joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5766bc
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
mov dword [ebp - 4], ebx
je 0x5767d1
mov esi, dword [ebp + 0xc]
cmp esi, ebx
je 0x5767d1
push ebx
push 0x8000080
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0x576709
mov eax, 0x80004005
jmp 0x5767d6
mov eax, dword [esi]
push esi
call dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi]
push esi
call dword [eax + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
push esi
call dword [eax + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
push esi
call dword [eax + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [esi]
push esi
call dword [eax + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
push esi
call dword [eax + 0x18]
mov dword [ebp - 8], eax
push edi
and dword [ebp + 0xc], 0
push 0x18
pop edi
sub edi, ebx
mov eax, 0x400000
cmp edi, eax
jbe 0x576754
mov edi, eax
push 0
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp + ebx - 0x1c]
push eax
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
je 0x5767ca
cmp dword [ebp + 0xc], edi
jne 0x5767ca
add ebx, edi
cmp ebx, 0x18
jne 0x576740
mov eax, dword [esi]
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 0x1c]
push 0
push esi
call dword [eax + 0x28]
mov edi, eax
test edi, edi
jl 0x5767b0
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x1c]
shl eax, 2
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.00590d29
mov edi, eax
test edi, edi
jl 0x5767b0
xor edi, edi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0x5767c5
mov eax, dword [esi]
push esi
call dword [eax + 0x2c]
mov eax, edi
pop edi
jmp 0x5767d6
mov edi, 0x80004005
jmp 0x5767b0
mov eax, 0x8876086c
pop esi
pop ebx
leave
ret 8
Function at 0x5767e1
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
mov dword [ebp - 4], ebx
je 0x5768f6
mov esi, dword [ebp + 0xc]
cmp esi, ebx
je 0x5768f6
push ebx
push 0x8000080
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0x57682e
mov eax, 0x80004005
jmp 0x5768fb
mov eax, dword [esi]
push esi
call dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi]
push esi
call dword [eax + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
push esi
call dword [eax + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
push esi
call dword [eax + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [esi]
push esi
call dword [eax + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
push esi
call dword [eax + 0x18]
mov dword [ebp - 8], eax
push edi
and dword [ebp + 0xc], 0
push 0x18
pop edi
sub edi, ebx
mov eax, 0x400000
cmp edi, eax
jbe 0x576879
mov edi, eax
push 0
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp + ebx - 0x1c]
push eax
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
je 0x5768ef
cmp dword [ebp + 0xc], edi
jne 0x5768ef
add ebx, edi
cmp ebx, 0x18
jne 0x576865
mov eax, dword [esi]
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 0x1c]
push 0
push esi
call dword [eax + 0x28]
mov edi, eax
test edi, edi
jl 0x5768d5
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x1c]
shl eax, 2
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.00590d29
mov edi, eax
test edi, edi
jl 0x5768d5
xor edi, edi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0x5768ea
mov eax, dword [esi]
push esi
call dword [eax + 0x2c]
mov eax, edi
pop edi
jmp 0x5768fb
mov edi, 0x80004005
jmp 0x5768d5
mov eax, 0x8876086c
pop esi
pop ebx
leave
ret 8
Function at 0x577357
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push edi
xor edi, edi
cmp dword [ebp + 8], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edi
je 0x5774d9
cmp dword [ebp + 0xc], edi
je 0x5774d9
push edi
push 0x8000080
push 3
push edi
push edi
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x5773a4
mov eax, 0x80004005
jmp 0x5774de
push ebx
push esi
mov ebx, 0x400000
and dword [ebp + 8], 0
push 0x18
pop esi
sub esi, edi
cmp esi, ebx
jbe 0x5773ba
mov esi, ebx
push 0
lea eax, [ebp + 8]
push eax
push esi
lea eax, [ebp + edi - 0x24]
push eax
push dword [ebp - 8]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x57742e
cmp dword [ebp + 8], 0
je 0x57742e
cmp dword [ebp + 8], esi
jne 0x57742e
add edi, esi
cmp edi, 0x18
jne 0x5773ab
xor ebx, ebx
cmp dword [ebp - 0x24], ebx
je 0x5774b6
cmp dword [ebp - 0x20], ebx
je 0x5774b6
cmp dword [ebp - 0x1c], ebx
je 0x5774b6
cmp dword [ebp - 0x10], ebx
je 0x577417
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x24]
jne 0x5774b6
push 0x2c
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
je 0x577438
mov ecx, eax
call fcn.00577247
mov esi, eax
jmp 0x57743a
mov edi, 0x80004005
jmp 0x5774bb
xor esi, esi
cmp esi, ebx
mov dword [ebp - 0xc], esi
jne 0x577448
mov edi, 0x8007000e
jmp 0x5774bb
cmp dword [ebp - 0x10], ebx
push dword [ebp - 0x1c]
mov ecx, esi
push dword [ebp - 0x20]
je 0x577462
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.00590d29
jmp 0x57746a
push dword [ebp - 0x24]
call fcn.00590d29
mov edi, eax
cmp edi, ebx
mov eax, dword [esi]
jge 0x57747b
push 1
mov ecx, esi
call dword [eax + 0x4c]
jmp 0x5774bb
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 0x24]
push ebx
push esi
call dword [eax + 0x28]
mov edi, eax
cmp edi, ebx
jl 0x5774bb
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x24]
shl eax, 2
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00590d29
mov edi, eax
test edi, edi
jl 0x5774bb
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
xor edi, edi
jmp 0x5774bb
mov edi, 0x8876086c
cmp dword [ebp - 4], 0
pop esi
pop ebx
je 0x5774cc
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
push dword [ebp - 8]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
jmp 0x5774de
mov eax, 0x8876086c
pop edi
leave
ret 8
Function at 0x5774e8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push edi
xor edi, edi
cmp dword [ebp + 8], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edi
je 0x57766a
cmp dword [ebp + 0xc], edi
je 0x57766a
push edi
push 0x8000080
push 3
push edi
push edi
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x577535
mov eax, 0x80004005
jmp 0x57766f
push ebx
push esi
mov ebx, 0x400000
and dword [ebp + 8], 0
push 0x18
pop esi
sub esi, edi
cmp esi, ebx
jbe 0x57754b
mov esi, ebx
push 0
lea eax, [ebp + 8]
push eax
push esi
lea eax, [ebp + edi - 0x24]
push eax
push dword [ebp - 8]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x5775bf
cmp dword [ebp + 8], 0
je 0x5775bf
cmp dword [ebp + 8], esi
jne 0x5775bf
add edi, esi
cmp edi, 0x18
jne 0x57753c
xor ebx, ebx
cmp dword [ebp - 0x24], ebx
je 0x577647
cmp dword [ebp - 0x20], ebx
je 0x577647
cmp dword [ebp - 0x1c], ebx
je 0x577647
cmp dword [ebp - 0x10], ebx
je 0x5775a8
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x24]
jne 0x577647
push 0x2c
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
je 0x5775c9
mov ecx, eax
call fcn.00577247
mov esi, eax
jmp 0x5775cb
mov edi, 0x80004005
jmp 0x57764c
xor esi, esi
cmp esi, ebx
mov dword [ebp - 0xc], esi
jne 0x5775d9
mov edi, 0x8007000e
jmp 0x57764c
cmp dword [ebp - 0x10], ebx
push dword [ebp - 0x1c]
mov ecx, esi
push dword [ebp - 0x20]
je 0x5775f3
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.00590d29
jmp 0x5775fb
push dword [ebp - 0x24]
call fcn.00590d29
mov edi, eax
cmp edi, ebx
mov eax, dword [esi]
jge 0x57760c
push 1
mov ecx, esi
call dword [eax + 0x4c]
jmp 0x57764c
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 0x24]
push ebx
push esi
call dword [eax + 0x28]
mov edi, eax
cmp edi, ebx
jl 0x57764c
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x24]
shl eax, 2
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00590d29
mov edi, eax
test edi, edi
jl 0x57764c
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
xor edi, edi
jmp 0x57764c
mov edi, 0x8876086c
cmp dword [ebp - 4], 0
pop esi
pop ebx
je 0x57765d
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
push dword [ebp - 8]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
jmp 0x57766f
mov eax, 0x8876086c
pop edi
leave
ret 8
Function at 0x57a068
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x60109d
call fcn.00600168
push ecx
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
lea ecx, [esi + 0x10]
mov dword [ebp - 0x10], esi
mov dword [esi], 0x421f30
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
call fcn.00579ebb
fld1
xor ebx, ebx
fstp dword [esi + 0x20]
inc ebx
lea ecx, [esi + 0x74]
mov dword [ebp - 4], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], 0x3ba3d70a
mov dword [esi + 0x6c], edi
call fcn.0058659f
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x4c], ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x58659f
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x601395
call fcn.00600168
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi], ebx
lea ecx, [esi + 0x10]
mov dword [ebp - 4], ebx
call fcn.00591e97
lea ecx, [esi + 0x20]
mov byte [ebp - 4], 1
call fcn.00591e97
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.00591e97
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 3
call fcn.0058498f
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 4
call fcn.005849f8
lea ecx, [esi + 0x60]
mov byte [ebp - 4], 5
call fcn.005849f8
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 6
call fcn.0058654e
or dword [esi + 0x90], 0xffffffff
or dword [esi + 0x94], 0xffffffff
or dword [esi + 0x98], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xa0], ebx
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xa8], ebx
mov byte [esi + 0xac], bl
mov byte [esi + 0xad], bl
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x590d29
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x590d38
pop dword [ebp - 0x30]
mov eax, 0x8d75dd58
sub eax, 0x8d1cd020
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x720c2
push 0
mov eax, 0x6e2cdcf8
sub eax, 0x6deccb5c
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x531c3b76
sub ecx, 0x531bfb86
xor esi, esi
add esi, eax
mov edi, 0x94a65c7c
sub edi, 0x9441c27c
add edi, dword [ebp - 0x30]
mov ebx, 0x7206f171
add ebx, 0x23735b3a
mov dword [ebp - 0x28], 0x366f512b
mov edx, dword [edi]
xor dword [ebp - 0x24], 0xa4c3d006
sub edx, ebx
xor dword [ebp - 8], ebx
mov dword [esi], edx
xor dword [ebp - 0x20], ebx
add esi, 0x51d5d2b
sub esi, 0x51d5d27
add edi, 4
loop 0x590d99
add eax, 0xf293
mov ebx, eax
add eax, 0xeea72f78
sub eax, 0xeea72f73
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x5a4717
Capabilities:
Delete file

Disassembly:
mov edi, edi
push esi
push edi
mov edi, dword [sym.imp.kernel32.dll_CloseHandle]
mov esi, ecx
push dword [esi + 0x30]
mov dword [esi], 0x4238d8
call edi
push dword [esi + 0x34]
call edi
mov eax, dword [esi + 0x38]
cmp eax, 0xffffffff
je 0x5a473e
push eax
call edi
mov al, byte [esi + 0x48]
test al, 0x40
je 0x5a4754
test al, al
js 0x5a4761
push dword [esi + 0xc]
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x5a4761
test al, al
js 0x5a4761
push dword [esi + 0xc]
call dword [sym.imp.kernel32.dll_DeleteFileA]
push dword [esi + 0xc]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov eax, dword [esi + 8]
pop ecx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [esi + 0x20]
call fcn.005a2c49
pop edi
lea ecx, [esi + 0x10]
pop esi
jmp fcn.005a2252

Function at 0x5a4d0c
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, ecx
push edi
mov dword [esi], 0x42383c
call fcn.00590d29
lea ebx, [esi + 0x30]
mov ecx, ebx
call fcn.00590d29
push dword [esi + 0x3c]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov edi, dword [esi + 0x48]
test edi, edi
je 0x5a4d48
push dword [edi + 0xc]
call sub.msvcrt.dll_free
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ecx
mov edi, dword [esi + 0x4c]
test edi, edi
je 0x5a4d5f
push dword [edi + 0xc]
call sub.msvcrt.dll_free
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ecx
mov eax, dword [esi + 0x50]
xor edi, edi
cmp eax, edi
je 0x5a4da9
cmp dword [eax], edi
jbe 0x5a4d92
mov eax, dword [esi + 0x50]
mov eax, dword [eax + 0xc]
push dword [eax + edi*4]
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov eax, dword [esi + 0x50]
mov eax, dword [eax + 0xc]
push dword [eax + edi*4]
call sub.msvcrt.dll_free
mov eax, dword [esi + 0x50]
inc edi
cmp edi, dword [eax]
pop ecx
jb 0x5a4d6c
mov edi, dword [esi + 0x50]
test edi, edi
je 0x5a4da9
push dword [edi + 0xc]
call sub.msvcrt.dll_free
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ecx
mov edi, dword [esi + 0x54]
test edi, edi
je 0x5a4dc0
push dword [edi + 0xc]
call sub.msvcrt.dll_free
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ecx
cmp byte [esi + 0x5c], 0
je 0x5a4dd6
cmp dword [esi + 0x44], 1
jne 0x5a4de4
push dword [esi + 0x2c]
call fcn.00590d29
jmp 0x5a4de4
cmp dword [esi + 0x44], 1
jne 0x5a4de4
push dword [esi + 0x2c]
call fcn.00590d29
push dword [esi + 0x2c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov eax, dword [esi + 8]
pop ecx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, ebx
call fcn.005a58f3
lea ecx, [esi + 0x1c]
call fcn.005a2c09
pop edi
lea ecx, [esi + 0xc]
pop esi
pop ebx
jmp fcn.005a2252
Function at 0x5ae180
Capabilities:
Check for software breakpoints

Disassembly:
cmp dword [esi + 0x14], 0xcc
je 0x5ae1a3
mov eax, dword [esi + 0x1a8]
push esi
call dword [eax]
mov dword [esi + 0x8c], 0
mov dword [esi + 0x14], 0xcc
mov ecx, dword [esi + 0x1a8]
mov eax, dword [ecx + 8]
test eax, eax
je 0x5ae1c9
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x30
call dword [eax]
mov edx, dword [esi + 0x1a8]
mov eax, dword [edx + 8]
test eax, eax
jne 0x5ae1b0
mov edx, dword [esi + 0x44]
xor eax, eax
test edx, edx
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov eax, 1
ret

Function at 0x6006b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x620894]
jne 0x6006c1
test ecx, 0xffff0000
jne 0x6006c1
ret
jmp fcn.006006cb
Function at 0x40153c
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x417ca8
call fcn.00401da0
push 1
call fcn.00401884
pop ecx
test al, al
jne 0x40155b
push 7
call fcn.00401b87
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0040184f
mov byte [ebp - 0x24], al
mov eax, dword [0x419b44]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x401554
test eax, eax
jne 0x4015c5
mov dword [0x419b44], ecx
push 0x412148
push 0x412130
call fcn.00404ed9
pop ecx
pop ecx
test eax, eax
je 0x4015a8
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x4016a5
push 0x41212c
push 0x412124
call fcn.00404e7d
pop ecx
pop ecx
mov dword [0x419b44], 2
jmp 0x4015ca
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.004019de
pop ecx
call fcn.00401b7b
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x4015fa
push esi
call fcn.00401954
pop ecx
test al, al
je 0x4015fa
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.00401d91
call esi
call fcn.00401b81
mov esi, eax
cmp dword [esi], edi
je 0x401618
push esi
call fcn.00401954
pop ecx
test al, al
je 0x401618
push dword [esi]
call fcn.00405138
pop ecx
call fcn.004051e2
mov edi, eax
call fcn.004051dc
mov esi, eax
call fcn.00404e64
push eax
push dword [edi]
push dword [esi]
call main
add esp, 0xc
mov esi, eax
call fcn.00401ca2
test al, al
jne 0x401649
push esi
call fcn.00405170
test bl, bl
jne 0x401652
call fcn.00405113
push 0
push 1
call fcn.004019fb
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x4016a5
call fcn.00401de6
ret
call fcn.004ab000
jmp 0x40153c

Function at 0x4098b8
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00409566
Function at 0x401ca0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x401caf
pop dword [ebp - 0x50]
mov eax, 0x920d3b9f
add eax, 0x6e32e110
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x1c22579
add dword [ebp - 0x60], 0x4c901fd2
mov dword [ebp - 0x5c], 0xac9e8e7a
sub dword [ebp - 0x5c], 0x7a6b4235
mov dword [ebp - 0x58], 0x7da6c451
sub dword [ebp - 0x58], 0x315a8023
mov dword [ebp - 0x54], 0xaf82a3d8
sub dword [ebp - 0x54], 0xaf82a3d8
lea eax, [ebp - 0x60]
push eax
mov eax, 0x522d542e
add eax, 0xae1c3c26
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xdeadd81a
sub dword [ebp - 0x60], 0x6a3b6ec4
mov dword [ebp - 0x5c], 0xd38ebde0
add dword [ebp - 0x5c], 0x6ddda395
mov dword [ebp - 0x58], 0x2338197f
sub dword [ebp - 0x58], 0xbfc8ad13
mov dword [ebp - 0x54], 0x28aeafa3
add dword [ebp - 0x54], 0xd751505d
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x2dfdf93
add eax, 0xfd69b091
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x6b4e9
push 0
call eax
mov ecx, 0x5a2a3590
add ecx, 0xa5d60828
mov esi, eax
mov edx, 0x6b7e65ac
add edx, 0x94cdf854
add edx, dword [ebp - 0x50]
mov edi, 0x6be3b4d7
add edi, 0xc61d70fe
mov ebx, dword [edx]
xor dword [ebp - 0x18], ebx
xor ebx, edi
mov dword [ebp - 0x2c], 0x1f764417
mov dword [esi], ebx
xor dword [ebp - 4], 0x69ad2dcc
add esi, 4
add edx, 0x622a277b
add edx, 0x9dd5d889
loop 0x401dd1
add eax, 0xb19ffaef
sub eax, 0xb19f113c
xor ebx, ebx
add ebx, eax
add eax, 0xcea73efa
sub eax, 0xcea73ef5
mov ecx, 0xe629c123
add ecx, 0x1a163edd
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x406451
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x238
mov eax, 0x40e9c3
call fcn.0040d3d4
mov dword [ebp - 0x21c], ecx
movzx eax, word [ebp + 8]
xor edi, edi
mov esi, dword [0x4166f0]
inc edi
push 0xf0
push eax
push esi
call dword [sym.imp.kernel32.dll_FindResourceW]
test eax, eax
je 0x4065c3
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
je 0x4065c3
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4065c3
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x4065c3
mov ecx, dword [esi + 4]
mov ebx, eax
movzx eax, word [esi + 2]
add esi, 8
mov dword [ebp - 0x220], ecx
mov ecx, 0x403
cmp cx, ax
jne 0x40653b
push 3
lea eax, [ebp - 0x110]
push esi
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], eax
call main
push dword [ebp - 0x114]
mov eax, dword [ebp - 0x21c]
and dword [ebp - 4], 0
push 0
push 0x143
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
lea eax, [ebp - 0x110]
cmove edi, ecx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x114], eax
je 0x4065b1
push dword [ebp - 0x114]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x4065b1
mov ecx, 0x1234
cmp cx, ax
jne 0x4065b1
or dword [ebp - 0x240], 0xffffffff
lea eax, [ebp - 0x214]
push 3
push esi
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x244], 1
mov dword [ebp - 0x218], eax
call main
mov eax, dword [ebp - 0x218]
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x23c], eax
cmp eax, ecx
je 0x40658e
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
lea eax, [ebp - 0x244]
push eax
mov eax, dword [ebp - 0x21c]
push 0
push 0x40b
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
cmp eax, 0xffffffff
je 0x4065c1
add esi, dword [ebp - 0x220]
test edi, edi
jne 0x4064a9
jmp 0x4065c3
xor edi, edi
mov eax, edi
call fcn.0040d38f
ret 4

Function at 0x40d82c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x40d83b
pop dword [ebp - 0x3c]
mov eax, 0x20960083
add eax, 0xdfaad7b8
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x37b94
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0x4574
xor edx, edx
add edx, eax
mov ebx, 0xd6cd5f3f
sub ebx, 0xd68bb53f
add ebx, dword [ebp - 0x3c]
mov esi, 0x1d834932
add esi, 0xd3a942a8
sub dword [ebp - 0x30], 0x6208428c
mov edi, dword [ebx]
xor dword [ebp - 0xc], 0x325b3a21
xor edi, esi
sub dword [ebp - 0x18], 0xa8284294
mov dword [edx], edi
add dword [ebp - 0x1c], 0x8e514efb
add edx, 4
add ebx, 0x9490080c
add ebx, 0x6b6ff7f8
loop 0x40d891
add eax, 0x3beec1a8
add eax, 0xc41246fb
xor ebx, ebx
add ebx, eax
add eax, 0x31a8a2ca
add eax, 0xce575d3b
mov ecx, 0x89458180
add ecx, 0x76fa7e80
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x401b4b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x401b5a
pop dword [ebp - 0x3c]
mov eax, 0x401b5a
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xda0a4cf2
sub dword [ebp - 0x4c], 0x8bb807a7
mov dword [ebp - 0x48], 0x8e84c753
sub dword [ebp - 0x48], 0x5c517b0e
mov dword [ebp - 0x44], 0x8f6a83b6
add dword [ebp - 0x44], 0xbce1c078
mov dword [ebp - 0x40], 0x9f3d83cf
add dword [ebp - 0x40], 0x60c27c31
lea eax, [ebp - 0x4c]
push eax
mov eax, 0xc6a86fb5
add eax, 0x3998609f
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xd06216b
add dword [ebp - 0x4c], 0x676c47eb
mov dword [ebp - 0x48], 0xa9809c69
sub dword [ebp - 0x48], 0x68143af4
mov dword [ebp - 0x44], 0x3c07a1d6
sub dword [ebp - 0x44], 0xd898356a
mov dword [ebp - 0x40], 0x33855b9c
add dword [ebp - 0x40], 0xcc7aa464
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3da45
push 0
call eax
mov ecx, 0x3e5d99d1
add ecx, 0xc1a2bdf2
mov edx, eax
mov esi, 0x58e2e0e2
add esi, 0xa75ecf1e
add esi, dword [ebp - 0x3c]
mov ebx, 0xf4853231
add ebx, 0xca357634
xor dword [ebp - 0x28], 0x9484589
mov edi, dword [esi]
sub dword [ebp - 0x1c], eax
sub edi, ebx
mov dword [edx], edi
sub dword [ebp - 0x1c], 0xf863410
add edx, 0x1df4a9e
sub edx, 0x1df4a9a
add esi, 0xad9a83fd
sub esi, 0xad9a83f9
loop 0x401c72
add eax, 0x151df
xor ebx, ebx
add ebx, eax
add eax, 0x90d31577
sub eax, 0x90d31572
mov ecx, 0x400000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53
Function at 0x62401028
Capabilities:
Encode data using xor

Disassembly:
push ebp
movzx eax, al
shl eax, 4
mov ebp, esp
push edi
push esi
mov esi, ecx
push ebx
sub esp, 8
mov dword [ebp - 0x10], eax
lea eax, [edx + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov ebx, edx
xor ecx, ecx
lea edi, [esi + eax]
mov al, byte [edi + ecx]
inc ecx
xor byte [ebx], al
inc ebx
cmp ecx, 4
jne 0x6240104c
add dword [ebp - 0x10], 4
add edx, 4
cmp edx, dword [ebp - 0x14]
jne 0x62401042
pop eax
pop edx
pop ebx
pop esi
pop edi
pop ebp
ret