joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4059bd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40fba0
cmp edx, dword [eax]
je 0x4059df
add eax, 8
inc ecx
cmp eax, 0x40fc30
jl 0x4059d0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40fba0]
jne 0x405b0d
mov eax, dword [0x41f1f0]
cmp eax, 1
je 0x405ae7
test eax, eax
jne 0x405a10
cmp dword [0x40faec], 1
je 0x405ae7
cmp edx, 0xfc
je 0x405b0d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x405a47
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004067c0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00405e80
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x405a8a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00405e80
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40841c
push edi
call fcn.00406940
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004067c0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004067d0
lea eax, [ebp - 0xa0]
push 0x4083fc
push eax
call fcn.004067d0
push dword [esi + 0x40fba4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004067d0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004068b0
add esp, 0x2c
pop edi
jmp 0x405b0d
lea eax, [ebp + 8]
lea esi, [esi + 0x40fba4]
push 0
push eax
push dword [esi]
call fcn.00405e80
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x252c2f13
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0xa24772
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x8224650
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x82246a8
call fcn.08229120
test eax, eax
jne 0x82246b0
mov eax, dword [0x8246c78]
test eax, eax
je 0x822467c
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x82246a8
push 0x82473a0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [ebp + 8]
push eax
push 0
push 1
push fcn.082303b0
push 0
push 0
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
pop edi
pop ebp
ret 4
mov ecx, dword [0x8246cbc]
push esi
push 0x14
push 8
push ecx
call fcn.08230040
mov esi, eax
add esp, 0xc
test esi, esi
je 0x82246f4
lea edx, [esi + 4]
push edx
call fcn.0822a400
add esp, 4
cmp ax, 0xffff
je 0x82246f4
cmp dword [0x8246c70], 0
jne 0x8224703
mov eax, dword [0x8246cbc]
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
mov dword [edi], 0
or eax, 0xffffffff
pop edi
pop ebp
ret 4
mov dword [edi], esi
pop esi
xor eax, eax
pop edi
pop ebp
ret 4
Function at 0x8229200
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x8242050
push 0x824163a
mov eax, dword fs:[0]
push eax
sub esp, 0x30c
mov eax, dword [0x8246b14]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor ebx, ebx
sub eax, ebx
je 0x8229411
sub eax, 1
jne 0x8229471
mov dword [ebp - 4], ebx
push 0x8247380
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call esi
push 0x8247ac0
call esi
mov dword [0x8246c70], edi
push 0x8221f1c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x8246c74], eax
cmp eax, ebx
jne 0x82292ce
test byte [0x8246c90], 2
je 0x82292c0
mov eax, dword [0x8248188]
test eax, eax
je 0x82292c0
cmp dword [0x82447ec], 0xffffffff
je 0x82292c0
push ebx
mov ecx, dword [0x8248188]
push ecx
push 0x1b800
mov edx, dword [0x82480ec]
push edx
mov eax, dword [0x82447ec]
push eax
call dword [0x82447b0]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
jmp 0x8229476
push 0x8247ae0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [0x8246b68], ebx
jne 0x82292e6
call fcn.08226040
call fcn.0822ffc0
test eax, eax
jne 0x8229351
push 0x200
lea ecx, [ebp - 0x31c]
push ecx
push 0x232f
mov edx, dword [0x8246c74]
push edx
mov esi, dword [sym.imp.USER32.dll_LoadStringA]
call esi
push 0x100
lea eax, [ebp - 0x11c]
push eax
push 0x2328
mov ecx, dword [0x8246c74]
push ecx
call esi
push 0x240010
lea edx, [ebp - 0x11c]
push edx
lea eax, [ebp - 0x31c]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
jmp 0x8229476
call fcn.0823afa0
call fcn.0822a3e0
push 0x105
push 0x82473a0
mov ecx, dword [0x8246c70]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov esi, dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
jne 0x8229394
push 0x105
push 0x82473a0
push 0x2333
mov edx, dword [0x8246c74]
push edx
call esi
push 0x5c
push 0x82473a0
call dword [sym.imp.msvcrt.dll_strrchr]
add esp, 8
mov dword [0x8247368], eax
cmp eax, ebx
jne 0x82293b9
mov dword [0x8247368], 0x82473a0
jmp 0x82293bf
inc eax
mov dword [0x8247368], eax
push 0x105
push 0x8247140
push 0x2334
mov eax, dword [0x8246c74]
push eax
call esi
push 0x105
push 0x8247260
push 0x233b
mov ecx, dword [0x8246c74]
push ecx
call esi
mov edx, dword [0x8246c70]
push edx
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
jmp 0x822946a
mov dword [ebp - 4], 1
call fcn.0822a5f0
call fcn.0823afc0
mov eax, dword [0x8246cbc]
push eax
call fcn.0822fff0
add esp, 4
mov eax, dword [0x8246c78]
cmp eax, ebx
je 0x8229440
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.082303f0
push 0x8247ac0
mov esi, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call esi
push 0x8247380
call esi
mov dword [0x8246cbc], ebx
jmp 0x822946a
mov dword [ebp - 4], 0xfffffffe
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.08241664
mov esp, ebp
pop ebp
ret 0xc
Function at 0x8229870
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x8246b14]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x10]
mov edx, dword [esi + 8]
push ebx
push edi
mov edi, dword [esi + 0xc]
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0x120]
push eax
mov eax, dword [esi]
push edi
lea ecx, [ebp - 0x118]
push ecx
push 0
push edx
push eax
mov dword [ebp - 0x118], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
test ebx, ebx
jne 0x8229940
cmp dword [ebp - 0x120], 1
jbe 0x8229935
mov eax, dword [ebp - 0x118]
sub eax, 1
je 0x822992a
sub eax, 1
je 0x82298ec
mov dword [esi + 0x14], ebx
mov byte [edi], bl
mov ebx, 0xd
jmp 0x8229935
push 0x10d
lea ecx, [ebp - 0x114]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x822990a
cmp eax, 0x10e
jb 0x8229911
mov byte [ebp - 0x114], 0
mov eax, dword [ebp - 0x11c]
push 0xffffffffffffffff
lea edx, [ebp - 0x114]
push edx
push eax
push edi
call sub.msvcrt.dll_strncpy_s
add esp, 0x10
xor ecx, ecx
cmp byte [edi], 0x3a
setne cl
mov dword [esi + 0x14], ecx
mov edx, dword [ebp - 0x11c]
mov byte [edx + edi - 1], 0
mov ecx, dword [ebp - 4]
xor eax, eax
test ebx, ebx
sete al
pop edi
xor ecx, ebp
pop ebx
call fcn.08241664
mov esp, ebp
pop ebp
ret

Function at 0x8229960
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x8246b14]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 3
jl 0x8229a23
mov al, byte [esi]
cmp al, 0x2e
je 0x8229a07
cmp al, 0x5c
je 0x82299dc
cmp al, 0x2f
je 0x82299dc
cmp byte [esi + 1], 0x3a
je 0x82299dc
lea edx, [ebp - 0x118]
push edx
lea eax, [ebp - 0x114]
push eax
push 0x10e
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathA]
test eax, eax
je 0x8229a23
cmp eax, 0x10e
jae 0x8229a23
mov edx, dword [ebp + 8]
push 0xffffffffffffffff
lea ecx, [ebp - 0x114]
push ecx
push edx
push esi
mov byte [ebp - 7], 0
call sub.msvcrt.dll_strncpy_s
add esp, 0x10
push ebx
mov bl, byte [esi + 3]
push esi
mov byte [esi + 3], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
xor ecx, ecx
cmp eax, 3
sete cl
mov byte [esi + 3], bl
pop ebx
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.08241664
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x114]
push ecx
push 0x10e
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
jmp 0x82299b7
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.08241664
mov esp, ebp
pop ebp
ret
Function at 0x822bfd0
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x8246b14]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x108]
push eax
push 0x104
mov esi, ecx
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x822c066
cmp eax, 0x104
ja 0x822c066
lea ecx, [ebp - 0x108]
push esi
push ecx
call dword [sym.imp.msvcrt.dll__tempnam]
mov esi, eax
add esp, 8
test esi, esi
je 0x822c066
push edi
push 0x1b6
push 0x8342
push esi
call dword [sym.imp.msvcrt.dll__open]
push esi
mov edi, eax
call dword [sym.imp.msvcrt.dll_free]
add esp, 0x10
cmp edi, 0xffffffff
je 0x822c053
push 0x8222030
push edi
call dword [sym.imp.msvcrt.dll__fdopen]
add esp, 8
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.08241664
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.08241664
mov esp, ebp
pop ebp
ret

Function at 0x822c110
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x2a8]
test ecx, ecx
je 0x822c179
mov eax, dword [ebp + 0xc]
dec eax
imul eax, dword [esi + 0x2b0]
push 0
push eax
push ecx
call dword [sym.imp.msvcrt.dll_fseek]
add esp, 0xc
test eax, eax
je 0x822c15d
push 0
push 0
push 0x27
push 0
push 0
push 0
add esi, 8
push esi
call fcn.0822a430
add esp, 0x1c
or eax, 0xffffffff
pop esi
pop ebp
ret
mov ecx, dword [esi + 0x2a8]
push ecx
push 1
lea edx, [ebp + 0x10]
push 2
push edx
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x10
test eax, eax
je 0x822c13f
xor eax, eax
pop esi
pop ebp
ret
Function at 0x822c3d0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, eax
lea eax, [ebx - 1]
imul eax, dword [edi + 0x2b0]
push 0
push eax
mov eax, dword [edi + 0x2a8]
push eax
call dword [sym.imp.msvcrt.dll_fseek]
add esp, 0xc
test eax, eax
je 0x822c421
push 0
push 0
push 0x27
push 0
push 0
push 0
add edi, 8
push edi
call fcn.0822a430
add esp, 0x1c
pop edi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x168], 1
jne 0x822c436
movzx ecx, word [edi + 0x144]
mov dword [ebp - 0xc], ecx
jmp 0x822c44e
mov eax, dword [edi + 0x138]
test eax, eax
je 0x822c446
movzx eax, word [eax + 6]
jmp 0x822c448
xor eax, eax
movzx edx, ax
mov dword [ebp - 0xc], edx
push esi
xor esi, esi
mov dword [ebp - 8], esi
cmp dword [ebp + 0xc], esi
jbe 0x822c567
mov ebx, dword [sym.imp.msvcrt.dll_fread]
mov ecx, dword [edi + 0x2a8]
mov edx, dword [edi + 0x148]
push ecx
lea eax, [esi + esi]
push 1
add edx, eax
push 2
push edx
call ebx
add esp, 0x10
push 0
test eax, eax
je 0x822c599
push edi
mov dword [ebp - 0x10], 0
call fcn.082252c0
xor ecx, ecx
add esp, 8
cmp cx, word [ebp - 0xc]
jge 0x822c557
lea esi, [eax + 0x68]
jmp 0x822c4b0
cmp dword [edi + 0x168], 3
jne 0x822c50b
mov edx, dword [edi + 0x2a8]
mov eax, dword [ebp - 8]
mov ecx, dword [esi - 4]
push edx
push 1
add eax, eax
add ecx, eax
push 2
push ecx
call ebx
add esp, 0x10
test eax, eax
je 0x822c597
mov edx, dword [edi + 0x2a8]
push edx
push 1
lea eax, [ebp - 4]
push 2
push eax
call ebx
add esp, 0x10
test eax, eax
je 0x822c597
mov eax, dword [esi]
test eax, eax
je 0x822c50b
mov ecx, dword [ebp - 8]
mov dx, word [ebp - 4]
add ecx, ecx
mov word [eax + ecx], dx
movzx eax, word [esi - 0x1c]
cmp ax, 8
je 0x822c590
cmp ax, 0x18
je 0x822c590
mov eax, dword [esi - 0x18]
test eax, eax
je 0x822c540
mov edx, dword [esi - 0x14]
imul edx, dword [ebp - 8]
mov ecx, dword [edi + 0x2a8]
add edx, dword [esi - 8]
push ecx
push 1
push eax
push edx
call ebx
add esp, 0x10
test eax, eax
je 0x822c597
mov eax, dword [ebp - 0x10]
inc eax
sub esi, 0xffffff80
cmp ax, word [ebp - 0xc]
mov dword [ebp - 0x10], eax
jl 0x822c4b0
mov esi, dword [ebp - 8]
inc esi
mov dword [ebp - 8], esi
cmp esi, dword [ebp + 0xc]
jb 0x822c463
mov ebx, dword [ebp + 8]
lea eax, [esi + ebx - 1]
mov dword [edi + 0x15c], esi
pop esi
mov dword [edi + 0x160], ebx
mov dword [edi + 0x164], eax
mov dword [edi + 0x154], 0
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 8
jmp 0x822c522
push 0
push 0
push 0x27
push 0
push 0
push 0
add edi, 8
push edi
call fcn.0822a430
add esp, 0x1c
pop esi
pop edi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x822cb30
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [edi + 0x138]
mov dword [ebp - 4], 0
test ecx, ecx
je 0x822cb54
movzx eax, word [ecx + 6]
jmp 0x822cb56
xor eax, eax
movzx esi, word [edi + 0x144]
sub eax, esi
movzx edx, ax
test ecx, ecx
jne 0x822cb6a
xor esi, esi
jmp 0x822cb73
movsx esi, si
shl esi, 7
add esi, dword [ecx + 8]
push ebx
test dx, dx
je 0x822ccb5
lea ecx, [ecx]
movzx eax, word [esi + 8]
dec edx
mov dword [ebp - 0x10], edx
cmp ax, 8
je 0x822cb98
cmp ax, 0x18
jne 0x822cca9
cmp dword [esi + 0x7c], 0
jne 0x822cbb3
mov ecx, 0x8222044
call fcn.08251d18
mov dword [esi + 0x7c], eax
test eax, eax
je 0x822ccd7
cmp dword [ebp - 4], 0
jne 0x822cbd9
mov eax, dword [0x8246cbc]
push 0x10000
push 0
push eax
call fcn.08230040
add esp, 0xc
mov dword [ebp - 4], eax
test eax, eax
je 0x822ccf4
mov ecx, dword [esi + 0x7c]
push 2
push 0
push ecx
call dword [sym.imp.msvcrt.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x822ccd7
mov edx, dword [esi + 0x7c]
push edx
call dword [sym.imp.msvcrt.dll_ftell]
add esp, 4
mov dword [ebp - 0x18], eax
mov ebx, 0x7fffffff
xor edi, edi
lea esp, [esp]
cmp ebx, 0xffff
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1c]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov ecx, 0xffff
jg 0x822cc2b
mov ecx, ebx
push edi
lea edx, [ebp - 8]
push edx
movsx edx, word [esi + 0x44]
push edx
movzx edx, word [esi]
push ecx
mov ecx, dword [ebp - 4]
push ecx
push edx
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.08230ee0
add esp, 0x20
test ax, ax
mov eax, dword [ebp + 8]
jne 0x822ccfc
mov edx, dword [eax + 0x1c]
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [edx + 4]
jne 0x822cd14
mov eax, dword [ebp - 8]
test eax, eax
jle 0x822cc98
mov edx, dword [esi + 0x7c]
push edx
push 1
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x10
test eax, eax
je 0x822cd31
mov eax, dword [ebp - 8]
add edi, eax
sub ebx, eax
jne 0x822cc10
mov eax, dword [esi + 0x60]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
mov dword [eax], ecx
mov dword [eax + 4], edi
mov edi, dword [ebp + 8]
sub esi, 0xffffff80
test dx, dx
jne 0x822cb80
xor esi, esi
mov eax, dword [ebp - 4]
pop ebx
test eax, eax
je 0x822ccce
push eax
mov eax, dword [0x8246cbc]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
mov ax, si
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x27
push 0
push 0
push 0
add edi, 8
push edi
call fcn.0822a430
add esp, 0x1c
or esi, 0xffffffff
jmp 0x822ccb7
push 0
push 0
push 0x28
jmp 0x822ccdd
mov edx, dword [eax]
mov ecx, dword [eax + 0x1c]
push edx
push ecx
add eax, 8
push eax
call fcn.0822a640
add esp, 0xc
or esi, 0xffffffff
jmp 0x822ccb7
push 0
push 0
push 0x55
push 0
push 0
add eax, 8
push 0
push eax
call fcn.0822a430
add esp, 0x1c
or esi, 0xffffffff
jmp 0x822ccb7
mov edx, dword [ebp + 8]
push 0
push 0
push 0x27
push 0
push 0
add edx, 8
push 0
push edx
call fcn.0822a430
add esp, 0x1c
or esi, 0xffffffff
jmp 0x822ccb7
Function at 0x822d820
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x2a8], 0
lea esi, [edi + 0x2a8]
lea ebx, [edi + 0x168]
mov dword [ebp + 8], 4
jne 0x822d85d
push ebx
push edi
call fcn.0822c2d0
movzx eax, ax
add esp, 8
test ax, ax
jne 0x822d8e0
mov eax, dword [esi]
push 2
push 0
push eax
call dword [sym.imp.msvcrt.dll_fseek]
add esp, 0xc
test eax, eax
je 0x822d891
push 0
push 0
push 0x27
push 0
push 0
push 0
add edi, 8
push edi
call fcn.0822a430
add esp, 0x1c
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret
mov ecx, dword [esi]
push ecx
push 1
lea edx, [ebp + 8]
push 2
push edx
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x10
test eax, eax
je 0x822d871
mov eax, dword [edi + 0x138]
test eax, eax
je 0x822d8b6
mov eax, dword [eax + 8]
mov ecx, dword [esi]
mov edx, dword [eax + 0x50]
mov eax, dword [ebp + 0xc]
push ecx
push 1
push edx
push eax
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x10
test eax, eax
je 0x822d871
mov eax, 1
add dword [ebx + 0x130], eax
add dword [esi + 4], eax
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x8230960
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x4e4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x8230983
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x8230997
push 0
push 0
push 0
push 0
call edi
mov dword [esi + 0x4e4], eax
test eax, eax
je 0x82309ed
mov eax, dword [esi + 0x4e8]
test eax, eax
je 0x82309aa
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x82309be
push 0
push 0
push 0
push 0
call edi
mov dword [esi + 0x4e8], eax
test eax, eax
je 0x82309ed
cmp dword [esi + 0x4ec], 0
jne 0x8230a37
lea eax, [esi + 0x4f0]
push eax
push 0
push esi
push 0x8230880
push 0
push 0
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0x4ec], eax
test eax, eax
jne 0x8230a28
mov eax, dword [esi + 0x4e4]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x8230a0a
push eax
call edi
mov dword [esi + 0x4e4], 0
mov eax, dword [esi + 0x4e8]
test eax, eax
je 0x8230a21
push eax
call edi
mov dword [esi + 0x4e8], 0
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret
mov ecx, dword [esi + 0x4e8]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop edi
xor eax, eax
pop esi
pop ebp
ret
Function at 0x8241ba0
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x318
mov eax, dword [0x8246b14]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x8241bd9
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.08241664
mov esp, ebp
pop ebp
ret
mov ecx, dword [str._C__b]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0x8224338
lea eax, [ebp - 0x318]
push 0x20a
push eax
call fcn.08224770
add esp, 0x14
lea ecx, [ebp - 0x318]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.08241664
mov esp, ebp
pop ebp
ret

Function at 0x824c252
Capabilities:
Encode data using xor

Disassembly:
call 0x824c1cb
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x824c1fb
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x824c217
xor edx, 0
jmp 0x824c222
xor edx, edx
jmp 0x824c239
jmp 0x824c245
xor eax, eax
push 0x8427d7c0
call 0x824c252
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x824c28e
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x824c267
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x824c2a5
add eax, 0
jno 0x824c2aa
add esi, 0
ret 0x10
Function at 0x824d013
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 0x63]
mov dword [esp + 0x5f], ebx
lea esp, [esp + 0x5f]
mov ebx, 0x8dff8662
xchg dword [esp], ebx
and dword [esp], ebp
jmp 0x824d035
add ebx, 0
or dword [esp], ebp
mov ebp, esp
push eax
push edi
lea esp, [esp - 4]
xchg dword [esp], ecx
pop ecx
lea esp, [esp - 4]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x14]
ja 0x824d1d7
cmp edi, dword [ebp + 0x10]
jb 0x824d1d7
lea esi, [esi]
sub esi, 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
sub esp, 0x6a
mov dword [esp + 0x66], 0xc2ccbc3c
add esp, 0x66
mov dword [esp], edi
or edi, 0xffffffff
and edi, 0xcedcf875
xor edi, 0xce9c140e
xchg dword [esp], edi
push edx
mov edx, esp
xor edx, 0
add edx, 0
push ebx
lea ebx, [edx + 4]
mov dword [ebx], eax
pop ebx
pop edx
push edi
call fcn.0824caff
inc edi
jmp 0x824d0be
jmp 0x824d0cb
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.0824caff
inc edi
and dword [esp - 0x4e], ecx
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.0824caff
inc edi
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push 0
sub esi, 0
add dword [esp], edx
xor edx, edx
je 0x824d11f
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or edx, 0x13e27bd2
push ebx
add ebx, esi
mov ebx, esp
xor dword [ebx - 0x2a], edi
fdiv qword [ecx]
jnp 0x824d103
pop ebx
xor edx, 0x1b7d0cc
add edx, 0xedeb415d
xchg dword [esp], edx
push edx
mov edx, esp
call int.0824d14d
add dword [eax], 0x39
jle 0x824d129
sub al, 0xf5
mov ch, al
call fcn.0824d162
mov dword [edi], eax
pop ecx
pop edi
pop eax
leave
ret 0x10

Function at 0x824ee3a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ecx
push edx
push 0
sub esi, esi
shr esi, 9
and dword [esp - 0x69], ebx
jbe 0x824ee50
add edi, 0
shr esi, 0x17
or esi, dword [esp]
add esp, 4
add esi, dword [ebp + 8]
xor eax, eax
xor edx, edx
cld
and dword [esp - 0x46], edx
xor ecx, ecx
rol edx, 7
and dword [esp - 0x4b], edx
xor dl, al
mov al, byte [esi]
inc esi
or al, al
jne 0x824ee61
mov eax, edx
pop edx
pop ecx
pop esi
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
push 0x54
call fcn.0824eea2
std
inc ebx
sar cl, 0x3e
lahf
in al, dx
mov ch, 0x4a
mov ebx, 0x971631d8
test byte [ebp - 0x5e], ch
xor eax, dword [ebx + 0x2b5108c4]
add esp, 8
push ecx
sub ecx, eax
mov ecx, esp
cmp dword [ecx - 0x51], edx