joyce8/EMBER2024-capa huggingface dataset:
Function at 0x558aa4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1020
call fcn.004fd580
mov eax, dword [0x5c125c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 0x1018], ebx
call fcn.0054b0bc
push ebx
lea esi, [eax - 1]
mov dword [ebp - 0x1020], esi
call fcn.00567673
pop ecx
pop ecx
test esi, esi
jne 0x558b1a
push 1
push ebx
push edi
call fcn.0055912e
mov esi, dword [ebp + 0x10]
add esp, 0xc
mov ebx, eax
inc esi
push dword [ebp - 0x1018]
call fcn.0050af04
pop ecx
test eax, eax
je 0x558c76
push 0
push 0
push edi
call fcn.0054c71f
jmp 0x558c71
push str.too_many_arguments
lea eax, [esi + 0x14]
push eax
push edi
call fcn.0054c591
mov esi, dword [ebp + 0x10]
xor ebx, ebx
mov eax, dword [ebp - 0x1020]
add esp, 0xc
inc ebx
mov dword [ebp - 0x101c], esi
dec eax
mov dword [ebp - 0x1020], eax
test ebx, ebx
je 0x558af7
push esi
push edi
call fcn.0054be72
pop ecx
pop ecx
cmp eax, 3
jne 0x558be7
push esi
push edi
call fcn.0054c41e
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x558b97
mov ebx, dword [ebp - 0x1018]
push ebx
call fcn.0050b355
mov esi, eax
push ebx
push esi
call fcn.0050bab3
push 0x5a985c
push edi
call fcn.0054b582
xor ebx, ebx
add esp, 0x14
cmp esi, 0xffffffff
setne bl
jmp 0x558bdf
lea eax, [ebp - 0x1014]
push eax
push edi
call fcn.0054c372
lea eax, [ebp - 0x1014]
push esi
push eax
call fcn.0054cca8
push dword [ebp - 0x1018]
push esi
push 1
push eax
call fcn.0050bebb
mov esi, eax
lea eax, [ebp - 0x1014]
add dword [ebp - 0x100c], esi
push eax
call fcn.0054cd27
xor eax, eax
add esp, 0x24
cmp eax, esi
sbb ebx, ebx
neg ebx
mov esi, dword [ebp - 0x101c]
jmp 0x558c4b
push 0
push esi
push edi
call fcn.0054c47e
add esp, 0xc
cmp byte [eax], 0x2a
jne 0x558bf9
inc eax
movsx eax, byte [eax]
sub eax, 0x4c
je 0x558c38
sub eax, 0x15
je 0x558c25
sub eax, 0xb
je 0x558c21
dec eax
sub eax, 1
jne 0x558c65
push dword [ebp - 0x1018]
push edi
call fcn.00559243
pop ecx
pop ecx
jmp 0x558c49
push 1
jmp 0x558c3a
push dword [ebp - 0x1018]
push edi
call fcn.005590ba
pop ecx
xor ebx, ebx
pop ecx
inc ebx
jmp 0x558c4b
push 0
push dword [ebp - 0x1018]
push edi
call fcn.0055912e
add esp, 0xc
mov ebx, eax
mov eax, dword [ebp - 0x1020]
inc esi
mov dword [ebp - 0x101c], esi
test eax, eax
jne 0x558b3e
jmp 0x558af7
push str.invalid_format
push esi
push edi
call fcn.0054c295
add esp, 0xc
jmp 0x558c90
test ebx, ebx
jne 0x558c8b
push 0xfffffffffffffffe
push edi
call fcn.0054bb3d
push edi
call fcn.0054b550
add esp, 0xc
sub esi, dword [ebp + 0x10]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fce93
mov esp, ebp
pop ebp
ret
Function at 0x558ca1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
call fcn.0054b0bc
mov edi, dword [ebp + 0x10]
pop ecx
push 1
pop esi
sub eax, edi
je 0x558d67
dec eax
push edi
push ebx
mov dword [ebp - 4], eax
call fcn.0054be72
pop ecx
pop ecx
cmp eax, 3
jne 0x558d3a
push edi
push ebx
call fcn.0054b177
pop ecx
pop ecx
push 0
push edi
push ebx
test eax, eax
je 0x558cfc
call fcn.0054bcc9
push edx
push eax
push str._lld
push dword [ebp + 0xc]
call fcn.0051eee5
add esp, 0x1c
jmp 0x558d17
call fcn.0054bd92
fstp qword [esp + 4]
mov dword [esp], str._.14g
push dword [ebp + 0xc]
call fcn.0051eee5
add esp, 0x10
test esi, esi
je 0x558d1f
test eax, eax
jg 0x558d62
xor esi, esi
mov eax, dword [ebp - 4]
inc edi
test eax, eax
jne 0x558cc0
test esi, esi
jne 0x558d67
push esi
push esi
push ebx
call fcn.0054c71f
add esp, 0xc
jmp 0x558d6a
lea eax, [ebp + 0x10]
push eax
push edi
push ebx
call fcn.0054c47e
add esp, 0xc
test esi, esi
je 0x558d1f
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push 1
push eax
call fcn.0050b750
add esp, 0x10
cmp eax, dword [ebp + 0x10]
jne 0x558d1f
xor esi, esi
inc esi
jmp 0x558d21
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5590ba
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.004fd580
mov eax, dword [0x5c125c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x1014]
push esi
mov esi, dword [ebp + 0xc]
push edi
push ecx
push eax
call fcn.0054c372
pop ecx
pop ecx
mov edi, 0x1000
lea eax, [ebp - 0x1014]
push edi
push eax
call fcn.0054cca8
push esi
push edi
push 1
push eax
call fcn.0050bebb
add dword [ebp - 0x100c], eax
add esp, 0x18
cmp eax, edi
je 0x5590ed
lea eax, [ebp - 0x1014]
push eax
call fcn.0054cd27
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004fce93
mov esp, ebp
pop ebp
ret
Function at 0x562eba
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
mov eax, dword [0x5c125c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push edi
mov edi, dword [ebp + 8]
mov ebx, 0x208
push ebx
push 0
push eax
call fcn.005033f0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push esi
lea ecx, [ebp - 0x42c]
call fcn.00407800
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x45c]
call fcn.00407780
push str._install_path_
lea ecx, [ebp - 0x444]
call fcn.00407780
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x42c]
push eax
call fcn.00562e05
add esp, 0xc
lea ecx, [ebp - 0x444]
xor esi, esi
push esi
push 1
call fcn.00407c70
push esi
push 1
lea ecx, [ebp - 0x45c]
call fcn.00407c70
push ebx
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.005033f0
add esp, 0xc
lea ecx, [ebp - 0x414]
cmp dword [ebp - 0x418], 8
lea eax, [ebp - 0x42c]
cmovae eax, dword [ebp - 0x42c]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x414]
mov ecx, edi
push eax
call fcn.00407780
cmp dword [edi + 0x14], 8
mov byte [ebp - 0x45d], 0x5c
mov byte [ebp - 0x45e], 0x2f
jb 0x562fd5
mov ecx, dword [edi]
jmp 0x562fd7
mov ecx, edi
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
lea eax, [ecx + eax*2]
jb 0x562fe7
mov ecx, dword [edi]
jmp 0x562fe9
mov ecx, edi
lea edx, [ebp - 0x45d]
push edx
lea edx, [ebp - 0x45e]
push edx
push eax
push ecx
call fcn.004ed174
add esp, 0x10
lea ecx, [ebp - 0x42c]
push esi
push 1
call fcn.00407c70
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fce93
mov esp, ebp
pop ebp
ret

Function at 0x563022
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x5c125c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x260]
push 0x22c
xor ebx, ebx
push ebx
push eax
call fcn.005033f0
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x563065
xor al, al
jmp 0x5630d4
lea eax, [ebp - 0x260]
mov dword [ebp - 0x260], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x5630c7
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00407780
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.00415e60
pop ecx
pop ecx
push eax
mov ecx, edi
call fcn.004232d0
push ebx
push 1
lea ecx, [ebp - 0x34]
call fcn.004080b0
push ebx
push 1
lea ecx, [ebp - 0x1c]
call fcn.00407c70
lea eax, [ebp - 0x260]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x56307e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fce93
mov esp, ebp
pop ebp
ret
Function at 0x563eb4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push ebx
mov ebx, dword [ebp + 8]
push edi
push ecx
push str.kernel32.dll
mov dword [ebx], ecx
mov dword [eax], ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x563f29
push esi
push edi
call fcn.004fd11a
pop ecx
mov esi, eax
xor eax, eax
push esi
push edi
push eax
push str.kernel32.dll
mov dword [ebp + 8], eax
mov dword [ebp - 4], eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x563f21
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push 0x5a3f98
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x563f21
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 8]
mov dword [ebx], eax
mov eax, dword [ecx + 0xc]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
push esi
call fcn.004fd115
pop ecx
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x563f2f
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [ebp - 0x24], 9
je 0x563f51
cmp word [ebp - 0x24], 6
je 0x563f51
xor al, al
jmp 0x563f53
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x47da50
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x515cfb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x116b448]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x47db88
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x47dab6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00509ab9
xor eax, eax
jmp 0x47dbff
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.00509bf6
push esi
lea ecx, [esp + 0xc]
call fcn.00509e85
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x47dbdd
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push SysReAllocString
call fcn.0047d9e0
test eax, eax
jne 0x47dbdd
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push SysReAllocString
mov ecx, edi
call fcn.0047d9e0
test eax, eax
jne 0x47dbdd
lea eax, [esp + 0x14]
push str.__1_
push eax
call fcn.004f19d3
mov esi, eax
add esp, 8
test esi, esi
jne 0x47dbbc
lea ecx, [esp + 0x14]
push 0x1156c00
push ecx
call fcn.004f1770
mov esi, eax
add esp, 8
test esi, esi
jne 0x47dbbc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x47dbbf
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.00509ba6
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x47dace
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00509ab9
xor eax, eax
jmp 0x47dbff
mov byte [esi], 0
push 0x1156bfc
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.00509ab9
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x50be86
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x50bebe
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00509f14
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00509eec
jmp 0x50beca
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x50d578
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x50d5ba
call fcn.00512ffa
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x50d5ba
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x50d5b1
xor eax, eax
jmp 0x50d5c2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0050d5c8
pop edi
pop esi
pop ebx
ret 4

Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.USER32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push 0x5040d1
push 0x504088
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.USER32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.USER32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret
Function at 0x746d40
Capabilities:
Encode data using xor

Disassembly:
mov eax, esi
imul edi, edx
mov bh, 0x89
imul ebx, ebp
xor eax, 0x8e37
cmp ecx, 0x4d1e
jne 0x746d60
sbb ecx, 0x4a1d06e2
test ch, dh
sub esi, 0xc3af5c5d
adc ebx, 0x35c500a0
bswap edx
or eax, eax
cmp esi, edx
jno 0x746d78
mov ecx, edi
mov ecx, ebx
mov edx, 0x117f
sub edx, 0x636
mov cl, 0x31
push edx
lea esi, [0x8478079c]
pop esi
jb 0x746d9a
test esi, 0x31ca8e5f
mov cl, 0xe6
or dl, 0x63
xor esi, 0xb12
movsx ecx, ax
lea edi, [esi]
mov cl, ch
imul edi, edi, 0xb
xchg ecx, ebp
sbb ah, ah
imul ecx, edi, 0x95d888c3
lea edx, [0x45d9f]
xor edx, 0x45d9e
movsx ecx, si
sub edi, edx
test ah, ah
sub eax, eax
xchg esi, edx
or eax, 0xc93a20b6
cmp edi, 0x48
jae 0x746daa
cmp ecx, edi
jno 0x746ddf
movzx edx, ch
push 0xd52741
add cl, bl
call 0x746e08
imul ecx, esi, 0x9192cdfb
mov esi, 0x23cbf438
sub eax, 0x690e
cmp ebx, edx
jb 0x746e03
imul esi, ebx
sub eax, 0x5040
mov edx, 0xbf6f5e26
movsx esi, bl
lea ebx, [0xcd9c259a]
xor eax, 0x2ec2
imul esi, ecx, 0xdd0092b6
dec eax
mov ebx, 0xcecae345
movzx ebp, ch
add ebp, ebx
mov edx, 0x6e34
cmp eax, 0xad180574
xor edx, 0x63c4
or eax, 0xcaf28dda
xor edx, 0x579
inc ebx
lea esi, [edx]
sub bh, dl
sub esi, 0x889
mov cl, bh
mov al, cl
add esi, 0x8dc0f
test bl, 0x5d
sub esi, 0x8dc0e
imul ebp, ebp, 0x8efd1288
cmp esi, 0x1c4
jb 0x746e54
pop edi
movd mm0, edi
jb 0x746e7e
mov bh, 0xec
mov esi, eax
lea ecx, [ebp]
xor al, 0x78
test eax, 0x84500ab8
push ecx
jmp 0x746e95
pop edi
dec eax
test edi, edi
add edx, edi
movd ecx, mm0
not ah
movsx ebx, dx
sub dl, bl
add ecx, 0x2536d
sub ecx, 0x613b
mov edi, 0xcc9a3b99
push 0xc424a2
lea eax, [0xc3415419]
test cl, cl
test ebx, eax
mov ah, ah
adc edi, edx
mov edi, ebx
lea edi, [ecx]
lea edx, [edi]
lea edi, [0xe115d649]
js 0x746edc
imul edi, ebx
mov eax, edx
xor dh, bh
inc edi
xchg dh, dh
bswap edi
lea ebp, [0]
cmp eax, 0xac7d
jo 0x746ef8
lea edi, [0xc205272]
mov dl, 0x9f
or ebp, eax
inc eax
xchg al, dl
mov ebx, ebp
movzx ebp, ch
jmp 0x746f0e
sub esi, ebx
inc eax
and al, 0x39
lea edi, [0xa0492c3]
bswap eax
push ecx
mov dh, bl
ret
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..data
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x5842bc5
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x18145866
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x402404
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.004025b4
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x402502
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x4024a5
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x4024e8
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x4024bc
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x4024d7
test al, 0x40
je 0x4024ce
mov ecx, dword [edi + 0x20]
jmp 0x4024d5
test al, 0x80
je 0x4024e8
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x4024e8
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x402474
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x418706
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x4187b9
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]

Function at 0x418e24
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x418e47
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x418e47
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x418e51
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x418e93
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x418ef5
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x418ef0
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x418edb
test dl, dl
je 0x418ed7
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x418edb
add ecx, 2
add eax, 2
test dl, dl
jne 0x418ebb
xor eax, eax
jmp 0x418ee0
sbb eax, eax
or eax, 1
test eax, eax
je 0x418f01
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x418ea8
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8

Function at 0x418f9e
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jge 0x418fc0
mov eax, 0xfffffffd
jmp 0x419092
cmp dword [0x959ca4], 0
je 0x41906b
cmp dword [0x959ca8], 5
jl 0x418fee
cmp dword [0x959ca8], 7
jg 0x418fee
mov eax, 1
jmp 0x418ff3
mov eax, 0
test eax, eax
jne 0x41900c
cmp dword [0x959ca8], 0xfffffffb
je 0x41900c
xor eax, eax
jmp 0x419011
mov eax, 1
test eax, eax
je 0x41903d
mov eax, dword [ebp]
add eax, 0x80
mov ecx, 0x20
push dword [eax]
sub eax, 4
loop 0x419026
mov eax, dword [ebp + 8]
call dword fs:[0xc0]
nop
nop
leave
ret 4
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
cmp dword [0x959ca4], 0
jne 0x419088
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x419092
mov esp, ebp
pop ebp
ret 4
Function at 0x611d4b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov eax, 0x816cd4
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00418879
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x611d7f
push ebx
call fcn.0067c3b1
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
xor edx, edx
not ecx
cmp dword [ebp + 0x10], edx
jbe 0x611dae
push esi
mov esi, dword [ebp + 0xc]
movzx eax, byte [edx + esi]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [ebx + eax*4]
inc edx
cmp edx, dword [ebp + 0x10]
jl 0x611d98
pop esi
not ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
jmp 0x611dbb
mov esp, ebp
pop ebp
ret 0xc
Function at 0x6b2af0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x781408
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
call fcn.006ad330
test eax, eax
je 0x6b2bf8
lea ecx, [esp + 0xc]
call fcn.00680810
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push eax
mov eax, dword [esp + 0x34]
push ecx
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x3c], 0
call fcn.006ad330
mov ecx, eax
call fcn.006aaa00
test eax, eax
je 0x6b2bdf
mov eax, dword [esp + 0x1c]
test eax, eax
mov ebp, eax
je 0x6b2bdf
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x6b2bdf
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
neg esi
push edi
push ebx
sbb esi, esi
and esi, edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, ebp
mov edi, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
call fcn.00680a10
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
pop edi
jne 0x6b2bc1
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x6b2bdf
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [0x966a28]
push ebx
and eax, 0xffff
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0xc], 0x85abd0
call fcn.00680a10
mov ecx, dword [esp + 0x20]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0x10