joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ba820
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov eax, dword [edi + 8]
mov dword [edi + 0xc], ebx
cmp eax, ebx
je 0x4ba847
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_FlushViewOfFile]
mov eax, dword [edi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [edi + 8], ebx
mov eax, dword [edi + 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebx
je 0x4ba85a
push eax
call esi
mov dword [edi + 4], ebx
mov eax, dword [edi]
cmp eax, 0xffffffff
je 0x4ba86a
push eax
call esi
mov dword [edi], 0xffffffff
mov esi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
cmp esi, ebx
mov ebx, dword [esp + 0x1c]
je 0x4ba8ed
xor eax, eax
xor ecx, ecx
cmp ebp, 1
je 0x4ba891
jle 0x4ba89b
cmp ebp, 3
jg 0x4ba89b
mov eax, 0xc0000000
jmp 0x4ba896
mov eax, DirectSoundCreate
mov ecx, 1
xor edx, edx
cmp ebx, 0xffffffff
setne dl
push 0
add edx, 3
push 0x10000000
push edx
push 0
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [edi], eax
je 0x4ba953
cmp ebx, 0xffffffff
mov dword [edi + 0xc], ebx
push 0
jne 0x4ba8da
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [edi + 0xc], eax
jmp 0x4ba8ed
push 0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
and ebp, 2
mov ecx, 0
setne cl
test esi, esi
lea ecx, [ecx + ecx + 2]
jne 0x4ba905
or eax, 0xffffffff
jmp 0x4ba907
mov eax, dword [edi]
mov edx, dword [esp + 0x20]
mov esi, ebx
inc esi
push edx
neg esi
sbb esi, esi
and esi, ebx
push esi
push 0
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test eax, eax
mov dword [edi + 4], eax
je 0x4ba953
neg ebp
sbb ebp, ebp
push esi
and ebp, 0xf001b
push 0
add ebp, 4
push 0
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [edi + 8], eax
je 0x4ba953
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0x10
Function at 0x4c4bc0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
xor edx, edx
push esi
mov esi, dword [esp + 8]
test ecx, ecx
jg 0x4c4be1
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
test ecx, ecx
jle 0x4c4bfe
push ebx
xor eax, eax
xor ebx, ebx
mov al, byte [esi]
mov bl, byte [eax + 0x566590]
lea eax, [edx*8]
xor ebx, eax
xor edx, ebx
inc esi
dec ecx
jne 0x4c4be2
pop ebx
mov eax, edx
pop esi
and eax, 0x7fffffff
ret

Function at 0x4cb720
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret

Function at 0x4cb850
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
sub esp, 0x138
lea eax, [esp]
push ebx
push ebp
push esi
push edi
push eax
push 0x118
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x4cb88c
lea eax, [esp + 0x10]
dec eax
cmp byte [eax + ecx], 0x5c
jne 0x4cb88c
dec ecx
test ecx, ecx
jg 0x4cb881
mov esi, dword [esp + 0x14c]
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov byte [esp + ecx + 0x10], 0
lea ecx, [esp + 0x10]
push ecx
push 0x54af48
push esi
call fcn.004e8361
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, 0xf
mov edi, ecx
call fcn.004c5d20
xor edx, edx
mov ecx, 0x3f
div ecx
inc edi
dec ebx
mov dl, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi - 1], dl
jne 0x4cb8c4
push esi
mov byte [edi + esi], 0
call ebp
cmp eax, 0xffffffff
jne 0x4cb89e
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x138
ret

Function at 0x4cb950
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
test esi, esi
push edi
jle 0x4cb98e
mov ebx, dword [esp + 0x14]
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, dword [esp + 0x18]
mov ecx, dword [ebx]
lea eax, [esp + 0x1c]
push 0
push eax
push esi
push edi
push ecx
call ebp
test eax, eax
je 0x4cb9a5
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jbe 0x4cb996
sub esi, ecx
add edi, ecx
test esi, esi
jg 0x4cb96a
jmp 0x4cb996
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
test eax, eax
je 0x4cb9a5
cmp esi, ecx
jg 0x4cb9a5
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 0xd
pop ebx
ret

Function at 0x4cba40
Capabilities:
Get file size

Disassembly:
mov ecx, dword [esp + 4]
lea eax, [esp + 4]
push esi
push eax
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov eax, dword [esp + 8]
push 1
push 0
push 0
push eax
call fcn.004eb110
mov ecx, eax
xor eax, eax
add ecx, esi
pop esi
adc edx, eax
mov eax, dword [esp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
xor eax, eax
ret
Function at 0x4e3720
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0xbf4
push ebx
push ebp
mov ebp, dword [esp + 0xc00]
push esi
push edi
mov ecx, 0x21
mov eax, dword [ebp + 0x34]
lea edi, [esp + 0x54]
mov dword [esp + 0x48], eax
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, 0x25e
lea edi, [esp + 0x28c]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0xc10]
test edi, edi
je 0x4e386c
cmp byte [edi], 5
jne 0x4e3819
mov eax, dword [edi + 4]
cmp byte [eax], 5
je 0x4e3795
mov ecx, dword [edi + 8]
lea edx, [esp + 0x2a4]
push ecx
push edx
push 0x64
mov dword [esp + 0x298], eax
call fcn.004e5410
mov esi, eax
add esp, 0xc
inc esi
jmp 0x4e37c8
push eax
lea eax, [esp + 0x290]
push eax
push 0x65
call fcn.004e5410
mov ecx, dword [edi + 8]
mov esi, eax
push ecx
mov ecx, 0x65
lea edx, [esi + esi*2]
sub ecx, esi
lea eax, [esp + edx*8 + 0x29c]
push eax
push ecx
call fcn.004e5410
add esp, 0x18
add esi, eax
cmp esi, 0x65
mov dword [esp + 0x34], esi
jne 0x4e3828
push 0x64
lea edx, [esp + 0x25c]
push 0x53c768
push edx
call fcn.004e8361
push 0
lea eax, [esp + 0x268]
push str._terms_allowed
push eax
lea ecx, [ebp + 0x10]
push str.WHERE_clause_too_complex___no_more_than
push ecx
call fcn.004c45d0
mov eax, dword [ebp + 0x44]
add esp, 0x20
inc eax
pop edi
mov dword [ebp + 0x44], eax
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xbf4
ret
mov dword [esp + 0x28c], edi
mov dword [esp + 0x34], 1
mov ebx, dword [esp + 0xc0c]
mov eax, dword [ebx]
lea eax, [eax + eax*2]
lea edx, [eax + eax*4]
lea eax, [edx*4 + 0x58]
push eax
call fcn.004c4410
mov esi, eax
mov eax, dword [0x582830]
add esp, 4
mov dword [esp + 0x4c], esi
test eax, eax
je 0x4e3876
push esi
call fcn.004c4480
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xbf4
ret
mov dword [esp + 0x34], 0
jmp 0x4e3828
mov ecx, dword [esp + 0x48]
mov dword [esi], ebp
mov dword [esi + 4], ebx
mov eax, dword [ebp + 0x48]
push ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
call fcn.004baaf0
add esp, 4
mov dword [esi + 0xc], eax
test edi, edi
je 0x4e38ba
cmp dword [ebx], 0
je 0x4e38aa
push edi
call fcn.004cca80
add esp, 4
test eax, eax
je 0x4e38ba
mov edx, dword [esi + 0xc]
push 1
push edx
push edi
push ebp
call fcn.004cea10
add esp, 0x10
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x54]
xor eax, eax
cmp ecx, eax
mov dword [esp + 0x18], eax
jle 0x4e3cf4
Function at 0x5034a6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [edx - 0xc]
mov dword [esp + 0x20], edx
mov edx, dword [edx]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x14]
mov ecx, eax
sub ecx, edx
mov edx, dword [esp + 0x10]
add ecx, ecx
sub ecx, edx
mov edx, dword [esp + 0x14]
sub ecx, edx
mov edx, dword [esp + 0x18]
add ecx, edx
add ecx, eax
lea edx, [edx + eax*4]
sar ecx, 1
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x14]
add eax, edx
sar eax, 1
lea edx, [ecx + ecx]
sub edx, eax
mov eax, dword [esp + 0x10]
sub ecx, eax
add edx, eax
sar ecx, 1
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
Function at 0x505e10
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov edx, dword [esp + 0x18]
push ebx
push ebp
push esi
xor esi, esi
push edi
mov dword [edx + 8], esi
mov dword [edx + 0xc], esi
mov ecx, dword [ecx + 8]
xor al, al
mov dword [esp + 0x1c], ecx
mov edx, dword [ecx + 8]
add edx, ecx
mov ecx, dword [esp + 0x24]
mov edi, ecx
cmp ecx, esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edi
je 0x505f1c
mov al, byte [edi]
mov ecx, edi
test al, al
je 0x505e5f
cmp al, 0x5c
je 0x505e7e
cmp al, 0x2f
je 0x505e7e
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x505e4f
mov dword [esp + 0x18], esi
mov ecx, esi
cmp ecx, esi
setne byte [esp + 0x24]
cmp ecx, esi
jne 0x505e84
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
jmp 0x505e88
mov dword [esp + 0x18], ecx
jmp 0x505e65
mov ebx, ecx
sub ebx, edi
xor ebp, ebp
cmp ebx, esi
jbe 0x505eb8
mov eax, dword [esp + 0x10]
movsx ax, byte [esi + eax]
and eax, 0xffff
push eax
call dword [sym.imp.USER32.dll_CharLowerA]
movsx ecx, al
mov edx, ebp
shl edx, 8
xor ecx, edx
xor ebp, ecx
inc esi
cmp esi, ebx
jb 0x505e8e
mov edx, dword [esp + 0x14]
mov cl, byte [edx]
mov eax, 1
shl eax, cl
mov ecx, dword [edx + 2]
dec eax
and eax, ebp
lea eax, [ecx + eax*8]
mov ecx, dword [esp + 0x1c]
add eax, ecx
mov esi, dword [eax]
mov edi, dword [eax + 4]
add esi, ecx
xor ecx, ecx
mov cx, word [edx + 0xe]
imul edi, ecx
add edi, esi
cmp edi, esi
jbe 0x505f1a
cmp ebp, dword [esi + 2]
jne 0x505f0e
xor eax, eax
mov ax, word [esi]
cmp ebx, eax
jne 0x505f0e
mov ecx, dword [esp + 0x10]
push ebx
lea edx, [esi + 0xf]
push ecx
push edx
call fcn.004fa300
add esp, 0xc
test eax, eax
je 0x505f26
mov edx, dword [esp + 0x14]
xor eax, eax
mov ax, word [edx + 0xe]
add esi, eax
cmp edi, esi
ja 0x505ee6
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
mov al, byte [esp + 0x24]
test al, al
je 0x505f7d
mov al, byte [esi + 6]
test al, al
je 0x505f1a
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x10], ecx
mov al, byte [ecx]
test al, al
je 0x505f1a
cmp al, 0x5c
je 0x505f4b
cmp al, 0x2f
jne 0x505f61
mov al, byte [ecx + 1]
inc ecx
test al, al
mov dword [esp + 0x10], ecx
jne 0x505f43
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
mov esi, dword [esi + 0xb]
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
add esi, eax
mov dword [esp + 0x14], esi
xor esi, esi
mov edx, dword [esp + 0x14]
jmp 0x505e47
mov eax, dword [esp + 0x28]
mov ecx, dword [esi + 7]
pop edi
mov dword [eax + 8], ecx
mov edx, dword [esi + 0xb]
mov ecx, dword [esp + 0x18]
pop esi
add edx, ecx
pop ebp
mov dword [eax + 0xc], edx
mov al, 1
pop ebx
add esp, 0x10
ret 8
Function at 0x5068f4
Capabilities:
Clear file content
Write file on windows

Disassembly:
sub esp, 0x3c
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0xc]
cmp eax, 0xffffffff
je 0x50690e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xc], 0xffffffff
mov eax, dword [esp + 0x4c]
xor ebx, ebx
push ebx
push 0x10000080
push 4
push ebx
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 0xc], eax
setne al
cmp al, bl
mov byte [esp + 0x4c], al
je 0x506a3e
mov ecx, dword [esi + 0xc]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ebp, dword [esp + 0x60]
xor edx, edx
mov dword [esp + 0x14], edx
push ebx
mov dword [esp + 0x1c], edx
lea eax, [ebp*4]
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], eax
add eax, 0x36
mov word [esp + 0x24], dx
mov edx, dword [esi + 0xc]
mov dword [esp + 0x22], eax
lea eax, [esp + 0x64]
lea ecx, [esp + 0x18]
push eax
push 0xe
push ecx
push edx
mov word [esp + 0x28], 0x4d42
mov dword [esp + 0x74], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xa
xor eax, eax
lea edi, [esp + 0x24]
push ebx
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x58]
mov dword [esp + 0x28], 0x28
mov word [esp + 0x34], 1
mov dword [esp + 0x38], ebx
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x30], ecx
mov ecx, 0x3e8
mov dx, word [eax*8 + 0x550a04]
mov al, byte [eax*8 + 0x550a08]
neg al
sbb eax, eax
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], ecx
and eax, ebp
lea ecx, [esp + 0x58]
mov word [esp + 0x36], dx
mov dword [esp + 0x48], eax
mov eax, dword [esi + 0xc]
push ecx
lea edx, [esp + 0x2c]
push 0x28
push edx
push eax
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x68], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp ebp, ebx
pop ebp
je 0x506a42
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x58]
lea ecx, [esp + 0x50]
push ebx
push ecx
mov ecx, dword [esi + 0xc]
push edx
push eax
push ecx
mov dword [esp + 0x64], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x506a42
mov edi, dword [esp + 0x50]
mov edx, dword [edi]
mov ecx, dword [esp + 0x54]
mov dword [esi], edx
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov al, byte [esp + 0x4c]
mov dword [esi + 8], ebx
mov dword [esi + 0x10], ecx
pop edi
pop esi
pop ebx
add esp, 0x3c
ret 0x14
Function at 0x514670
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
xor edx, edx
cmp ecx, edx
je 0x514710
push ebx
push ebp
push esi
mov esi, dword [ecx]
push edi
xor eax, eax
mov byte [esi + 0x16], dl
mov esi, dword [ecx]
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov byte [esi + 0x18], dl
mov esi, dword [ecx]
mov byte [esi + 0x19], dl
mov edi, dword [ecx + 4]
xor esi, esi
cmp edi, edx
jle 0x5146c2
mov ebp, dword [ecx]
xor edx, edx
mov ebx, eax
mov dl, byte [esi + ebp]
shr ebx, 0x18
xor edx, ebx
shl eax, 8
mov edx, dword [edx*4 + 0x56c228]
xor eax, edx
inc esi
cmp esi, edi
jl 0x5146a3
xor edx, edx
mov edi, dword [ecx + 0xc]
xor esi, esi
cmp edi, edx
jle 0x5146eb
mov ebp, dword [ecx + 8]
xor edx, edx
mov ebx, eax
mov dl, byte [esi + ebp]
shr ebx, 0x18
xor edx, ebx
shl eax, 8
mov edx, dword [edx*4 + 0x56c228]
xor eax, edx
inc esi
cmp esi, edi
jl 0x5146ce
mov edx, dword [ecx]
pop edi
mov byte [edx + 0x16], al
mov esi, dword [ecx]
mov edx, eax
shr edx, 8
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov edx, eax
shr edx, 0x10
mov byte [esi + 0x18], dl
mov ecx, dword [ecx]
shr eax, 0x18
pop esi
pop ebp
mov byte [ecx + 0x19], al
pop ebx
ret
Function at 0x530e10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x530e1b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x530f1e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x553d30]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x553d30]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x553d30]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x553d30]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x553d30]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x553d30]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x553d30]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x553d30]
xor eax, edx
inc ecx
dec edi
jne 0x530e36
pop edi
test esi, esi
je 0x530f40
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x553d30]
xor eax, edx
inc ecx
dec esi
jne 0x530f22
pop esi
pop ebx
not eax
ret
Function at 0x1007485
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x1007568
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp + 0xc]
mov dword [ebp - 8], eax
push ebx
push eax
call esi
mov dword [ebp - 4], eax
cmp eax, ebx
jne 0x10074e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push 0x1002140
push eax
call dword [sym.imp.msvcrt.dll_fwprintf]
add esp, 0xc
jmp 0x1007567
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
cmp edi, ebx
jne 0x1007516
push dword [ebp - 4]
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 8
add eax, 0x40
push 0x10020d8
push eax
call dword [sym.imp.msvcrt.dll_fwprintf]
add esp, 0x10
jmp 0x1007553
push ebx
push ebx
push dword [ebp - 4]
push edi
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push dword [ebp - 8]
call esi
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x1007553
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1007533
push ebx
lea ecx, [ebp - 4]
push ecx
sub eax, edx
push eax
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp edi, ebx
je 0x1007566
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x15ce86a
Capabilities:
Encode data using xor

Disassembly:
pop eax
mov byte [edi - 1], 0
pushfd
mov dword [esp + 4], ebx
movzx ax, dl
lea eax, [0x291ee08]
jmp 0x292a2b2
test dword [0xddf5bb72], esi
rcl bl, 1
push ebp
sub al, 0xbe
cmp edi, ebx
mov dh, 0
xor dword [edi - 0x2c], edx
cmp dword [ebp + 0x76be9996], edx
xor byte [edx + 0x3c], 0x29
push ebx
fsubr qword [edx]
lahf
inc esp
psubw mm5, qword cs:[ebx - 0x2b24e8b8]
ror byte [esi - 0x47], cl
test dword [eax - 0x49cd1871], eax
call 0x9da2b49f
sbb ebp, dword [ebx]
or ebp, dword [eax + 0x1c]
jns 0x292a278
push 0xc179641c
mov dword [esp + 4], 0x292dbdf
pushal
call fcn.0292d285
push ss
mov esi, 0x57f67193
sbb dword [ebx - 0x66], eax
push es
xor dword [ecx - 0x5979ce46], 0x5be7bdb1
sahf
fisttp word [eax]
jbe 0x292a2a1
push edx
adc eax, 0x3a146edc
or dword [ebp + 0x3f06c4e9], edi
imul ebx, dword [esi - 0x35], 0xffffffe9
fdivr dword [ecx]
xor eax, 0xe3a4d86f
movsb byte es:[edi], byte [esi]
stc
adc eax, 0x5f5748e6
or dh, al
mov al, ch
mov dh, byte [edx + 0x23]
retf
Function at 0x4012f0
Capabilities:
Create process on windows
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46d978
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x134
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], esi
call fcn.004645b4
mov ebx, dword [eax + 4]
mov eax, dword [0x489554]
mov dword [ebp - 0x14], eax
mov ecx, 0x49
xor eax, eax
lea edi, [ebp - 0x13c]
mov dword [ebp - 0x140], esi
push esi
push 2
rep stosd dword es:[edi], eax
mov byte [ebp - 4], 1
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x401371
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.00458a0e
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x140]
mov dword [ebp - 0x140], 0x128
push ecx
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4013f8
lea edx, [ebp - 0x11c]
lea eax, [ebp - 0x14]
push edx
push 0x4881a0
push eax
call fcn.00451ecf
mov eax, dword [ebx + 0xc8]
mov ecx, dword [ebp - 0x14]
add esp, 0xc
push eax
push ecx
call fcn.004188c6
add esp, 8
test eax, eax
jne 0x4013e7
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x138]
cmp dword [edx + 0x64], eax
je 0x4013e7
push eax
lea eax, [ebp - 0x14]
push str.taskkill__pid__d
push eax
call fcn.00451ecf
mov ecx, dword [ebp - 0x14]
add esp, 0xc
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
lea edx, [ebp - 0x140]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40138c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x401354
Function at 0x402140
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
cmp edi, 0x40
mov ebp, ecx
jg 0x402172
mov esi, dword [esp + 0x10]
xor eax, eax
test edi, edi
jle 0x4021a9
mov ecx, dword [esp + 0x14]
mov dl, byte [eax + ecx]
xor dl, 0x36
mov byte [esi + eax + 0x20], dl
inc eax
cmp eax, edi
jl 0x40215c
cmp eax, 0x40
jge 0x4021c7
jmp 0x4021a9
mov esi, dword [esp + 0x10]
push ebx
mov ecx, ebp
lea ebx, [esi + 0x60]
push ebx
call fcn.004019e0
mov eax, dword [esp + 0x18]
push edi
push eax
push ebx
mov ecx, ebp
call fcn.00402020
xor eax, eax
pop ebx
mov cl, byte [esi + eax + 0x60]
xor cl, 0x36
mov byte [esi + eax + 0x20], cl
inc eax
cmp eax, 0x20
jl 0x402193
cmp eax, 0x40
jge 0x4021c7
mov ecx, 0x40
lea edi, [eax + esi + 0x20]
sub ecx, eax
mov eax, 0x36363636
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea edi, [esi + 0x60]
mov ecx, ebp
push edi
call fcn.004019e0
add esi, 0x20
push 0x40
push esi
push edi
mov ecx, ebp
call fcn.00401a40
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x402210
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
push eax
mov ecx, dword [esp + 0x1c]
lea esi, [edi + 0x60]
push ecx
push esi
mov ecx, ebx
call fcn.00402020
xor eax, eax
mov dl, byte [esi + eax]
mov byte [eax + edi], dl
inc eax
cmp eax, 0x20
jl 0x402231
lea ebp, [edi + 0x20]
mov ecx, 0xffffffe0
mov eax, ebp
sub ecx, edi
mov dl, byte [eax]
xor dl, 0x6a
mov byte [eax], dl
inc eax
lea edx, [ecx + eax]
cmp edx, 0x40
jl 0x402249
push esi
mov ecx, ebx
call fcn.004019e0
push 0x40
push ebp
push esi
mov ecx, ebx
call fcn.00401a40
push 0x20
push edi
push esi
mov ecx, ebx
call fcn.00402020
xor eax, eax
mov cl, byte [esi + eax]
mov byte [eax + edi], cl
inc eax
cmp eax, 0x20
jl 0x402279
pop edi
pop esi
pop ebp
pop ebx
ret 0xc