add edi, eax
mov ebx, 0xcc9765cd
sub ebx, 0xcc55b5cd
add ebx, dword [ebp - 0x18]
mov esi, 0x67ff6996
sub esi, 0xd9211952
sub dword [ebp - 8], ebx
mov edx, dword [ebx]
add dword [ebp - 0x10], ebx
add edx, esi
xor dword [ebp - 0x14], 0xb76f90e9
mov dword [edi], edx
xor dword [ebp - 4], 0xc3b46476
add edi, 0x613e5446
sub edi, 0x613e5442
add ebx, 0x440cb9cf
sub ebx, 0x440cb9cb
loop 0x40bee6
add eax, 0x78df1bfe
sub eax, 0x78ddc747
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x5ca2dcb9
invalid
invalid
Function at 0x40241a
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x28]
and dword [esi + 0x558], 0
and dword [esi + 0x14], 0
mov dword [esi + 0x454], 1
call fcn.0040a3f5
push 2
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EndDialog]
pop esi
ret
Function at 0x403b62
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x403ba0
mov edi, dword [sym.imp.USER32.dll_IsWindow]
push eax
call edi
test eax, eax
je 0x403ba0
push 6
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esi + 0x5a0], 0
je 0x403ba5
cmp dword [esi + 4], 0
je 0x403ba0
push dword [esi + 0x59c]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
xor eax, eax
pop edi
pop esi
ret
push 0
push 0x403bd9
push dword [esi + 4]
push 0x83
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
test eax, eax
mov dword [esi + 0x59c], eax
je 0x403ba0
push eax
call edi
test eax, eax
je 0x403ba0
push 1
pop eax
mov dword [esi + 0x5a0], eax
jmp 0x403ba2

Function at 0x4049f4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1020
call fcn.00407c70
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edi, ecx
cmp ebx, esi
mov dword [ebp - 4], edi
je 0x404a97
push esi
push ebx
call sub.MSVCRT.dll__access
pop ecx
test eax, eax
pop ecx
jne 0x404a8b
push esi
push 0x8000000
push 3
push esi
push 1
push SysReAllocString
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x404a8b
push 0x1000
lea eax, [ebp - 0x1020]
push esi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp + 8]
mov dword [ebp + 8], esi
push esi
push eax
lea eax, [ebp - 0x1020]
push 0xfff
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x404a84
lea eax, [ebp - 0x1020]
push eax
push ebx
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edi, dword [ebp - 4]
push ebx
lea ecx, [edi + 0x1c]
call fcn.00408f37
lea ecx, [edi + 0x36c]
call fcn.0040a8fc
test eax, eax
je 0x404ab1
mov ecx, edi
call fcn.00404d70
test eax, eax
jne 0x404ab5
xor eax, eax
jmp 0x404b10
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
push esi
push esi
lea eax, [ebp - 0x20]
push esi
mov dword [ebp - 0x1c], esi
push eax
call edi
test eax, eax
jle 0x404b05
cmp dword [ebp - 0x1c], 0x12
je 0x404b05
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
push dword [eax + 8]
push dword [ebp - 0x20]
call dword [sym.imp.USER32.dll_TranslateAcceleratorA]
test eax, eax
jne 0x404afc
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push esi
push esi
lea eax, [ebp - 0x20]
push esi
push eax
jmp 0x404ac5
mov ecx, dword [ebp - 4]
call fcn.0040512f
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
leave
ret 4