joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449210
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x449243
push esi
call fcn.004575b0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x44923c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x4492c9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4492b2
mov eax, dword [esi + 8]
test eax, eax
je 0x449267
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x4492ae
cmp eax, 2
je 0x4492b2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44925a
cmp eax, 3
je 0x44928d
cmp eax, 1
jne 0x44925a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x44925a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x44925a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004492f0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4492d8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.004492f0
add esp, 4
pop esi
ret

Function at 0x449b60
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x449b81
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x449b81
mov eax, dword [eax + 0x44]
test eax, eax
je 0x449b81
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x464710
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x464759
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x464bd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4868d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00464780
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00464800
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00464800
lea ecx, [esi + 0xc]
call fcn.004782fa
lea ecx, [esi + 0x10]
call fcn.004782fa
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00465da0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00465da0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00465da0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0047836f
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0047836f
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x465f90
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x465ff6
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x465ff6
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x465fd7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x47a716
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x47a74e
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004787ca
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004787a2
jmp 0x47a75a
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x47be08
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x47be4a
call fcn.00481978
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x47be4a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x47be41
xor eax, eax
jmp 0x47be52
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0047be58
pop edi
pop esi
pop ebx
ret 4

Function at 0x481ea8
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x481ed6
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x481ef4
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00481e0e
jmp 0x481ef4
mov eax, dword [esi + 0x14]
test eax, eax
je 0x481ef4
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00481e0e
test edi, edi
mov eax, edi
jne 0x481ede
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0xfd7058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xfd71a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xfd707e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xfd706a
add dl, dl
jne 0xfd7089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xfd70dc
xor eax, eax
add dl, dl
jne 0xfd7096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xfd717d
add dl, dl
jne 0xfd70a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xfd70b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xfd70bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xfd70c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xfd70d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xfd7075
mov eax, 1
add dl, dl
jne 0xfd70ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xfd70f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xfd70e1
sub eax, ebx
mov ebx, 1
jne 0xfd7128
mov ecx, 1
add dl, dl
jne 0xfd710e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xfd7119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xfd7105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xfd7075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xfd713f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xfd714a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xfd7136
cmp eax, 0x7d00
jae 0xfd716d
cmp eax, 0x500
jb 0xfd7168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xfd7075
cmp eax, 0x7f
ja 0xfd7170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xfd7075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xfd719e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xfd7075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x63f731
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x63f742
xchg dl, al
mov eax, ebx
cmc
jge 0x63f71b
jl 0x63f742
adc byte [edx + 0x599a6f08], bl
jnp 0x63f794
lea esp, [esp + 4]
dec cl
bts ax, bp
jmp 0x63f78b
lea edx, [eax*4]
mov eax, dword [esp]
mov al, bh
rdtsc
rcr dl, cl
jmp 0x63f7c0
jns 0x63f752

Function at 0x64124a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 3]
jne 0x64124c
push word [esp + 3]
jmp 0x64128e
jmp 0x641234
push word [esp + 3]
mov word [esp + 2], cx
mov dword [esp + 4], ecx
pushal
pop word [esp + 0x10]
jmp 0x64129a
pop word [esp + 0x10]
jmp 0x64129a
mov word [esp + 2], cx
mov dword [esp + 4], ecx
pushal
jmp 0x641278
pop dword [esp + 8]
pop dword [esp + 3]
mov byte [esp + 6], ah
lea esp, [esp + 2]
mov dword [esp + 0x14], edx
call fcn.00641352
push esi
rol dword [eax - reloc.mscoree.dll__CorExeMain], 0x64
and al, 2

Function at 0x6dfed1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bx, ax
std
mov ah, cl
cld
bt eax, edi
setno ah
jmp 0x6dff2a
pop word [esp + 0xb]
pop edx
xchg byte [esp + 6], ah
rcr bp, 0
jmp 0x6dfebb
mov ax, word [esp + 0x1a]
popal
pop esi
mov edx, 0x649a8c5d
xchg bl, bh
xchg ebx, ecx
jmp 0x6dff54
push ax
lea eax, [ecx + edx]
mov bh, 0x9c
pop word [esp + 4]
xchg byte [esp + 0x15], ch
sub esp, 0x16
jmp 0x6dff3e
not ebx
bsr cx, di
btc edx, eax
setno dl
bswap edi
lea esp, [esp + 2]
jmp 0x6dfeff
xchg dword [esp + 0x16], edx
add esp, 0x33
bsr edx, esi
not dh
rdtsc
jmp 0x6dffc9
add esi, 0xb9ec279
mov si, 0x9442
sub esp, 0x1b
push word [esp + 0xe]
xchg dword [esp + 5], ebx
mov cl, bl
jmp 0x6dff11
rcr dx, cl
rdtsc
xchg edi, edx
rdtsc
add al, 0xd3
mov dh, byte [esp + 1]
call int.006dffe1
mov dword [eax], ebp
lea esi, [edi + ebp]
bt ax, dx
bswap edx
pop word [esp]
cpuid
xchg word [esp], si
jmp 0x6dff95
push word [esp + 1]
mov byte [esp + 2], bh
xchg di, dx
mov ch, byte [esp + 3]
mov di, word [esp + 1]
clc
jmp 0x6dffab

Function at 0x6e0022
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg bh, cl
lea esp, [esp + 2]
lea esp, [esp + 4]
setae ah
pop esi
mov dh, 0x53
jmp 0x6e0047
pop word [esp + 1]
xchg dword [esp + 3], esi
pop bp
push si
mov edx, 0xaa75f012
pop ebx
jmp 0x6e0031
pop bp
mov dword [esp + 1], edi
shl ebp, 0xf
push dword [esp + 3]
jmp 0x6dfff7
neg bh
push word [esp + 4]
sub esp, 0xe
mov bp, word [esp + 8]
jmp 0x6e0057
clc
sub esp, 9
not di
cpuid
mov eax, edi
mov edi, dword [esp]
jmp 0x6e0009
lea edx, [esp + esi]
bts di, cx
lea eax, [edi - 0xb4]
xchg bx, dx
stc
bts cx, dx
jmp 0x6e00aa
cpuid
lea eax, [ebx*4]
cmp al, bl
mov bp, word [esp + 4]
xchg bx, ax
clc
jmp 0x6e008a
Function at 0x6e087a
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 0x17], bl
push word [esp + 1]
add esp, 0xa
mov bh, 0xe1
cld
jmp 0x6e0859
std
xchg dword [esp + 0x1e], edi
cpuid
lea edi, reloc.mscoree.dll__CorExeMain
stc
add esp, 0xd
jmp 0x6e0830
lea ebp, [ebp*4]
mov al, 0x83
mov dh, byte [esp + 9]
or dx, 0x44f8
pop dx
setge bh
jmp 0x6e08f5
mov dx, word [esp + 8]
rdtsc
mov eax, dword [esp + 7]
xchg word [esp + 0xb], di
pop di
jmp 0x6e0846
mov cx, bx
setnp bh
not ebp
mov bx, 0x8cce
push dword [esp + 0xa]
jmp 0x6e08d6
std
clc
cld
bswap esi
neg bx
mov bh, bl
jmp 0x6e088e
std
xchg word [esp + 0xd], dx
pop dword [esp + 8]
xchg word [esp + 0xb], dx
setbe cl
lea eax, [ecx*4]
jmp 0x6e08a4
neg esi
lea ebx, [ecx*4]
mov si, word [esp + 0xd]
pop word [esp + 0xc]
rdtsc
pop dx
jmp 0x6e091e
mov eax, dword [esp + 9]
mov ebp, ebx
bt edi, eax
pop word [esp + 5]
mov cl, 0xcb
pushfd
jmp 0x6e08bb
mov ebp, dword [esp + 3]
pop word [esp + 4]
pop word [esp + 4]
xchg ecx, eax
jmp 0x6e0935
push bx
xchg dword [esp + 0xa], ebx
sub si, 0xb795
pop ebp
xchg dword [esp + 3], ebp
mov ax, word [esp + 3]
jmp 0x6e0908
mov al, byte [esp + 3]
neg edi
lea ebp, [esi*4]
lea ebp, [esp + edi]
inc ch
mov cx, word [esp + 5]
jmp 0x6e130d
setle bh
mov edx, dword [esp + 7]
xchg byte [esp + 3], al
mov dx, 0x8304
mov edi, esi
xor eax, ebx
jmp 0x6e099f
bswap ebx
lea esp, [esp + 3]
rdtsc
pushfd
mov byte [esp + 6], cl
pop si
jmp 0x6e0970
mov byte [esp + 3], ah
lea esp, [esp + 8]
popal
pushfd
mov word [esp], dx
push dword [esp + 2]
jmp 0x6e0a02
mov dword [esp + 2], edi
adc ebx, ecx
xchg dword [esp + 1], esi
mov word [esp + 4], bp
xchg edx, esi
mov byte [esp + 3], bl
jmp 0x6e098e
lea esp, [esp + 4]
pushfd
mov dword [esp], ebx
mov byte [esp], bl
mov dword [esp], eax
jmp 0x6e0a29
lea esp, [esp + 0x44]
call fcn.006e0a13
mov esp, 0x2bd8b929
sbb dh, 0x4a
fdivr dword [edi - 0x709401b6]
add al, 0x24
pop dword [esp]
mov dword [esp], ebx
mov byte [esp + 1], cl
lea esp, [esp + 4]
popfd
jmp 0x6e09dc
pushal
mov dword [esp + 0x17], esp
pushal
mov word [esp + 0x34], bp
push dword [esp + 9]
jmp 0x6e09ec
stc
xchg dword [esp], ebp
mov ax, word [esp + 7]
pop ax
push dword [esp + 4]
lea esp, [esp + 1]
jmp 0x6e09c5
mov dword [esp + 2], edx
std
mov ah, 0x9b
bswap esi
xchg byte [esp + 3], cl
mov word [esp + 1], cx
jmp 0x6e0a40
bsf edx, eax
mov word [esp + 5], dx
mov ebx, 0xb76fe315
xchg byte [esp + 4], ch
clc
mov bx, 0x1ba8
jmp 0x6e0c6b
add esp, 1
pop dword [esp]
push dword [esp + 2]
std
mov ebx, ebp
mov edi, dword [esp + 6]
jmp 0x6e0f83

Function at 0x6e0a58
Capabilities:
Parse pe header

Disassembly:
call fcn.006e0a6e
xor ah, byte [ebp + 0x4af5c35]
dec esp
salc
inc esp
and ebx, esi
push 0xffffffffffffffc7
outsb dx, byte [esi]
jns 0x6e0ac5
mov ebx, 0xc246489
Function at 0x6e0a6e
Capabilities:
Parse pe header

Disassembly:
call fcn.006e0073
mov dword [esp + 0xc], esp
push esp
lea esp, [esp + 3]
jmp 0x6e0ab1
mov byte [esp], bl
mov word [esp], si
mov word [esp], cx
lea esp, [esp + 2]
mov dword [esp + 8], edi
lea esp, [esp + 8]
jmp 0x6e0ad9
push ebx
lea esp, [esp + 1]
mov dword [esp + 0xc], ebp
pushfd
mov dword [esp + 0xc], esi
push bp
jmp 0x6e0a8c
mov eax, dword [eax]
jmp 0x6e0ae7
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x6e0ac3
mov eax, dword [eax + 8]
push eax
jmp 0x6e006e

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x42105f
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x44e8a8
call fcn.00422e90
call main
movzx esi, ax
push 2
call main
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x420f16
xor ebx, ebx
jmp 0x420f49
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x420f12
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x420f12
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x420f49
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.004279ab
test eax, eax
jne 0x420f5d
push 0x1c
call main
pop ecx
call fcn.00427918
test eax, eax
jne 0x420f6e
push 0x10
call main
pop ecx
call fcn.00428296
and dword [ebp - 4], 0
call fcn.004279c0
test eax, eax
jns 0x420f88
push 0x1b
call main
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov dword [0x457adc], eax
call main
mov dword [0x455a24], eax
call main
test eax, eax
jns 0x420fae
push 8
call main
pop ecx
call fcn.00427eb1
test eax, eax
jns 0x420fbf
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x420fd2
push eax
call main
pop ecx
call fcn.00428714
push esi
push eax
push 0
push 0x400000
call main
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x420ff4
push esi
call main
call fcn.00426cd7
jmp 0x421029
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.00422ed5
ret
call main
jmp 0x420ee8

Function at 0x4259d1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x4259e0
pop dword [ebp - 0x10]
mov eax, 0xff0abbd9
sub eax, 0xfec861f9
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xf76293a6
add dword [ebp - 0x20], 0x56efb1a5
mov dword [ebp - 0x1c], 0x7bbc3fee
add dword [ebp - 0x1c], 0xb6770c57
mov dword [ebp - 0x18], 0x9451ceaa
sub dword [ebp - 0x18], 0x48058a7c
mov dword [ebp - 0x14], 0x302fbdc3
add dword [ebp - 0x14], 0xcfd0423d
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x9271bc51
add dword [ebp - 0x20], 0xe200ad05
mov dword [ebp - 0x1c], 0x20f6639e
sub dword [ebp - 0x1c], 0xdf8a0229
mov dword [ebp - 0x18], 0xeecc4b81
add dword [ebp - 0x18], 0x74a320eb
mov dword [ebp - 0x14], 0x866646fd
add dword [ebp - 0x14], 0x7999b903
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x4526f
push 0
call eax
mov ecx, 0x2a57ccce
add ecx, 0xd5a877c3
xor ebx, ebx
add ebx, eax
mov esi, 0x475600
add esi, dword [ebp - 0x10]
mov edx, 0x807fd982
sub edx, 0x69bd9251
mov edi, dword [esi]
xor dword [ebp - 0xc], 0xf666cf6d
xor edi, edx
sub dword [ebp - 0xc], esi
mov dword [ebx], edi
xor dword [ebp - 0xc], 0x52418311
add ebx, 4
add esi, 0x53554157
add esi, 0xacaabead
loop 0x425af4
add eax, 0x10517
mov ebx, eax
add eax, 0xde8afa83
add eax, 0x21750582
mov ecx, 0x9053e90d
add ecx, 0x6fec16f3
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x401f50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
push eax
call fcn.004019c0
add esp, 4
push eax
lea ecx, [ebp - 0xc]
push ecx
call fcn.00402100
add esp, 8
push eax
lea ecx, [ebp - 8]
call fcn.00401200
lea ecx, [ebp - 0xc]
call fcn.00402c70
mov dword [ebp - 0x10], 0x401dd0
mov edx, dword [ebp - 4]
add edx, 4
push edx
push 0
lea ecx, [ebp - 8]
call fcn.00404580
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0
push 0
call fcn.0040bd83
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
cmp dword [edx], 0
je 0x401fc3
lea ecx, [ebp - 8]
call fcn.004048b0
jmp 0x401fd4
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0
push 6
call fcn.00404ec5
lea ecx, [ebp - 8]
call fcn.00402c70
mov esp, ebp
pop ebp
ret 4

Function at 0x40652d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x40654e
jl 0x406545
test edi, edi
jne 0x40654e
xor eax, eax
xor edx, edx
jmp 0x40660f
cmp dword [ebx + 0x38], 0
je 0x406563
push eax
push edi
push dword [ebp + 8]
call fcn.00406615
jmp 0x40660f
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x4065aa
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x4065aa
cmp eax, edi
jb 0x406584
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.00407b90
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x4065b0
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x406604
mov ecx, ebx
call fcn.00405d7d
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x4065ef
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.0040d271
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x406604
jmp 0x4065c2
test edx, edx
je 0x406604
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.0040d271
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x4079cd
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x407a0c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x407a0c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x407a0c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x407a0c
cmp dword [ecx + 0x74], 0xe
jbe 0x407a0c
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x41260d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4216b4
push 0x4216ac
push str.FlsAlloc
push 0x1e
call fcn.004124b6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x412641
push dword [ebp + 8]
mov ecx, esi
call dword [0x41e14c]
call esi
jmp 0x412647
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x41268b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4216c4
push 0x4216bc
push str.FlsGetValue
push 0x20
call fcn.004124b6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4126c2
push dword [ebp + 8]
mov ecx, esi
call dword [0x41e14c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x4150d1
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00414f42

Function at 0x4154cb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00407b40
mov eax, dword [0x475740]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00412ee6
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x41550d
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x415669
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0041c820
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x477350]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.004164c2
mov ecx, dword [esi*4 + 0x477350]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x415662
cmp eax, dword [edi + ecx + 0x24]
jne 0x415662
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x415662
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004164c2
add esp, 0x14
test edx, edx
jl 0x415662
jg 0x4155d8
test eax, eax
jb 0x415662
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x415662
jl 0x4155f2
cmp dword [ebp - 0x1008], eax
ja 0x415662
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x415610
test ebx, ebx
je 0x415649
cmp ecx, edi
jae 0x415649
mov al, byte [ecx]
cmp al, 0xd
jne 0x41562a
lea eax, [edi - 1]
cmp ecx, eax
jae 0x415636
cmp byte [ecx + 1], 0xa
jne 0x415636
inc ecx
jmp 0x415636
movzx eax, al
movsx eax, byte [eax + 0x475a18]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x415610
cmp edx, ebx
jne 0x415610
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x415667
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00406da7
leave
ret