joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d5e3
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419428]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040805b
mov dword [ebp - 0x14], eax
cmp dword [0x813f3c], esi
jne 0x40d6d6
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d663
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d7b6
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d7b6
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d7b6
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x813f3c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x813f40], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x813f44], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x813f4c], eax
test eax, eax
je 0x40d6d3
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x813f48], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d6fb
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d6ee
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d710
push 4
pop eax
jmp 0x40d7b8
cmp dword [ebp - 0x14], esi
je 0x40d710
push dword [0x813f3c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d6f5
mov eax, dword [0x813f48]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d76e
cmp dword [0x813f4c], edi
je 0x40d76e
push eax
call ebx
push dword [0x813f4c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d76e
test eax, eax
je 0x40d76e
call ecx
test eax, eax
je 0x40d763
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d763
test byte [ebp - 8], 1
jne 0x40d76e
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d79e
mov eax, dword [0x813f40]
cmp eax, edi
je 0x40d79b
push eax
call ebx
test eax, eax
je 0x40d79b
call eax
mov esi, eax
test esi, esi
je 0x40d79b
mov eax, dword [0x813f44]
cmp eax, edi
je 0x40d79b
push eax
call ebx
test eax, eax
je 0x40d79b
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x813f3c]
call ebx
test eax, eax
je 0x40d7b6
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d7b8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040401d
mov esp, ebp
pop ebp
ret
Function at 0x40a3a7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x40a3ce
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040aeee
jmp 0x40a49d
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x40a3f0
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x40a3f2
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x40a491
jg 0x40a40f
test esi, esi
je 0x40a491
test ecx, ecx
jl 0x40a45c
jg 0x40a419
test eax, eax
je 0x40a45c
cmp ebx, ecx
jg 0x40a42d
jl 0x40a423
cmp esi, eax
jae 0x40a42d
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call fcn.0043bb90
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x40a463
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x40a491
jg 0x40a46d
test esi, esi
je 0x40a491
cmp dword [edi + 0x4c], 0
je 0x40a491
mov ecx, edi
call fcn.0040b3b2
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call fcn.004442d2
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40a6d6
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x30
mov eax, dword [0x48b068]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
mov ebx, dword [esp + 0x38]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x40a6fb
xor eax, eax
jmp 0x40a7c9
mov eax, dword [esi + 0x20]
push ebp
mov ecx, dword [eax]
test ecx, ecx
je 0x40a729
mov edx, dword [esi + 0x30]
mov ebp, dword [edx]
lea eax, [ecx + ebp]
cmp ecx, eax
jae 0x40a729
lea ecx, [ebp - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0x40a7c8
cmp dword [esi + 0x4c], 0
je 0x40a7c6
mov ecx, esi
call fcn.0040b3b2
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x40a755
push dword [esi + 0x4c]
push eax
call fcn.00408a44
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x40a7c6
mov byte [esp + 0x10], al
lea eax, [esp + 0x14]
mov edx, dword [ecx]
push eax
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x21]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x40a7c6
cmp eax, 1
jle 0x40a797
cmp eax, 3
jne 0x40a7c6
push dword [esi + 0x4c]
push dword [esp + 0x14]
jmp 0x40a747
mov ebp, dword [esp + 0x14]
lea eax, [esp + 0x1c]
sub ebp, eax
je 0x40a7b6
push dword [esi + 0x4c]
push ebp
push 1
push eax
call fcn.00443cdc
add esp, 0x10
cmp ebp, eax
jne 0x40a7c6
lea eax, [esp + 0x10]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x18], eax
mov eax, ebx
jne 0x40a7c8
mov eax, edi
pop ebp
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00439b80
add esp, 0x30
ret 4

Function at 0x40b3fd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x48b068]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x40b47f
cmp byte [esi + 0x3d], 0
je 0x40b47f
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x40b451
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x40b455
sub eax, 1
je 0x40b459
dec eax
sub eax, 1
je 0x40b47f
xor al, al
jmp 0x40b481
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40b476
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00443cdc
add esp, 0x10
cmp edi, eax
jne 0x40b451
cmp byte [esi + 0x3d], 0
sete al
jmp 0x40b481
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00439b80
leave
ret
Function at 0x420e41
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push pe_nt_image_headers32
mov eax, 0x46208a
call fcn.0043a499
mov edi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c], eax
call fcn.00420e23
mov ebx, eax
test ebx, ebx
je 0x420f2f
mov esi, dword [sym.imp.KERNEL32.dll_LoadResource]
push ebx
push dword [edi + 0x38]
call esi
test eax, eax
jne 0x420ee7
push str.cannot_load_resource
lea ecx, [ebp - 0x2c]
call fcn.004069c2
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 0x68]
mov ecx, edi
push eax
call fcn.00420d65
push eax
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 5
call fcn.004174ff
push str.System_error
mov byte [ebp - 4], 6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x84]
call fcn.0042adad
mov edx, eax
push 0x46
push str.Resource::getPtr
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x78]
push str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u281_880_install_src_windows_common_Resources.cpp
jmp 0x420f9c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp dword [edi + 0x34], 6
mov esi, eax
jne 0x420f16
mov ecx, dword [edi + 0x18]
and ecx, 0xf
jbe 0x420f0c
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x420efe
movzx eax, word [esi]
add eax, eax
add esi, 2
jmp 0x420f20
push ebx
push dword [edi + 0x38]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 0x6c]
mov dword [ecx], eax
mov eax, esi
call fcn.0043a443
ret 4
push str.cannot_find_resource
lea ecx, [ebp - 0x2c]
call fcn.004069c2
and dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x68]
mov ecx, edi
push eax
call fcn.00420d65
push eax
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 1
call fcn.004174ff
push str.System_error
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [sym.imp.KERNEL32.dll_FindResourceA]
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x78]
call fcn.0042adad
mov edx, eax
push 0x41
push str.Resource::getPtr
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x84]
push str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u281_880_install_src_windows_common_Resources.cpp
call fcn.00404614
push eax
lea ecx, [ebp - 0x50]
call fcn.0041ec43
lea eax, [ebp - 0x50]
mov dword [esp], 0x488fdc
push eax
call fcn.0043d85d
int3

Function at 0x42411b
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0x24
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.0043c110
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [ebp - 0x24], 9
sete al
leave
ret
Function at 0x424674
Capabilities:
Get common file path

Disassembly:
push 0x2c
mov eax, 0x462a4e
call fcn.0043a499
mov esi, ecx
mov dword [ebp - 0x38], esi
push ecx
push 0x104
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x38], esi
call fcn.00411578
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x30]
push dword [ebp - 0x34]
sub eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ecx, dword [ebp - 0x34]
mov edx, eax
mov eax, dword [ebp - 0x30]
sub eax, ecx
cmp edx, eax
jbe 0x4246d7
lea eax, [ebp - 0x34]
push eax
push edx
mov ecx, eax
call fcn.0041727b
mov eax, dword [ebp - 0x30]
push dword [ebp - 0x34]
sub eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ecx, dword [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x28]
call fcn.004069c2
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 1
mov ecx, esi
call fcn.00425bef
lea ecx, [ebp - 0x28]
call fcn.00406b80
lea ecx, [ebp - 0x34]
call fcn.004115b2
mov eax, esi
call fcn.0043a443
ret

Function at 0x42599b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 0x10
jb 0x4259a3
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
setne al
ret

Function at 0x4259b1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 0x10
jb 0x4259b9
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4259cc
test al, 0x10
je 0x4259cc
mov al, 1
ret
xor al, al
ret
Function at 0x425cab
Capabilities:
Get file version info

Disassembly:
push 0xe8
mov eax, 0x462e06
call fcn.0043a499
mov esi, ecx
mov dword [ebp - 0x3c], esi
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x44], esi
push eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
call fcn.00407be2
lea edi, [esi + 0x18]
mov dword [ebp - 4], ebx
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov byte [ebp - 4], 1
mov eax, esi
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x3c], ebx
jb 0x425cf2
mov eax, dword [esi]
mov ebx, dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
lea ecx, [ebp - 0x3c]
push ecx
push eax
call ebx
test eax, eax
je 0x425db7
push edi
push eax
mov ecx, edi
call fcn.00414eba
mov eax, dword [edi + 4]
mov ecx, esi
sub eax, dword [edi]
cmp dword [esi + 0x14], 0x10
jb 0x425d1f
mov ecx, dword [esi]
push dword [edi]
mov edi, dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
push eax
push dword [ebp - 0x3c]
push ecx
call edi
test eax, eax
jne 0x425dad
push 0x46d
push str.VersionResource::VersionResource
push str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u281_880_install_src_windows_common_FileUtils.cpp
lea ecx, [ebp - 0x5c]
call fcn.00404614
push eax
push str.System_error
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 0x478c28
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x40], esp
push esi
call fcn.00407bc8
lea ecx, [ebp - 0xf4]
mov byte [ebp - 4], 6
call fcn.004088ff
mov byte [ebp - 4], 7
push str.GetFileVersionInfo_
mov ecx, eax
call fcn.0040be06
mov ecx, eax
mov byte [ebp - 4], 8
call fcn.0040be1a
mov ecx, eax
call fcn.0040be06
push eax
lea ecx, [ebp - 0x50]
call fcn.0042adad
mov byte [ebp - 4], 9
jmp 0x425e2d
mov eax, esi
call fcn.0043a443
ret 4
push 0x464
push str.VersionResource::VersionResource
push str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u281_880_install_src_windows_common_FileUtils.cpp
lea ecx, [ebp - 0x50]
call fcn.00404614
push eax
push str.System_error
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push 0x478c28
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x40], esp
push esi
call fcn.00407bc8
lea ecx, [ebp - 0xf4]
mov byte [ebp - 4], 2
call fcn.004088ff
mov byte [ebp - 4], 3
push str.GetFileVersionInfoSize_
mov ecx, eax
call fcn.0040be06
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.0040be1a
mov ecx, eax
call fcn.0040be06
push eax
lea ecx, [ebp - 0x5c]
call fcn.0042adad
mov byte [ebp - 4], 5
mov edx, eax
lea ecx, [ebp - 0x38]
call fcn.0041ec43
lea eax, [ebp - 0x38]
mov dword [esp], 0x488fdc
push eax
call fcn.0043d85d
int3
Function at 0x429faf
Capabilities:
Check mutex on windows

Disassembly:
push 0xa4
mov eax, 0x463bb9
call fcn.0043a465
mov edi, ecx
push str.Global_MSIExecute
xor ebx, ebx
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov esi, eax
mov byte [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], ebx
test esi, esi
je 0x42a061
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x10], eax
test edi, edi
je 0x42a05a
cmp dword [0x48e67c], 1
jg 0x42a05a
push ecx
push ecx
lea ecx, [ebp - 0xb0]
call fcn.0040a898
mov edx, str.finish_waiting_for_mutex:
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xb0]
call fcn.0040c4c7
push dword [ebp - 0x10]
lea ecx, [ebp - 0xb0]
call fcn.0040f157
lea eax, [ebp - 0xb0]
mov ecx, 0x48e67c
push eax
push str.msi::waitForInstallationCompletion
push 0x1c8
push str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u281_880_install_src_windows_common_MsiUtils.cpp
push 1
call fcn.004089d8
lea ecx, [ebp - 0xb0]
call fcn.0040898c
mov eax, dword [ebp - 0x10]
cmp eax, 0x102
je 0x42a063
mov bl, 1
push esi
mov dword [ebp - 4], 3
call fcn.0042a9ee
pop ecx
mov al, bl
call fcn.0043a42e
ret
Function at 0x452017
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00451e8d

Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x42e01e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp int.00401219
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x401e40
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
nop
lea eax, [ebp - 0x44]
push eax
call sub.kernel32.dll_GetStartupInfoA
mov eax, dword [ebp - 0x18]
and eax, 1
cmp eax, 0
je 0x401e6e
movzx eax, word [ebp - 0x14]
mov dword [ebp - 0x50], eax
jmp 0x401e76
mov eax, 0xa
mov dword [ebp - 0x50], eax
mov eax, 0
mov dword [ebp - 0x48], eax
call sub.kernel32.dll_GetCommandLineA
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 8]
cmp eax, 0
je 0x401ea5
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x4c]
push eax
call sub.msvcrt.dll_strstr
add esp, 8
mov dword [ebp - 0x48], eax
mov eax, 0
mov ecx, dword [ebp - 0x48]
cmp eax, ecx
jne 0x401ecb
mov eax, 0x403080
push eax
call sub.msvcrt.dll__strdup
add esp, 4
mov dword [ebp - 0x48], eax
jmp 0x401ef4
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x4c]
cmp eax, ecx
jbe 0x401ef4
mov eax, dword [ebp - 0x48]
add eax, 0xffffffff
movsx ecx, byte [eax]
cmp ecx, 0x22
jne 0x401ef4
mov eax, dword [ebp - 0x48]
add eax, 0xffffffff
mov dword [ebp - 0x48], eax
mov eax, 0x30000
push eax
mov eax, 0x10000
push eax
call sub.msvcrt.dll__controlfp
add esp, 8
mov eax, 0
push eax
call sub.kernel32.dll_GetModuleHandleA
mov ecx, dword [ebp - 0x50]
push ecx
mov ecx, dword [ebp - 0x48]
push ecx
mov ecx, 0
push ecx
push eax
call fcn.00401c16
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x6c836a87
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
mov ecx, 0x407e22a2
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x405b00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov esi, ecx
mov edi, dword [esp + 0x78]
xorps xmm0, xmm0
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
push 0
push 0x48
call fcn.00420170
mov dword [esp + 4], esi
mov dword [esi], 0x54adf0
mov eax, dword [edi + 8]
mov dword [esp + 0xc], eax
test eax, eax
je 0x405c60
xor ecx, ecx
lea ebx, [esp + 0x18]
mov esi, esp
jmp 0x405b61
mov ecx, dword [esp + 0x10]
add ecx, 1
cmp ecx, dword [esp + 0xc]
je 0x405c60
mov eax, dword [esp + 0x78]
mov eax, dword [eax + 4]
mov dword [esp + 0x10], ecx
lea ecx, [ecx + ecx*4]
mov edx, dword [eax + ecx*4 + 8]
mov dword [esp + 0x14], edx
test edx, edx
je 0x405b50
lea eax, [eax + ecx*4]
mov dword [esp + 8], eax
xor edi, edi
mov ebp, 0x40
jmp 0x405b9c
add edi, 1
add ebp, 0x44
cmp dword [esp + 0x14], edi
je 0x405b50
mov dword [esp], 0
push edi
push dword [esp + 0xc]
push ebx
call fcn.004266b0
add esp, 0xc
push ebx
push esi
call fcn.00405380
add esp, 8
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x405bce
mov eax, dword [ecx]
add ecx, dword [eax - 0xc]
push ebx
call fcn.0041c020
mov ecx, dword [esp]
test ecx, ecx
je 0x405b90
mov esi, ebx
mov eax, dword [esp + 8]
mov eax, dword [eax + 4]
movups xmm0, xmmword [eax + ebp - 0x10]
movups xmmword [esp + 0x4c], xmm0
movups xmm0, xmmword [eax + ebp - 0x20]
movups xmmword [esp + 0x3c], xmm0
movups xmm0, xmmword [eax + ebp - 0x40]
movups xmm1, xmmword [eax + ebp - 0x30]
movups xmmword [esp + 0x2c], xmm1
movups xmmword [esp + 0x1c], xmm0
mov eax, dword [eax + ebp]
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], ecx
mov eax, dword [ecx]
add ecx, dword [eax - 0xc]
lea ebx, [esp + 0x60]
push ebx
call fcn.0041bfa0
mov ecx, dword [esp + 4]
lea eax, [esp + 0x1c]
push eax
call fcn.004203c0
mov ecx, dword [esp + 0x60]
test ecx, ecx
je 0x405c41
mov eax, dword [ecx]
add ecx, dword [eax - 0xc]
push ebx
call fcn.0041c020
mov ecx, dword [esp]
test ecx, ecx
mov ebx, esi
mov esi, esp
je 0x405b90
mov eax, dword [ecx]
add ecx, dword [eax - 0xc]
push esi
call fcn.0041c020
jmp 0x405b90
mov eax, dword [esp + 4]
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x41ed60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, dword [esp + 0x18]
test esi, esi
je 0x41eed1
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x41eed1
mov eax, dword [esp + 0x20]
test eax, eax
je 0x41eed1
mov edi, dword [esp + 0x24]
test ecx, ecx
jle 0x41eec8
lea ecx, [esi + ecx*2]
mov dword [esp], ecx
jmp 0x41edd7
mov ecx, edx
and cl, 0x3f
or cl, 0x80
mov byte [edi - 1], cl
add edi, 0xffffffff
shr edx, 6
mov ecx, edx
and cl, 0x3f
or cl, 0x80
mov byte [edi - 1], cl
add edi, 0xffffffff
shr edx, 6
or edx, dword [ebx*4 + 0x54edc8]
mov byte [edi - 1], dl
mov edi, ebp
cmp esi, dword [esp]
jae 0x41eeca
movzx edx, word [esi]
mov ecx, edx
and ecx, 0xfc00
cmp ecx, 0xd800
jne 0x41ee30
lea ebp, [esi + 2]
cmp ebp, dword [esp]
jae 0x41ee60
movzx ebx, word [ebp]
mov ecx, ebx
and ecx, 0xfc00
cmp ecx, 0xdc00
jne 0x41ee60
shl edx, 0xa
add edx, 0xfca00000
add ebx, 0xffff2400
or ebx, edx
add ebx, 0x10000
mov edx, ebx
jmp 0x41ee32
mov ebp, esi
mov ebx, 1
cmp edx, 0x80
jb 0x41ee90
mov ebx, 2
cmp edx, 0x800
jb 0x41ee90
cmp edx, 0xffff
ja 0x41ee76
mov esi, ebp
nop word cs:[eax + eax]
lea ecx, [edx - 0xe000]
xor ebx, ebx
cmp ecx, 0xfffff800
setb bl
lea ebx, [ebx + ebx*2]
jmp 0x41ee92
xor ebx, ebx
cmp edx, 0x110000
setb bl
shl ebx, 2
nop word cs:[eax + eax]
nop
mov esi, ebp
mov ebp, edi
sub ebp, ebx
jb 0x41eed9
add esi, 2
add eax, ebx
lea ecx, [ebx - 1]
cmp ecx, 3
ja case.default.0x41eeab
mov edi, eax
jmp dword [ecx*4 + 0x54ecd0]
mov ecx, edx
and cl, 0x3f
or cl, 0x80
lea edi, [eax - 1]
mov byte [eax - 1], cl
shr edx, 6
jmp case.0x41eeab.3
mov ebp, edi
test ebp, ebp
je 0x41eeef
mov byte [eax], 0
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push ebx
push edi
push str._zu____zu
push str.unicode
push str.dst_len___len
call fcn.004210a0
push 0
push str._zu___1
push str.unicode
push str.dst_len___1
call fcn.004210a0
nop word cs:[eax + eax]
nop

Function at 0x4230e0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
mov dword [esp + 0xc], eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00486bd0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
lea esi, [esi]