joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417ae0
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push str.kernel32.dll
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
call fcn.00417a10
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetCurrentPackageId
push esi
call ebx
test edi, edi
mov dword [0x4c57c4], eax
je 0x417b4f
push str.GetSystemTimePreciseAsFileTime
push esi
call ebx
mov ecx, dword [0x4c5aec]
push 0x4c57d8
push ecx
mov dword [0x4c4fbc], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push str.GetTempPath2W
push esi
call ebx
mov dword [0x4c4fb8], eax
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret

Function at 0x444927
Capabilities:
Encode data using xor

Disassembly:
xchg dword [ebx + edi*4 - 0x45865836], edi
xchg byte [eax + 0x4593cb9f], ah
mov al, byte [0x4593cb9f]
lodsb al, byte [esi]
sub dword [ebx], edi

Function at 0x48a86f
Capabilities:
Encode data using xor

Disassembly:
add eax, 0x54f22464
aad 0x85
test al, 0x34
or bh, byte [esi]
movsb byte es:[edi], byte [esi]
xor al, 0xa
movsb byte es:[edi], byte ds:[esi]
jno 0x48a877
dec esi
mov eax, dword [0x74148239]
xlatb
test eax, 0x8194730
dec esi
mov ch, 0xc8
inc eax
inc ebx
imul edi, dword [edx - 0x764961f3], 0xffffffc0
mov eax, eax

Function at 0x4b978d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c2390
cmp edx, dword [eax]
je 0x4b97af
add eax, 8
inc ecx
cmp eax, 0x4c2420
jl 0x4b97a0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c2390]
jne 0x4b98dd
mov eax, dword [0x4c6d2c]
cmp eax, 1
je 0x4b98b7
test eax, eax
jne 0x4b97e0
cmp dword [0x4c22b8], 1
je 0x4b98b7
cmp edx, 0xfc
je 0x4b98dd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4b9817
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004ba170
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004ba600
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4b985a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004ba600
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bea8c
push edi
call fcn.004bc4d0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004ba170
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004ba180
lea eax, [ebp - 0xa0]
push 0x4bea6c
push eax
call fcn.004ba180
push dword [esi + 0x4c2394]
lea eax, [ebp - 0xa0]
push eax
call fcn.004ba180
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bc444
add esp, 0x2c
pop edi
jmp 0x4b98dd
lea eax, [ebp + 8]
lea esi, [esi + 0x4c2394]
push 0
push eax
push dword [esi]
call fcn.004ba600
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0xf02150
Capabilities:
Encode data using xor

Disassembly:
jmp 0xf0215a
pushal
call 0xf02160
pop ebp
sub ebp, 0x10
sub ebp, 0xb02150
jmp 0xf02176
mov eax, 0xb02150
add eax, ebp
add eax, 0x4c
mov ecx, 0x5ce
mov edx, 0x1cfabdea
xor byte [eax], dl
inc eax
dec ecx
jne 0xf0218d
jmp 0xf021a0
popal
daa
popal
arpl si, dx
ljmp 0xea12
Function at 0x1003ee20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x1003ee2f
pop dword [ebp - 0x34]
mov eax, 0x2de4fc86
sub eax, 0x1de10e57
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x8d8caed4
add dword [ebp - 0x44], 0xc0c59677
mov dword [ebp - 0x40], 0x12bf6d2e
add dword [ebp - 0x40], 0x1f73df17
mov dword [ebp - 0x3c], 0x513d8099
sub dword [ebp - 0x3c], 0x4f13c6b
mov dword [ebp - 0x38], 0x4a7c5716
add dword [ebp - 0x38], 0xb583a8ea
lea eax, [ebp - 0x44]
push eax
mov eax, 0xfde35c29
add eax, 0x1221149f
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xe1d4e549
add dword [ebp - 0x44], 0x929d840d
mov dword [ebp - 0x40], 0x629ccf85
add dword [ebp - 0x40], 0xdecf91f0
mov dword [ebp - 0x3c], 0x6d137ef8
add dword [ebp - 0x3c], 0xf65bed74
mov dword [ebp - 0x38], 0x852f3f03
sub dword [ebp - 0x38], 0x852f3f03
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xe685e274
sub eax, 0xd6817190
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x430e6
push 0
call eax
mov ecx, 0x4b1c430d
sub ecx, 0x4b1bf83e
xor edi, edi
add edi, eax
mov ebx, 0x882bc5ac
sub ebx, 0x782595ac
add ebx, dword [ebp - 0x34]
mov esi, 0x470a60ba
add dword [ebp - 8], edi
mov edx, dword [ebx]
sub dword [ebp - 0x10], 0xf8f0604
xor edx, esi
sub dword [ebp - 0x20], 0x3081c70a
mov dword [edi], edx
sub dword [ebp - 0x2c], 0x7ebd9ec4
add edi, 4
add ebx, 4
loop 0x1003ef4d
add eax, 0x14d05312
sub eax, 0x14cf3503
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x40bdb0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
jmp 0x40bdca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40bdd1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40bdc0
mov eax, 1
add ebx, ebx
jne 0x40bde3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40bdd8
jne 0x40bdf4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40bdd8
xor ecx, ecx
sub eax, 3
jb 0x40be08
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40be7a
mov ebp, eax
add ebx, ebx
jne 0x40be13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40be20
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40be44
inc ecx
add ebx, ebx
jne 0x40be30
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40be25
jne 0x40be41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40be25
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40be64
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40be55
jmp 0x40bdc6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40be64
add edi, ecx
jmp 0x40bdc6
pop esi
lea edi, [esi + 0x9000]
mov eax, dword [edi]
or eax, eax
je 0x40bec3
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb4c8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb550]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40be81
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb558]
or eax, eax
je 0x40bebd
mov dword [ebx], eax
add ebx, 4
jmp 0x40be9e
call dword [esi + 0xb554]
mov ebp, dword [esi + 0xb55c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40bef7
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x6bf01330
Capabilities:
Get disk information

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x30
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
cmp dx, 1
je 0x6bf01380
mov ebx, 0xd68d
test dx, dx
je 0x6bf0136c
cmp dx, 2
je 0x6bf013d0
xor ebx, ebx
test byte [0x6bf03330], 4
jne 0x6bf01413
lea esp, [ebp - 8]
mov eax, ebx
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 8
add eax, 0x41
mov dword [ebp - 0xc], 0x3a
mov ebx, 0x40004
mov word [ebp - 0xe], ax
lea eax, [ebp - 0xe]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetDriveTypeW]
sub esp, 4
cmp ax, 5
je 0x6bf0136c
xor ebx, ebx
cmp ax, 1
je 0x6bf0136c
lea esp, [ebp - 8]
movzx ebx, ax
shl eax, 0x10
pop ecx
or ebx, eax
mov eax, ebx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 8
xor ebx, ebx
test byte [0x6bf03330], 1
je 0x6bf0136c
movzx eax, ax
mov dword [esp + 0x10], 2
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str.Case__d:_set_single_drive__d_not_supported_n
mov dword [esp + 8], str.InquireSystem16
mov dword [esp + 4], 0x6bf03330
mov dword [esp], 0
call sym._wine_dbg_log.constprop.2
jmp 0x6bf0136c
movzx edx, dx
mov dword [esp + 0xc], str.Unknown_code__d_n
mov dword [esp + 0x10], edx
mov dword [esp + 8], str.InquireSystem16
mov dword [esp + 4], 0x6bf03330
mov dword [esp], 2
call sym._wine_dbg_log.constprop.2
jmp 0x6bf0136c

Function at 0x6bf01450
Capabilities:
Create thread

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
mov eax, 0x6bf06020
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push ecx
sub esp, 0x20
mov edx, dword [ecx]
mov ecx, dword [ecx + 4]
nop
cmp dword [eax], 0
je 0x6bf01490
add ebx, 1
add eax, 0xc
cmp ebx, 8
jne 0x6bf01470
lea esp, [ebp - 8]
xor eax, eax
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 8
movzx edx, dx
lea eax, [ebx + ebx*2]
imul edx, edx, 0x3e8
cmp edx, 0xd68c
jbe 0x6bf014e0
mov dword [eax*4 + 0x6bf06024], edx
lea eax, [ebx + ebx*2]
shl eax, 2
mov dword [eax + 0x6bf06028], edx
mov dword [eax + 0x6bf06020], ecx
mov eax, dword [0x6bf0600c]
add eax, 1
mov dword [0x6bf0600c], eax
cmp eax, 1
je 0x6bf014f2
lea esp, [ebp - 8]
lea eax, [ebx + 1]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 8
mov dword [eax*4 + 0x6bf06024], 0xd68d
mov edx, 0xd68d
jmp 0x6bf014ab
mov eax, dword [0x6bf06004]
test eax, eax
jne 0x6bf014cf
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym._SYSTEM_TimerThread_4
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateThread]
sub esp, 0x18
mov dword [0x6bf06004], eax
jmp 0x6bf014cf
Function at 0x6bf01540
Capabilities:
Terminate thread

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x1c
mov eax, dword [ecx]
lea edx, [eax - 1]
mov ebx, eax
cmp dx, 7
ja 0x6bf0158c
movzx eax, ax
lea eax, [eax + eax*2 - 3]
shl eax, 2
mov edx, dword [eax + 0x6bf06020]
test edx, edx
je 0x6bf0158c
sub dword [0x6bf0600c], 1
mov ebx, 0
mov dword [eax + 0x6bf06020], 0
je 0x6bf015a0
lea esp, [ebp - 0xc]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4
mov eax, dword [0x6bf06004]
test eax, eax
je 0x6bf0158c
mov eax, dword [0x6bf06008]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CancelWaitableTimer]
mov eax, dword [0x6bf06004]
sub esp, 4
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TerminateThread]
mov eax, dword [0x6bf06004]
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 8
mov dword [esp], eax
call esi
mov eax, dword [0x6bf06008]
sub esp, 4
mov dword [esp], eax
call esi
mov dword [0x6bf06004], 0
sub esp, 4
jmp 0x6bf0158c

Function at 0x6bf01700
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_strlen]
mov esi, eax
xor eax, eax
test esi, esi
je 0x6bf0175b
cmp byte [ebx + esi - 1], 0xa
je 0x6bf0172f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x6bf06104], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x6bf01d50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xf0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call dbg.__wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x6bf01f12
mov edx, dword fs:[0x18]
xor eax, eax
mov edi, dword [0x6bf06104]
cmp dword [edx + 0x24], edi
je 0x6bf01e38
test byte [0x6bf03348], 8
jne 0x6bf01ec0
lea ebx, [esp + 0x28]
mov edi, ebx
test byte [0x6bf03358], 8
jne 0x6bf01e81
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x6bf01dda
cmp esi, 3
jbe 0x6bf01e40
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x6bf01deb
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x6bf050f8]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.2
jmp 0x6bf01dda
mov dword [esp], 0x6bf03358
call dbg.__wine_dbg_get_channel_flags
test al, 8
je 0x6bf01db1
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x6bf01db1
mov dword [esp], 0x6bf03348
call dbg.__wine_dbg_get_channel_flags
test al, 8
je 0x6bf01d9e
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [esp + 0x28]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x6bf01da4
mov eax, 0xffffffff
jmp 0x6bf01e38
Function at 0x10058760
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x1005894d
pushal
mov esi, section.UPX1
lea edi, [esi - 0x47000]
push edi
or ebp, 0xffffffff
jmp 0x1005878a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10058791
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10058780
mov eax, 1
add ebx, ebx
jne 0x100587a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x100587b4
jne 0x100587d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100587d3
dec eax
add ebx, ebx
jne 0x100587c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x10058798
add ebx, ebx
jne 0x100587cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x10058825
xor ecx, ecx
sub eax, 3
jb 0x100587eb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1005885a
sar eax, 1
mov ebp, eax
jmp 0x100587f6
add ebx, ebx
jne 0x100587f6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100587c4
inc ecx
add ebx, ebx
jne 0x10058804
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100587c4
add ebx, ebx
jne 0x10058811
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10058806
jne 0x10058822
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10058806
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10058844
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10058836
jmp 0x10058786
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10058844
add edi, ecx
jmp 0x10058786
pop esi
mov edi, esi
mov ecx, 0x602
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10058862
cmp byte [edi], 0xa
jne 0x10058862
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x10058867
lea edi, [esi + 0x54000]
mov eax, dword [edi]
or eax, eax
je 0x100588df
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x58e70]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x58f24]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10058894
mov ecx, edi
jns 0x100588c3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x58f28]
or eax, eax
je 0x100588d9
mov dword [ebx], eax
add ebx, 4
jmp 0x100588b1
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x10058910
cmp al, 0xef
ja 0x10058903
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x100588e5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x100588f2
mov ebp, dword [esi + 0x58f2c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x10058944
sub esp, 0xffffff80
jmp 0x100230b4
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x403508
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x403517
pop dword [ebp - 0x28]
mov eax, 0x8f2f5260
sub eax, 0x8eef1d49
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xc3b604a3
add dword [ebp - 0x38], 0x8a9c40a8
mov dword [ebp - 0x34], 0xb46da7a5
sub dword [ebp - 0x34], 0x823a5b60
mov dword [ebp - 0x30], 0xf62832c1
sub dword [ebp - 0x30], 0xa9dbee93
mov dword [ebp - 0x2c], 0x6452303a
add dword [ebp - 0x2c], 0x9badcfc6
lea eax, [ebp - 0x38]
push eax
mov eax, 0x4e04ff95
add eax, 0xb23bd0b7
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x51472749
sub dword [ebp - 0x38], 0xdcd4bdf3
mov dword [ebp - 0x34], 0xb36aeeb0
add dword [ebp - 0x34], 0x8e0172c5
mov dword [ebp - 0x30], 0x37e681b5
sub dword [ebp - 0x30], 0xd4771549
mov dword [ebp - 0x2c], 0x29a198ab
add dword [ebp - 0x2c], 0xd65e6755
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x9e6bd3eb
add eax, 0x61d4fc5d
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x344e4
push 0
call eax
mov ecx, 0x5f01fdb6
add ecx, 0xa0fe3567
mov edx, eax
mov ebx, 0x41b000
add ebx, dword [ebp - 0x28]
mov edi, 0xa769e3e7
mov esi, dword [ebx]
add dword [ebp - 0x18], ecx
add esi, edi
mov dword [edx], esi
xor dword [ebp - 0x24], 0xc21f3ff3
add edx, 0xbf466047
sub edx, 0xbf466043
add ebx, 4
loop 0x40362d
add eax, 0x7f55b9f3
add eax, 0x80ab0554
mov ebx, eax
add eax, 0x2d9f4d0f
add eax, 0xd260b2f6
mov ecx, 0xcfda0325
sub ecx, 0xcf9a0325
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x660
cmp dword [esp + 0x668], 0
push esi
push edi
jne 0x40111e
lea edi, [esp + 0xc]
xor eax, eax
mov ecx, 0x11
push 0x104
rep stosd dword es:[edi], eax
mov word [esp + 0x40], 1
or dword [esp + 0x3c], 1
mov dword [esp + 0x10], 0x44
lea eax, [esp + 0x268]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x568]
lea eax, [esp + 0x468]
lea edx, [esp + 0x368]
push ecx
lea ecx, [esp + 0xc]
push eax
lea eax, [esp + 0x26c]
push edx
push ecx
push eax
call fcn.00401130
lea ecx, [esp + 0x37c]
lea edx, [esp + 0x1c]
lea eax, [esp + 0x74]
add esp, 0x14
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push str.orainst.exe
push ecx
push edx
push str._s_s_s
push eax
call esi
mov eax, dword [esp + 0x688]
add esp, 0x14
test eax, eax
je 0x4010c5
lea ecx, [esp + 0x164]
push eax
lea eax, [esp + 0x64]
push eax
push str._s__s
push ecx
call esi
add esp, 0x10
jmp 0x4010ed
lea edi, [esp + 0x60]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x164]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x50]
lea ecx, [esp + 0xc]
push eax
push ecx
lea edx, [esp + 0x16c]
push 0
push 0
push 0x200
push 0
push 0
push 0
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp ax, 1
sbb eax, eax
neg eax
pop edi
pop esi
add esp, 0x660
ret 0x10
Function at 0x401290
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push section..rdata
push 0x402304
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x405274], eax
xor eax, eax
mov al, byte [0x405275]
mov dword [0x405280], eax
mov eax, dword [0x405274]
shr dword [0x405274], 0x10
and eax, 0xff
mov dword [0x40527c], eax
shl eax, 8
add eax, dword [0x405280]
mov dword [0x405278], eax
call fcn.004022c0
test eax, eax
jne 0x401304
push 0x1c
call fcn.00401430
add esp, 4
mov dword [ebp - 4], 0
call fcn.004020e0
call fcn.004017b0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x406090], eax
call fcn.00401f50
mov dword [0x40503c], eax
test eax, eax
je 0x401337
cmp dword [0x406090], 0
jne 0x401341
push 0xffffffffffffffff
call fcn.004017f0
add esp, 4
call fcn.00401cd0
call fcn.00401be0
call fcn.004017c0
mov esi, dword [0x406090]
mov al, byte [esi]
cmp al, 0x22
je 0x401368
cmp al, 0x20
jbe 0x401395
inc esi
cmp byte [esi], 0x20
ja 0x401360
jmp 0x401395
inc esi
cmp byte [esi], 0x22
je 0x401394
mov bl, byte [ebp - 0x28]
mov bl, byte [esi]
test bl, bl
je 0x40138f
xor eax, eax
mov al, bl
push eax
call fcn.00401b80
add esp, 4
test eax, eax
je 0x401389
inc esi
inc esi
cmp byte [esi], 0x22
jne 0x401371
cmp byte [esi], 0x22
jne 0x401395
inc esi
cmp byte [esi], 0
je 0x4013a5
cmp byte [esi], 0x20
ja 0x4013a5
inc esi
cmp byte [esi], 0
jne 0x40139a
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x44], 1
mov eax, 0xa
je 0x4013c9
mov eax, dword [ebp - 0x40]
and eax, 0xffff
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.004017f0
jmp 0x40140a
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401830
Capabilities:
Terminate process

Disassembly:
cmp dword [0x4052b0], 1
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
jne 0x40184e
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x4052ac], 1
cmp dword [esp + 0x14], 0
mov ebx, dword [esp + 0x18]
mov byte [0x4052a8], bl
jne 0x4018a8
cmp dword [0x406088], 0
je 0x401896
mov edi, dword [0x406084]
sub edi, 4
cmp edi, dword [0x406088]
jb 0x401896
mov eax, dword [edi]
test eax, eax
je 0x40188b
call eax
sub edi, 4
cmp edi, dword [0x406088]
jae 0x401883
push 0x405014
push 0x405010
call fcn.004018e0
add esp, 8
push 0x40501c
push 0x405018
call fcn.004018e0
add esp, 8
test ebx, ebx
jne 0x4018cf
mov dword [0x4052b0], 1
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebx
ret