joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a3164
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x4a317b
add esp, 0xfffffff0
call fcn.004052f4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0043b470
mov eax, dword [0x4daf04]
cmp byte [eax], 0
jne 0x4a31a8
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x17c], al
mov eax, dword [0x4db188]
cmp word [eax + 2], 0
jne 0x4a31c2
mov eax, dword [0x4db188]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004a525c
mov eax, dword [0x4db268]
cmp word [eax + 2], 0
jne 0x4a31dc
mov eax, dword [0x4db268]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004a546c
mov byte [ebx + 0x35], 0
mov dl, 1
mov eax, dword [0x4469c8]
call fcn.0044b9d0
mov esi, eax
mov dword [ebx + 0x3c], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x4a5a1c
mov dl, 1
mov eax, dword [0x424ad8]
call fcn.00404da8
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x424ad8]
call fcn.00404da8
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x44a060]
call fcn.004527c8
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x4a33bc
mov eax, dword [0x4db068]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.00452c5c
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4a5d04
mov dl, 1
mov eax, dword [0x424ad8]
call fcn.00404da8
mov dword [ebx + 0x98], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x4db068]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00411fc8
test eax, eax
je 0x4a32ed
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00411dac
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00411fac
test eax, eax
je 0x4a3305
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00406d14
push ebx
push 0x4a4c2c
call fcn.00498e74
mov dword [ebx + 0x178], eax
mov byte [ebx + 0xd0], 0
mov eax, dword [0x4daf04]
cmp byte [eax], 0
jne 0x4a3356
mov eax, ebx
call fcn.004a3530
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
mov byte [ebx + 0xd1], 0
mov byte [ebx + 0xdc], 0
xor eax, eax
mov dword [ebx + 0xd4], eax
mov byte [ebx + 0xd3], 0
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.004a5f30
mov eax, ebx
call fcn.004a6b64
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4a33b3
call fcn.0040534c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a3804
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x4a38a6
cmp dword [ebx + 0x94], 0
jne 0x4a38a0
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4a3750
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4a38a0
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x4a3866
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4a38a0
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0042f8ac
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4a3875
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4a3ac4
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x4e1280]
cmp dword [eax + 0x170], 0
je 0x4a3c29
test bl, bl
jne 0x4a3b77
cmp dword [esi + 0x9c], 0
jne 0x4a3b6c
mov eax, esi
call fcn.004a69b4
push eax
push 0x4a39d0
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x4a3b3d
mov eax, dword [0x4e1280]
cmp byte [eax + 0xd3], 0
je 0x4a3b3d
mov eax, dword [esi + 0xd8]
call fcn.00408130
mov edi, eax
cmp edi, 0
jl 0x4a3b3d
push 0
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4a3b26
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4a3b6c
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0042f8ac
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4a3b4c
inc dword [esi + 0x9c]
jmp 0x4a3c29
cmp dword [esi + 0x9c], 0
jle 0x4a3c29
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x4a3c29
cmp dword [esi + 0x44], 0
je 0x4a3bd4
mov eax, dword [0x4e1280]
cmp byte [eax + 0xd3], 0
je 0x4a3bd4
mov eax, dword [esi + 0xd8]
call fcn.00408130
mov edi, eax
cmp edi, 0
jl 0x4a3bd4
push 5
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4a3bbd
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4a3c03
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0042f8ac
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4a3be3
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd8]
mov ecx, 1
mov edx, dword [0x496d4c]
call fcn.004082f0
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4a4878
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4a48e3
cmp byte [ebx + 0xd3], 0
jne 0x4a48e3
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00406c68
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x4a48d0
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4a48f0
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406b2c
jmp 0x4a48f0
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406b2c
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x4a6118
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4a6186
mov eax, esi
call fcn.0047e75c
test al, al
je 0x4a6186
mov eax, dword [ebx + 0x84]
call fcn.0047e3b0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4a6186
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x4a617a
push 0
mov eax, dword [ebx + 0x84]
call fcn.0047e3b0
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00475384
jmp 0x4a6186
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004a5f50
pop esi
pop ebx
ret
Function at 0x4cddec
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406b14
xor eax, eax
push ebp
push 0x4cdf5e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4270a0]
call fcn.00432ee8
mov ebx, eax
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00404548
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 8]
mov edx, 0x4cdf78
call fcn.00411b14
cmp dword [0x4e3770], 0
jne 0x4cde6f
mov eax, dword [ebp - 8]
call fcn.004119f0
test al, al
je 0x4cde65
mov eax, dword [ebp - 8]
call fcn.00406bb8
push eax
call sub.kernel32.dll_DeleteFileW
call fcn.004cddb4
mov dword [0x4e3770], eax
call fcn.004cddb4
sub eax, dword [0x4e3770]
cdq
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
lea eax, [ebp - 0x18]
push eax
push 0
push 0x3e8
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00407ca0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
lea eax, [ebp - 0x30]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0x10
push 0
push 0x3e8
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00407d34
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
lea eax, [ebp - 0x38]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0x10
lea eax, [ebp - 0x28]
push eax
push 0x4cdf90
push dword [ebp - 4]
push 0
lea eax, [ebp - 0x3c]
mov edx, 3
call fcn.004070cc
mov eax, dword [ebp - 0x3c]
mov ecx, 1
pop edx
call fcn.00412204
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
call fcn.00406b80
mov eax, dword [ebp - 8]
call fcn.004119f0
test al, al
je 0x4cdf13
mov edx, dword [ebp - 8]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x68]
mov edx, dword [ebp - 4]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 8]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x7c]
mov eax, ebx
call fcn.00404dd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cdf65
lea eax, [ebp - 0x3c]
call fcn.00406b1c
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00406b24
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406b24
ret
Function at 0x414df1
Capabilities:
Encode data using xor

Disassembly:
xor dword [edx], ecx
add edx, 4
cmp edx, esi
jne fcn.00414df1
ret

Function at 0x1001609
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x1001a90
call fcn.010017b4
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x1002370
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x10013c4
cmp eax, esi
jne 0x10013b7
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x10013c7
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100139e
xor esi, esi
inc esi
mov eax, dword [0x100236c]
cmp eax, esi
jne 0x10013da
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1001409
mov eax, dword [0x100236c]
test eax, eax
jne 0x1001403
mov dword [0x100236c], esi
push 0x10010b8
push 0x10010ac
call fcn.01001300
pop ecx
pop ecx
test eax, eax
je 0x1001409
jmp 0x100152d
mov dword [0x1002034], esi
mov eax, dword [0x100236c]
cmp eax, esi
jne 0x100142d
push 0x10010a8
push 0x10010a0
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x100236c], 2
cmp dword [ebp - 0x20], ebx
jne 0x100143a
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1002374], ebx
je 0x100145b
push 0x1002374
call fcn.01001729
pop ecx
test eax, eax
je 0x100145b
push ebx
push 2
push ebx
call dword [0x1002374]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x100152d
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x10014c5
cmp cx, bx
je 0x1001480
cmp dword [ebp - 0x1c], ebx
jne 0x10014c5
movzx ecx, word [eax]
cmp cx, bx
je 0x1001495
cmp cx, 0x20
ja 0x1001495
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x1001480
test byte [ebp - 0x40], 1
je 0x10014a1
movzx ecx, word [ebp - 0x3c]
jmp 0x10014a4
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call main
mov dword [0x1002030], eax
cmp dword [0x1002024], ebx
jne 0x100150a
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cx, 0x22
jne 0x10014d6
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x100146a
cmp dword [0x1002034], ebx
jne 0x1001518
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1002030]
jmp 0x1001539
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.010017f9
ret
call fcn.01001901
jmp 0x1001361
Function at 0x4116e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x4117c7
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x4117b6
jg 0x411720
test edx, edx
je 0x4117b6
nop dword [eax]
call fcn.00415290
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x411773
jg 0x411737
test esi, esi
je 0x411773
cmp ebx, eax
jg 0x411747
jl 0x411741
cmp edi, esi
jae 0x411747
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
push esi
push dword [esp + 0x14]
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.004cd290
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x41179a
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
movzx eax, byte [eax]
push eax
call edx
cmp eax, 0xffffffff
je 0x4117b0
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x411720
jl 0x4117b0
test edi, edi
jne 0x411720
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x4117e9
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x4117eb
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x411869
jg 0x4117fe
test esi, esi
je 0x411869
test eax, eax
jl 0x41184d
jg 0x411808
test ebx, ebx
je 0x41184d
cmp edi, eax
jg 0x411818
jl 0x411812
cmp esi, ebx
jae 0x411818
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.004cd290
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [esp + 0x14]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x411869
jg 0x411850
test esi, esi
je 0x411869
jmp 0x411850
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x411869
push eax
push esi
push 1
push edx
call fcn.004d4b21
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x411e80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x534090]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x411eb0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cb63e
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x411eec
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x411eec
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cb63e
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x411fd6
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x411f14
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x411f47
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.004d00fb
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cb63e
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 0x25], bl
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x411fa9
sub eax, 1
je 0x411fa9
sub eax, 2
jne 0x411fd6
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.004d00fb
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cb63e
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x411fc6
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004d4b21
add esp, 0x10
cmp edi, eax
jne 0x411fd6
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x411ed7
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cb63e
mov esp, ebp
pop ebp
ret 4
Function at 0x414570
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x534090]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x41462c
cmp byte [esi + 0x3d], 0
je 0x41462c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x41461a
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x4145e2
sub eax, 1
je 0x4145e6
sub eax, 2
jne 0x41461a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cb63e
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x414603
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004d4b21
add esp, 0x10
cmp edi, eax
jne 0x41461a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cb63e
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cb63e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.004cb63e
mov esp, ebp
pop ebp
ret

Function at 0x414730
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f66e0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x534090]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004cb682
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.004b53f3
mov dword [esi + 4], eax
lea ebx, [edi + 4]
mov eax, dword [ebp - 0x10]
lea edx, [edi + 8]
mov dword [ebp - 0x14], ebx
lea ecx, [eax + 0x18]
mov ebx, dword [ebp - 0x10]
add esp, 8
mov dword [ebp - 0x18], edx
mov edx, dword [ebp - 0x10]
mov dword [edi + 0x34], esi
add edi, 0x14
mov dword [ebx], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
lea esi, [eax + 0x24]
mov byte [ebx + 0x48], 0
add eax, 0x28
mov byte [ebx + 0x3d], 0
mov ebx, dword [ebp - 0x14]
mov dword [edx + 0xc], ebx
mov ebx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x10], edx
mov dword [ebx + 0x20], ecx
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x2c], esi
mov ebx, dword [ebp - 0x14]
mov dword [edx], 0
mov edx, dword [ebp - 0x10]
mov dword [ecx], 0
mov ecx, dword [0x538dc4]
mov dword [eax], 0
mov eax, dword [0x538dc0]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [esi], 0
mov dword [edx + 0x40], eax
mov eax, edx
mov dword [edx + 0x4c], 0
mov dword [edx + 0x44], ecx
mov dword [edx + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419820
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x419851
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x419840
pop edi
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x41a760
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f707c
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x534090]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [edi], eax
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
lea esi, [edi + 0x38]
mov dword [edi + 0x30], 0
mov byte [edi + 0x34], 0
mov dword [ebp - 0x14], esi
mov dword [esi + 0x24], 0
mov byte [ebp - 4], 4
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x41a814
mov eax, dword [ecx]
push esi
call dword [eax]
mov dword [esi + 0x24], eax
mov al, byte [ebp + 0xc]
lea ecx, [edi + 0x70]
mov byte [ebp - 4], 5
mov byte [edi + 0x60], al
push 9
mov byte [edi + 0x68], 9
call fcn.004159f0
lea eax, [ebp - 0xd]
mov byte [ebp - 4], 6
push eax
lea ecx, [edi + 0x10]
mov byte [ebp - 0xd], 1
call fcn.0041b930
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x41a858
mov esi, dword [ecx]
lea eax, [ebp + 0x10]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x30
Function at 0x432540
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
test esi, esi
je 0x43256b
mov edx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x432554
pop edi
mov eax, edx
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
pop esi
pop ebp
ret

Function at 0x433290
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x203c
call fcn.004cc790
mov eax, dword [0x534090]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x203c], eax
lea esi, [ebp - 0x2038]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
push edi
push eax
lea eax, [ebp - 0x34]
push 0x5140b4
push eax
call fcn.00433270
mov al, byte [ebp - 0x34]
add esp, 0x10
test al, al
je 0x4332f2
lea ecx, [ebp - 0x34]
mov edx, esi
sub ecx, edx
mov byte [esi], al
inc esi
mov al, byte [ecx + esi]
test al, al
jne 0x4332e8
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x43330b
mov al, byte [ecx]
test al, al
je 0x43330b
sub ecx, esi
mov byte [esi], al
inc esi
mov al, byte [ecx + esi]
test al, al
jne 0x433301
mov eax, dword [ebp + 0x14]
lea edi, [ebp - 0x3a]
test eax, eax
mov ecx, 0x5141c8
cmovne ecx, eax
lea eax, [ebp + 0x18]
push eax
push ecx
push ecx
mov dword [ebp + 0x14], ecx
sub edi, esi
push 0xffffffffffffffff
mov edx, edi
mov ecx, esi
call fcn.00438e50
add esp, 0x10
cmp eax, edi
cmova eax, edi
cmp dword [ebp + 0xc], 8
mov word [esi + eax], 0xa
mov esi, dword [ebp - 0x203c]
mov eax, dword [esi]
mov ebx, dword [eax]
jne 0x433358
cmp dword [esi + 8], 2
je 0x433358
or ebx, 2
mov edx, esi
lea ecx, [ebp - 0x2038]
call fcn.00434de0
mov edi, eax
test bl, 1
je 0x433379
lea eax, [ebp - 0x2038]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test bl, 2
je 0x43338d
push edi
lea eax, [ebp - 0x2038]
mov ecx, esi
push eax
call fcn.00434360
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cb63e
mov esp, ebp
pop ebp
ret