joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45cb00
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x59be20]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45cb9b
sub esp, 0x30
lea ecx, [esp + 0x34]
mov dword [esp + 4], ecx
mov edx, dword [0x59be20]
mov edx, dword fs:[edx]
mov edx, dword [edx]
mov dword [esp + 8], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.00466de7
lea ecx, [sym.runtime.callers.func1]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
lea ecx, [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call sym.runtime.systemstack
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call sym.runtime.morestack_noctxt
jmp sym.runtime.callers
Function at 0x4637a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x59be20]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x463933
sub esp, 0x24
mov eax, dword [esp + 0x28]
test byte [eax], al
lea ecx, [eax + 0x18]
mov dword [esp + 0x20], ecx
nop
mov dword [esp], ecx
call sym.runtime.lock2
mov eax, dword [esp + 0x28]
movzx ecx, byte [eax + 0x1c]
test cl, cl
jne 0x46391c
mov byte [eax + 0x1c], 1
inc dword [eax + 0x24]
inc dword [eax + 0x60]
mov dword [esp], eax
call sym.runtime._pollDesc_.publishInfo
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x28]
mov dword [esp], eax
mov dword [esp + 4], 0x72
mov byte [esp + 8], 0
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], ecx
call sym.runtime.netpollunblock
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x28]
mov dword [esp], ecx
mov dword [esp + 4], 0x77
mov byte [esp + 8], 0
lea edx, [esp + 0x14]
mov dword [esp + 0xc], edx
call sym.runtime.netpollunblock
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 0x3c]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x18], edx
test ecx, ecx
je 0x463888
lea ecx, [eax + 0x28]
mov dword [esp], ecx
call sym.runtime.deltimer
mov eax, dword [0x59bed8]
test eax, eax
jne 0x46386f
mov eax, dword [esp + 0x28]
jmp 0x46387d
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 0x3c]
call sym.runtime.gcWriteBarrier1
mov dword [edi], ecx
mov dword [eax + 0x3c], 0
mov edx, dword [esp + 0x18]
mov ecx, dword [eax + 0x78]
test ecx, ecx
je 0x4638bf
lea ecx, [eax + 0x64]
mov dword [esp], ecx
call sym.runtime.deltimer
mov eax, dword [0x59bed8]
test eax, eax
jne 0x4638aa
mov eax, dword [esp + 0x28]
jmp 0x4638b8
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 0x78]
call sym.runtime.gcWriteBarrier1
mov dword [edi], ecx
mov dword [eax + 0x78], 0
nop
nop
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sym.runtime.unlock2
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4638e5
mov dword [esp], eax
mov dword [esp + 4], 3
call sym.runtime.netpollgoready
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4638fd
mov dword [esp], eax
mov dword [esp + 4], 3
call sym.runtime.netpollgoready
mov eax, dword [esp + 0x14]
test eax, eax
je 0x463918
nop
lea ecx, [0x59bd7c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call sym.runtime_internal_atomic.Xadd
add esp, 0x24
ret
lea eax, [0x4c48c9]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call sym.runtime.throw
nop
call sym.runtime.morestack_noctxt
jmp sym.internal_poll.runtime_pollUnblock

Function at 0x466ae0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x59bd07], 0
je 0x466afa
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp sym.aeshashbody
jmp sym.runtime.memhashFallback

Function at 0x466b00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x59bd07], 0
je 0x466b1b
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp sym.aeshashbody
jmp sym.runtime.strhashFallback
Function at 0x467940
Capabilities:
Allocate thread local storage

Disassembly:
mov ebp, esp
mov eax, dword [sym.imp.kernel32.dll_TlsAlloc]
call eax
mov esp, ebp
mov ecx, eax
cmp ecx, 0x40
jb 0x46795a
mov ecx, 0x14
jmp 0x467963
shl ecx, 2
add ecx, 0xe10
mov dword [0x59be20], ecx
ret
Function at 0x48bd40
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x59be20]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x48bf2a
sub esp, 0x48
mov eax, dword [0x559828]
mov ecx, dword [esp + 0x50]
movzx edx, word [ecx + 2]
movzx ebx, word [ecx + 8]
movzx ebp, word [ecx + 0xa]
movzx esi, word [ecx + 0xc]
mov edi, dword [esp + 0x4c]
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], 1
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
call sym.time.Date
lea edi, [esp + 0x34]
lea esi, [esp + 0x20]
call fcn.004672ce
lea edi, [esp]
lea esi, [esp + 0x34]
call fcn.004672ce
call sym.time.Time.abs
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
add eax, 0x15180
mov dword [esp], eax
adc ecx, 0
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x93a80
mov dword [esp + 0xc], 0
call sym.runtime.uint64mod
mov eax, dword [esp + 0x50]
movzx ecx, word [eax + 4]
mov edx, dword [esp + 0x10]
mov ebx, eax
mov eax, 0xc22e4507
mov ebp, edx
imul edx
mov eax, ebp
sar ebp, 0x1f
add eax, edx
sar eax, 0x10
sub eax, ebp
sub ecx, eax
test ecx, ecx
jge 0x48be17
add ecx, 7
movzx edx, word [ebx + 6]
lea ebp, [edx - 1]
cmp ebp, 4
jge 0x48be31
lea ebx, [edx + edx*2]
lea edx, [edx + ebx*2]
lea ecx, [ecx + edx - 6]
mov edx, ecx
jmp 0x48bea8
movzx eax, word [ebx + 2]
cmp eax, 2
jne 0x48be7e
mov edx, dword [esp + 0x4c]
test edx, 3
jne 0x48be7a
mov ebx, edx
sar edx, 0x1f
mov ebp, eax
mov eax, 0x51eb851f
mov esi, edx
imul ebx
mov edi, edx
sar edx, 5
sub edx, esi
imul edx, edx, 0x64
cmp ebx, edx
jne 0x48be73
sar edi, 7
sub edi, esi
imul edx, edi, 0x190
cmp ebx, edx
jne 0x48be80
mov ebx, 0x1d
jmp 0x48be9e
mov ebp, eax
jmp 0x48be80
mov ebp, eax
cmp ebp, 0xd
jae 0x48bf1d
lea eax, [ebp - 1]
lea edx, [0x553580]
mov ebx, dword [edx + ebp*4]
cmp eax, 0xd
jae 0x48bf13
sub ebx, dword [edx + ebp*4 - 4]
lea edx, [ecx + 0x1d]
cmp ebx, edx
jge 0x48bea8
lea edx, [ecx + 0x16]
mov ecx, dword [esp + 0x38]
test ecx, 0x80000000
je 0x48beda
mov ebx, dword [esp + 0x34]
shl ecx, 1
mov ebp, ebx
shl ebx, 1
shr ebp, 0x1f
or ebp, ecx
mov ecx, ebp
shl ebp, 1
shr ecx, 0x1f
shr ebx, 0x1f
or ebp, ebx
add ebp, 0xd7b17f80
adc ecx, 0xd
jmp 0x48bee2
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
lea eax, [edx - 1]
mov edx, eax
sar edx, 0x1f
mov ebx, 0x15180
mov esi, edx
mul ebx
imul ebx, esi, 0x15180
add edx, ebx
add eax, ebp
adc edx, ecx
add eax, 0x886e0900
mov dword [esp + 0x54], eax
adc edx, 0xfffffff1
mov dword [esp + 0x58], edx
add esp, 0x48
ret
mov ecx, 0xd
call sym.runtime.panicIndex
mov eax, ebp
mov ecx, 0xd
call sym.runtime.panicIndex
nop
call sym.runtime.morestack_noctxt
jmp sym.time.pseudoUnix
Function at 0x49c5a0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x59be20]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x49c641
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [esp + 0x18]
cmp dword [edx], ecx
jne 0x49c637
movzx ecx, byte [eax + 4]
cmp byte [edx + 4], cl
jne 0x49c637
movzx ecx, byte [eax + 5]
cmp byte [edx + 5], cl
jne 0x49c637
movzx ecx, byte [eax + 6]
cmp byte [edx + 6], cl
jne 0x49c637
movzx ecx, byte [eax + 7]
cmp byte [edx + 7], cl
jne 0x49c637
movzx ecx, byte [eax + 8]
cmp byte [edx + 8], cl
jne 0x49c637
movzx ecx, byte [eax + 9]
cmp byte [edx + 9], cl
jne 0x49c637
movzx ecx, byte [eax + 0xa]
cmp byte [edx + 0xa], cl
jne 0x49c637
movzx ecx, byte [eax + 0xb]
cmp byte [edx + 0xb], cl
jne 0x49c637
movzx ecx, byte [eax + 0xc]
cmp byte [edx + 0xc], cl
jne 0x49c637
add eax, 0x10
mov dword [esp], eax
lea eax, [edx + 0x10]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x4c
call sym.runtime.memequal
movzx eax, byte [esp + 0xc]
jmp 0x49c639
xor eax, eax
mov byte [esp + 0x1c], al
add esp, 0x10
ret
call sym.runtime.morestack_noctxt
jmp sym.type:.eq.fmt.fmt
Function at 0x49eeb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x59be20]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x49efaa
sub esp, 0x20
mov ecx, dword [esp + 0x24]
test byte [ecx], al
mov edx, dword [esp + 0x28]
mov ebx, edx
and edx, 0x7f
shl edx, 5
add ecx, edx
mov dword [esp + 0x1c], ecx
xor eax, eax
jmp 0x49eef0
mov ebp, dword [esp + 0x14]
inc ebp
mov ecx, dword [esp + 0x1c]
mov ebx, eax
mov eax, ebp
cmp eax, 4
jge 0x49ef29
mov dword [esp + 0x14], eax
lea edx, [ecx + eax*8]
mov dword [esp], edx
call sym.sync_atomic.LoadUint64
mov eax, dword [esp + 0x28]
cmp dword [esp + 4], eax
sete cl
mov edx, dword [esp + 0x2c]
cmp dword [esp + 8], edx
sete bl
and ebx, ecx
test bl, bl
je 0x49eee3
mov byte [esp + 0x30], 1
add esp, 0x20
ret
xor eax, eax
mov edx, 0x84222325
jmp 0x49ef33
inc eax
cmp eax, 4
jge 0x49ef49
mov dword [esp + 0x18], eax
lea ebp, [ecx + eax*8]
mov esi, dword [ebp]
mov ebp, dword [ebp + 4]
xor edi, edi
jmp 0x49efa3
and edx, 3
lea eax, [ecx + edx*8]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], eax
call sym.sync_atomic.StoreUint64
mov byte [esp + 0x30], 0
add esp, 0x20
ret
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebp
and esi, 0xff
xor edx, esi
mov esi, dword [esp + 0xc]
shr esi, 8
shl ebp, 0x18
mov eax, edx
mov ebx, 0x1b3
mul ebx
inc edi
or esi, ebp
mov ebp, dword [esp + 0x10]
shr ebp, 8
mov ebx, dword [esp + 0x28]
mov edx, eax
mov eax, dword [esp + 0x18]
cmp edi, 8
jl 0x49ef6c
jmp 0x49ef32
call sym.runtime.morestack_noctxt
jmp sym.internal_bisect._dedup_.seenLossy
Function at 0x10001000
Capabilities:
Parse pe header

Disassembly:
push 0x24
push 0x100048f0
call fcn.10002590
push 0x1c
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
and dword [ebp - 4], 0
mov eax, 0x5a4d
mov edx, dword [ebp - 0x30]
cmp word [edx], ax
jne 0x10001068
mov eax, dword [edx + 0x3c]
add eax, edx
cmp dword [eax], 0x4550
jne 0x10001068
mov ecx, dword [eax + 0xd8]
lea esi, [ecx + edx]
cmp dword [ebp + 0xc], esi
jb 0x10001068
mov eax, dword [eax + 0xdc]
add eax, ecx
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x10001068
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x10001071
mov dword [ebp - 4], 0xfffffffe
xor al, al
call fcn.100025e0
ret
Function at 0x10001169
Capabilities:
Allocate or change rwx memory
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
mov esi, eax
push edi
mov ebx, 0x10000
cmp esi, 0x7ff80000
jbe 0x1000118c
lea eax, [esi - 0x7ff80000]
mov dword [ebp - 4], eax
jmp 0x1000118f
mov dword [ebp - 4], ebx
cmp esi, 0x80000000
jae 0x100011a2
lea eax, [esi + 0x7ff80000]
mov dword [ebp - 8], eax
jmp 0x100011a9
mov dword [ebp - 8], 0xfff80000
mov eax, dword [0x1000510c]
mov ecx, dword [0x10005108]
test eax, eax
jne 0x100011c3
test ecx, ecx
je 0x100011d8
mov eax, ecx
mov dword [0x1000510c], eax
mov edx, dword [eax + 8]
test edx, edx
je 0x100011d8
cmp edx, dword [ebp - 4]
jb 0x100011d8
cmp edx, dword [ebp - 8]
jbe 0x100012a9
mov eax, ecx
test ecx, ecx
jmp 0x100011fc
test eax, eax
je 0x100011f7
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x100011f7
cmp ecx, dword [ebp - 4]
jb 0x100011f7
cmp ecx, dword [ebp - 8]
jbe 0x100012a9
mov eax, dword [eax + 4]
test eax, eax
mov dword [0x1000510c], eax
jne 0x100011de
mov eax, esi
and eax, 0xffff
sub esi, eax
mov edi, esi
cmp esi, dword [ebp - 4]
jbe 0x1000133b
lea eax, [edi - 0x70000000]
cmp eax, 0x10000000
ja 0x10001229
mov edi, 0x6fff0000
push 0x1c
lea eax, [ebp - 0x40]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1000133b
cmp dword [ebp - 0x30], ebx
jne 0x10001248
cmp dword [ebp - 0x34], ebx
jae 0x1000125b
mov edi, dword [ebp - 0x3c]
add edi, 0xffff0000
cmp edi, dword [ebp - 4]
ja 0x10001217
jmp 0x1000133b
push 0x40
push 0x3000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x1000510c], eax
test eax, eax
je 0x1000133b
mov ecx, dword [0x10005108]
xor edx, edx
mov dword [eax + 4], ecx
mov dword [eax], 0x52727464
mov dword [eax + 8], edx
mov dword [0x10005108], eax
lea ecx, [eax + 0xffe0]
mov esi, 0x7fd
mov dword [ecx + 0x18], edx
mov edx, ecx
sub ecx, 0x20
dec esi
jne 0x1000129b
mov dword [eax + 8], edx
mov esi, dword [eax + 8]
cmp esi, dword [ebp - 4]
jb 0x10001340
cmp esi, dword [ebp - 8]
ja 0x10001340
mov ecx, dword [esi + 0x18]
push 0x20
push 0xcc
push esi
mov dword [eax + 8], ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, esi
jmp 0x10001342
lea eax, [esi - 0x70000000]
cmp eax, 0x10000000
ja 0x100012ea
mov esi, 0x80010000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10001340
cmp dword [ebp - 0x14], ebx
jne 0x10001335
cmp dword [ebp - 0x18], ebx
jb 0x10001335
movzx ecx, si
test ecx, ecx
je 0x10001319
mov eax, ebx
sub eax, ecx
sub dword [ebp - 0x18], eax
add dword [ebp - 0x24], eax
mov esi, dword [ebp - 0x24]
push 0x40
push 0x3000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x1000510c], eax
test eax, eax
jne 0x10001277
mov esi, dword [ebp - 0x24]
add esi, dword [ebp - 0x18]
cmp esi, dword [ebp - 8]
jb 0x100012d8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100013cb
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push edi
xor edi, edi
cmp dword [0x10005114], edi
je 0x100013de
mov eax, 0x10dd
jmp 0x10001439
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x10005114
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x100013d7
push esi
mov esi, dword [0x10005108]
mov dword [0x10005110], edi
mov dword [0x10005124], edi
mov dword [0x10005120], edi
mov dword [0x10005118], edi
mov dword [0x1000511c], edi
jmp 0x10001432
lea eax, [esp + 8]
push eax
push 0x40
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [esi + 4]
cmp esi, edi
jne 0x1000141c
xor eax, eax
pop esi
pop edi
pop ecx
ret

Function at 0x1000143c
Capabilities:
Resume thread

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x10005114], eax
je 0x10001452
mov eax, 0x10dd
pop ecx
ret
push ebx
push esi
mov esi, dword [0x10005124]
xor ebx, ebx
push edi
cmp esi, ebx
je 0x1000149d
lea eax, [esp + 0xc]
push eax
mov eax, dword [esi + 0x10]
push dword [esi + 0x14]
movzx eax, byte [eax + 0x17]
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [esi + 4], ebx
jne 0x1000148e
mov edi, dword [esi + 0x10]
cmp edi, ebx
je 0x1000148e
call fcn.10001347
mov dword [esi + 0x10], ebx
mov edi, dword [esi]
push esi
call fcn.10002623
pop ecx
mov esi, edi
cmp edi, ebx
jne 0x10001461
mov dword [0x10005124], ebx
call fcn.10001142
mov esi, dword [0x10005120]
cmp esi, ebx
je 0x100014ca
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edi, dword [esi]
push esi
call fcn.10002623
pop ecx
mov esi, edi
cmp edi, ebx
jne 0x100014b2
pop edi
pop esi
mov dword [0x10005120], ebx
mov dword [0x10005114], ebx
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x10001721
Capabilities:
Suspend thread

Disassembly:
mov eax, dword [0x10005118]
test eax, eax
jne 0x10001791
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, dword [esp + 8]
cmp edi, eax
jne 0x1000173d
xor eax, eax
jmp 0x10001790
push esi
push 8
call fcn.10002628
mov esi, eax
pop ecx
test esi, esi
jne 0x10001751
push 8
pop edi
jmp 0x1000176c
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x1000177d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call fcn.10002623
pop ecx
and dword [0x1000511c], 0
mov dword [0x10005118], edi
mov eax, edi
jmp 0x1000178f
mov eax, dword [0x10005120]
mov dword [esi], eax
mov dword [esi + 4], edi
mov dword [0x10005120], esi
xor eax, eax
pop esi
pop edi
ret 4
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00404502
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00404502
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00404502
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00404502
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00404502
mov dword [0x41203c], eax
call fcn.00404502
test eax, eax
jge 0x402550
push 8
call fcn.00404502
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00404502
pop ecx
push 1
call fcn.00404502
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00404502
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00404502
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00404502
jmp 0x402495

Function at 0x4036a8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x407034], 0
je 0x403709
cmp word [0x407310], 0xd7b2
jne 0x4036d1
cmp dword [0x407318], 0
jbe 0x4036d1
mov eax, 0x40730c
call dword [0x407328]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403734
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x406018], 0
jne 0x403725
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x403ab0
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret
Function at 0x1000412c
Capabilities:
Set file attributes

Disassembly:
push edx
push ecx
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
test eax, eax
setne al
ret

Function at 0x100045e5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100045f3
or eax, eax
ret

Function at 0x1000ac8d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x1000ac9c
pop dword [ebp - 0x1c]
mov eax, 0x1000ac9c
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x42d5a
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x43fc
mov ebx, eax
mov esi, 0x809cb014
sub esi, 0x708a9214
add esi, dword [ebp - 0x1c]
mov edx, 0xa07b764e
xor dword [ebp - 0x18], ecx
mov edi, dword [esi]
sub dword [ebp - 0x18], esi
xor edi, edx
sub dword [ebp - 0x18], ebx
mov dword [ebx], edi
xor dword [ebp - 4], 0x3d5bb33b
add ebx, 0x54cdc877
sub ebx, 0x54cdc873
add esi, 0xeb982545
add esi, 0x1467dabf
loop 0x1000ace5
add eax, 0x82ae204
sub eax, 0x829df41
mov ebx, eax
add eax, 5
mov ecx, 0x485dbae9
sub ecx, 0x385dbae9
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x1000df9d
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100d01b8
call fcn.100cece0
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.10001da4
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.10001da4
mov eax, dword [edi + 0x18]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov al, byte [edi + 0x2c]
mov byte [esi + 0x2c], al
mov al, byte [edi + 0x2d]
mov byte [esi + 0x2d], al
mov al, byte [edi + 0x2e]
mov byte [esi + 0x2e], al
mov al, byte [edi + 0x2f]
mov byte [esi + 0x2f], al
mov al, byte [edi + 0x30]
mov byte [esi + 0x30], al
mov al, byte [edi + 0x31]
mov byte [esi + 0x31], al
mov ax, word [edi + 0x32]
mov word [esi + 0x32], ax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x402bb0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
test eax, eax
mov ecx, dword [esi]
push ebp
mov ebp, dword [esp + 0x18]
mov dword [esp + 8], 0
mov dword [esp + 0xc], ecx
mov dword [esi], 0
je 0x402c61
test ebp, ebp
je 0x402c61
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x402c61
test ebx, ebx
je 0x402c61
lea edx, [esp + 4]
push edx
push 0x20019
push 0
push eax
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402c44
mov ecx, dword [esi]
push edi
mov edx, ecx
shr ecx, 2
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
mov edx, dword [esp + 8]
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x10]
push eax
push ebx
lea ecx, [esp + 0x14]
push ecx
push 0
push ebp
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x402c49
mov eax, edi
pop edi
pop ebp
add esp, 0xc
ret
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
mov dword [edx], ecx
pop edi
mov dword [esi], eax
xor eax, eax
pop ebp
add esp, 0xc
ret
mov eax, 6
pop ebp
add esp, 0xc
ret