joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410050
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
mov dword [ebp - 4], 0xffffffff
cmp dword [edi + 0xc], 0xffffffff
je 0x4100f1
push esi
lea esi, [edi + 0x10]
lea eax, [ebp - 4]
mov dword [esi + 8], 0
push esi
push eax
push dword [ebp + 0xc]
mov dword [esi + 0xc], 0
push dword [ebp + 8]
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4100db
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe8
je 0x4100e6
cmp eax, 0xe9
je 0x4100e6
cmp eax, 0x6d
je 0x4100e6
cmp eax, 0x3e5
jne 0x4100db
push dword [ebp + 0x10]
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4100db
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 1
lea eax, [ebp - 4]
push eax
push esi
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov eax, dword [ebp - 4]
pop esi
pop edi
mov esp, ebp
pop ebp
ret 0x10
pop esi
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret 0x10
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x410100
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
cmp dword [edi + 0xc], 0xffffffff
je 0x4101a3
push esi
lea esi, [edi + 0x24]
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
mov dword [esi + 8], 0
push esi
push eax
push dword [ebp + 0xc]
mov dword [esi + 0xc], 0
push dword [ebp + 8]
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41018d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe8
je 0x410198
cmp eax, 0xe9
je 0x410198
cmp eax, 0x6d
je 0x410198
cmp eax, 0x3e5
jne 0x41018d
push 0x3e8
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x41018d
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 1
lea eax, [ebp - 4]
push eax
push esi
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov eax, dword [ebp - 4]
pop esi
pop edi
mov esp, ebp
pop ebp
ret 0x10
pop esi
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret 0x10
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4104d0
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov edx, dword [esi + 0x10]
cmp edx, 0xffffffff
je 0x41050e
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x4104f5
lea eax, [esi + 0x14]
push eax
push edx
call ecx
lea eax, [esi + 0x28]
push eax
push dword [esi + 0x10]
mov eax, dword [esi + 0x3c]
call eax
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x10], 0xffffffff
mov eax, dword [esi + 0x40]
test eax, eax
je 0x410543
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x410533
push 1
push dword [esi + 0x40]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x40]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x40], 0
pop esi
ret
Function at 0x410810
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
xor al, al
cmp dword [esi + 0xc], 0xffffffff
je 0x41088c
push ebx
push edi
lea edi, [esi + 0x10]
mov dword [edi + 8], 0
push edi
mov dword [edi + 0xc], 0
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
setne bl
test bl, bl
jne 0x410888
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
jne 0x41085d
pop edi
pop ebx
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 8
cmp eax, 0xe8
jne 0x410893
mov eax, dword [esi + 0x38]
test eax, eax
je 0x41087d
push edi
push dword [esi + 0xc]
call eax
lea eax, [esi + 0x24]
push eax
push dword [esi + 0xc]
mov eax, dword [esi + 0x38]
call eax
push dword [esi + 0xc]
mov bl, 1
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
pop edi
mov al, bl
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8
cmp eax, 0x218
je 0x4108a1
cmp eax, 0x3e5
jne 0x410888
push 0xffffffffffffffff
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x410888
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 1
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push edi
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
pop edi
test eax, eax
pop ebx
setne al
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x4131e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4131f9
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x413234
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x413230
lea ebx, [ebx]
cmp esi, edx
jae 0x413234
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x413220
cmp esi, edx
jb 0x41323b
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4132c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, 0x10b
push edi
mov edi, ecx
mov ecx, dword [edi + 0x3c]
movzx eax, word [ecx + edi + 0x18]
cmp ax, dx
je 0x4132e7
mov ecx, 0x20b
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ecx + edi + 0x78]
mov edx, edi
push ebx
push esi
call fcn.00413250
mov ecx, dword [edi + eax + 0x20]
mov edx, edi
lea ebx, [edi + eax]
mov dword [ebp - 8], ebx
call fcn.00413250
mov ecx, dword [ebx + 0x24]
mov edx, edi
lea esi, [edi + eax]
call fcn.00413250
mov ebx, dword [ebx + 0x18]
lea ecx, [edi + eax]
mov dword [ebp - 4], ecx
test ebx, ebx
je 0x413349
nop
mov ecx, dword [esi]
mov edx, edi
dec ebx
call fcn.00413250
add eax, edi
push str.ReflectiveLoader
push eax
call fcn.004184e0
add esp, 8
test eax, eax
jne 0x413352
add dword [ebp - 4], 2
add esi, 4
test ebx, ebx
jne 0x413320
pop esi
pop ebx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
mov edx, edi
mov ecx, dword [ecx + 0x1c]
call fcn.00413250
mov ecx, dword [ebp - 4]
add eax, edi
mov edx, edi
movzx ecx, word [ecx]
mov ecx, dword [eax + ecx*4]
call fcn.00413250
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x413380
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
push edi
mov edi, edx
test esi, esi
je 0x4133f7
test edi, edi
je 0x4133f7
push ebx
call fcn.004132c0
mov ebx, eax
push ebx
push str.dwReflectiveLoaderOffset:_0x_x_n
call fcn.0041aac4
add esp, 8
test ebx, ebx
je 0x4133ed
lea eax, [ebp - 4]
push eax
push 0x40
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x4133ed
push esi
lea eax, [ebx + esi]
call eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 8]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x413400
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x453bea
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.00431c37
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x413498
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], str.bad_locale_name
push eax
lea ecx, [ebp - 0x1c]
call fcn.00419f50
push 0x464a64
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], vtable.std::runtime_error.0
push eax
call fcn.0041d31d
push eax
push 0x3f
push esi
call fcn.00433f47
mov ecx, dword [ebp - 0xc]
add esp, 0xc
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x4149d0
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x454780
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
push 0xf0000000
push 1
push 0
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x20], 0
push eax
mov edi, edx
mov dword [ebp - 0x14], 0
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], 0
mov byte [ebp - 0x38], 0
mov byte [ebp - 4], 1
test edi, edi
jne 0x414a40
mov dword [ebp - 0x28], edi
mov byte [ebp + edi - 0x38], 0
jmp 0x414a4b
push 0
push edi
lea ecx, [ebp - 0x38]
call fcn.00401db0
xor ebx, ebx
test edi, edi
jle 0x414a88
mov dword [ebp - 0x1c], 0x3e
lea eax, [ebp - 0x18]
push eax
push 4
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
cmp dword [ebp - 0x24], 0x10
lea ecx, [ebp - 0x38]
mov eax, dword [ebp - 0x18]
cmovae ecx, dword [ebp - 0x38]
xor edx, edx
div dword [ebp - 0x1c]
mov al, byte [edx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz____]
mov byte [ecx + ebx], al
inc ebx
cmp ebx, edi
jl 0x414a58
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
mov ecx, dword [ebp - 0x24]
cmp ecx, 0x10
jae 0x414aba
mov eax, dword [ebp - 0x28]
inc eax
je 0x414ac6
push eax
lea eax, [ebp - 0x38]
push eax
push esi
call fcn.00417690
mov ecx, dword [ebp - 0x24]
add esp, 0xc
jmp 0x414ac6
mov eax, dword [ebp - 0x38]
mov dword [esi], eax
mov dword [ebp - 0x38], 0
mov eax, dword [ebp - 0x28]
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x14], ecx
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], 0
mov byte [ebp - 0x38], 0
test eax, eax
je 0x414af1
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415b80
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x454a02
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], edi
mov dword [edi], 0x45fd08
mov dword [edi + 0x70], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
lea esi, [edi + 0x10]
mov eax, dword [edi]
mov dword [ebp - 0x10], 1
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push ecx
push esi
lea eax, [ecx - 0x18]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.0040c3b0
mov dword [ebp - 4], 2
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ecx + edi - 4], eax
mov ecx, esi
call fcn.0040c530
lea eax, [esi + 4]
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
lea eax, [esi + 0x14]
mov byte [esi + 0x4c], 0
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov byte [esi + 0x45], 0
mov dword [esi + 0x10], ecx
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [0x46a024]
mov dword [esi + 0x50], 0
mov dword [esi + 0x48], eax
mov dword [esi + 0x40], 0
sub esp, 8
mov byte [ebp - 4], 3
mov ecx, esi
push dword [ebp + 8]
call fcn.004167f0
test eax, eax
jne 0x415cda
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + edi + 0xc]
add ecx, edi
or eax, 2
cmp dword [ecx + 0x38], 0
jne 0x415cc8
or eax, 4
and eax, 0x17
mov dword [ecx + 0xc], eax
test dword [ecx + 0x10], eax
je 0x415cda
push 0
call fcn.00407a50
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4169f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x453ea8
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x40], 0
je 0x416b44
cmp byte [ebx + 0x45], 0
je 0x416b44
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x416a47
xor al, al
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0xf
mov byte [esp + 0x10], 0
xorps xmm0, xmm0
mov dword [esp + 0x24], ecx
cmp ecx, 0x10
movq qword [esp + 0x10], xmm0
lea eax, [esp + 0x10]
mov dword [esp + 0x20], 8
cmovae eax, dword [esp + 0x10]
mov byte [eax + 8], 0
mov dword [esp + 0x34], 0
mov edi, edi
cmp dword [esp + 0x24], 0x10
lea eax, [esp + 0xc]
mov ecx, dword [ebx + 0x40]
lea edi, [esp + 0x10]
cmovae edi, dword [esp + 0x10]
lea esi, [esp + 0x10]
cmovae esi, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x24]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x416ac1
dec eax
je 0x416ac5
sub eax, 2
je 0x416b1b
xor bl, bl
jmp 0x416b1d
mov byte [ebx + 0x45], 0
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x10]
mov edx, dword [esp + 0x10]
cmp ecx, 0x10
mov esi, dword [esp + 0xc]
cmovae eax, edx
sub esi, eax
je 0x416afc
push dword [ebx + 0x50]
cmp ecx, 0x10
lea eax, [esp + 0x14]
push esi
cmovae eax, edx
push 1
push eax
call fcn.0041974e
add esp, 0x10
cmp esi, eax
jne 0x416abd
cmp byte [ebx + 0x45], 0
je 0x416b1b
test esi, esi
jne 0x416a80
push esi
push 8
lea ecx, [esp + 0x18]
call fcn.00401db0
jmp 0x416a80
mov bl, 1
cmp dword [esp + 0x24], 0x10
jb 0x416b30
push dword [esp + 0x10]
call fcn.00417686
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x2c]
mov al, 1
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x427301
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x466d50]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0041f726
mov dword [ebp - 0x14], eax
cmp dword [0x46969c], esi
jne 0x4273f4
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x427381
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4274d4
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4274d4
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4274d4
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x46969c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4696a0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4696a4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4696ac], eax
test eax, eax
je 0x4273f1
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4696a8], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x427419
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x42740c
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x42742e
push 4
pop eax
jmp 0x4274d6
cmp dword [ebp - 0x14], esi
je 0x42742e
push dword [0x46969c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x427413
mov eax, dword [0x4696a8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x42748c
cmp dword [0x4696ac], edi
je 0x42748c
push eax
call ebx
push dword [0x4696ac]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x42748c
test eax, eax
je 0x42748c
call ecx
test eax, eax
je 0x427481
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x427481
test byte [ebp - 8], 1
jne 0x42748c
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4274bc
mov eax, dword [0x4696a0]
cmp eax, edi
je 0x4274b9
push eax
call ebx
test eax, eax
je 0x4274b9
call eax
mov esi, eax
test esi, esi
je 0x4274b9
mov eax, dword [0x4696a4]
cmp eax, edi
je 0x4274b9
push eax
call ebx
test eax, eax
je 0x4274b9
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x46969c]
call ebx
test eax, eax
je 0x4274d4
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4274d6
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042236e
mov esp, ebp
pop ebp
ret
Function at 0x44cdf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
add ecx, 0xdeadbeef
push ebx
mov ebx, dword [ebp + 8]
add ecx, edx
push esi
mov esi, ecx
mov dword [ebp + 0x10], esi
push edi
mov edi, ecx
cmp edx, 0xc
jbe switch.0x0044cefb
add edx, 0xfffffff3
mov eax, 0xaaaaaaab
mul edx
mov eax, edx
shr eax, 3
inc eax
mov dword [ebp - 4], eax
jmp 0x44ce30
movzx esi, byte [ebx + 7]
movzx eax, byte [ebx + 6]
movzx edx, byte [ebx + 0xb]
shl esi, 8
add esi, eax
shl edx, 8
movzx eax, byte [ebx + 5]
shl esi, 8
add esi, eax
movzx eax, byte [ebx + 4]
add edi, eax
shl esi, 8
movzx eax, byte [ebx + 0xa]
add edi, esi
movzx esi, byte [ebx + 8]
add edx, eax
movzx eax, byte [ebx + 9]
add esi, ecx
shl edx, 8
add edx, eax
shl edx, 8
add esi, edx
mov edx, dword [ebp + 8]
mov ebx, esi
rol ebx, 4
movzx ecx, byte [edx + 3]
movzx eax, byte [edx + 2]
shl ecx, 8
add ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
add ecx, eax
movzx eax, byte [edx]
shl ecx, 8
add ecx, eax
sub ecx, esi
add esi, edi
add ecx, dword [ebp + 0x10]
xor ebx, ecx
sub edi, ebx
mov eax, ebx
add ebx, esi
rol eax, 6
xor eax, edi
sub esi, eax
mov edx, eax
rol edx, 8
add eax, ebx
xor edx, esi
sub ebx, edx
mov esi, edx
rol esi, 0x10
add edx, eax
xor esi, ebx
mov ebx, dword [ebp + 8]
mov edi, esi
sub eax, esi
ror edi, 0xd
add esi, edx
xor edi, eax
mov dword [ebp + 0x10], esi
sub edx, edi
mov ecx, edi
rol ecx, 4
add ebx, 0xc
xor ecx, edx
mov dword [ebp + 8], ebx
mov edx, dword [ebp + 0xc]
add edi, esi
sub edx, 0xc
dec dword [ebp - 4]
mov dword [ebp + 0xc], edx
jne 0x44ce30
cmp edx, 0xc
ja 0x44cf67
jmp dword [edx*4 + 0x44cfb4]
movzx eax, byte [ebx + 0xb]
shl eax, 0x18
add ecx, eax
movzx eax, byte [ebx + 0xa]
shl eax, 0x10
add ecx, eax
movzx eax, byte [ebx + 9]
shl eax, 8
add ecx, eax
movzx eax, byte [ebx + 8]
add ecx, eax
movzx eax, byte [ebx + 7]
shl eax, 0x18
add edi, eax
movzx eax, byte [ebx + 6]
shl eax, 0x10
add edi, eax
movzx eax, byte [ebx + 5]
shl eax, 8
add edi, eax
movzx eax, byte [ebx + 4]
add edi, eax
movzx eax, byte [ebx + 3]
shl eax, 0x18
add esi, eax
movzx eax, byte [ebx + 2]
shl eax, 0x10
add esi, eax
movzx eax, byte [ebx + 1]
shl eax, 8
add esi, eax
movzx eax, byte [ebx]
add esi, eax
mov dword [ebp + 0x10], esi
xor ecx, edi
mov eax, edi
rol eax, 0xe
sub ecx, eax
mov eax, ecx
mov esi, ecx
xor esi, dword [ebp + 0x10]
rol eax, 0xb
sub esi, eax
xor edi, esi
mov eax, esi
ror eax, 7
sub edi, eax
mov eax, edi
xor ecx, edi
rol eax, 0x10
sub ecx, eax
mov eax, ecx
mov edx, ecx
rol eax, 4
xor edx, esi
sub edx, eax
mov eax, edx
xor edi, edx
rol eax, 0xe
sub edi, eax
mov eax, edi
xor ecx, edi
ror eax, 8
sub ecx, eax
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44d3c0
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], 0
mov esi, 0xf0000000
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 4
mov ecx, 0xf0000040
lea eax, [ebp - 4]
cmova esi, ecx
push esi
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x44d41b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.error_CryptAcquireContextA_0x_08lx
call fcn.0041b7d2
add eax, 0x40
push eax
call fcn.0045298c
add esp, 0xc
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
push 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test esi, esi
jne 0x44d45f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.error_CryptGenRandom_0x_08lx
call fcn.0041b7d2
add eax, 0x40
push eax
call fcn.0045298c
add esp, 0xc
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x412e82
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00412d01

Function at 0x4171e6
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00416b54

Function at 0x4171f1
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00416d8f

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0xdd2790
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xe0ab6b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0xe19840]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00df27e7
push 4
mov dword [ebp - 4], 0
call fcn.00df3e67
mov edi, eax
add esp, 4
test edi, edi
je 0xdd2810
call fcn.00df2373
mov dword [edi], eax
call fcn.00df2132
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.00df2067
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0xdd2806
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.00df208f
jmp 0xdd2812
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret