joyce8/EMBER2024-capa huggingface dataset:
Function at 0x484eb8
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
mov byte [ebp - 1], 0
mov ebx, 0x14
mov dword [ebp - 0x1c], 0x14
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x34], 2
mov eax, 0x484f80
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 3
mov eax, 0x484f84
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 1
push 0x484f80
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x484f77
xor eax, eax
push ebp
push 0x484f70
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x1c]
push eax
push 0x4b
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
push 0
push 0
push 0x25
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484f77
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
mov al, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4851f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
xor edx, edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x485404
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 0x105
mov eax, dword [ebp - 0x18]
call fcn.004027b8
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x48526e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
test eax, eax
je 0x485258
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 8]
call fcn.00404394
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x485275
mov eax, dword [ebp - 8]
call fcn.004027d8
ret

Function at 0x4867d0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov bl, 2
lea eax, [ebp - 0xa]
xor ecx, ecx
mov edx, 0xa
call fcn.00402d98
push 0xa
lea eax, [ebp - 0xa]
push eax
push 0xd
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
je 0x48680a
cmp byte [ebp - 0xa], 0x31
jne 0x486808
mov bl, 1
jmp 0x48680a
xor ebx, ebx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x487f30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.004486b8
test al, al
je 0x487fee
mov byte [ebp - 9], 0
xor ebx, ebx
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 8], eax
jmp 0x487fcc
cmp word [esi + 0x5f2], 0
je 0x487f81
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 9]
push eax
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [esi + 0x5f4]
call dword [esi + 0x5f0]
mov al, byte [esi + 0x5e8]
or al, byte [ebp - 9]
jne 0x487fa3
cmp dword [ebp - 4], 0
jbe 0x487f9f
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
ja 0x487fa3
xor ebx, ebx
jmp 0x487fa5
mov bl, 1
test bl, bl
jne 0x487fee
mov eax, dword [0x4a7894]
mov eax, dword [eax]
cmp byte [eax + 0x9c], 0
jne 0x487fee
mov eax, dword [0x4a7894]
mov eax, dword [eax]
call fcn.004617c0
push 1
call sub.kernel32.dll_Sleep_1
test esi, esi
je 0x487fee
cmp byte [esi + 0x588], 0
jne 0x487fee
mov edx, 0xfffffdf3
mov eax, esi
call fcn.00466ff8
cmp eax, 4
jne 0x487f5e
mov byte [esi + 0x5e8], 0
test bl, bl
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48af64
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x48af9c]
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x48af7a
or bl, 1
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x48af89
or bl, 4
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x48af98
or bl, 2
mov eax, ebx
pop ebx
ret

Function at 0x48c338
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4a7894]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x48c35e
push 0
mov eax, dword [0x4a7894]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x48e9e8
Capabilities:
Suspend thread

Disassembly:
mov byte [eax + 0xd], 1
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_SuspendThread
ret

Function at 0x48e9f8
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jne 0x48ea0d
mov byte [ebx + 0xd], 0
pop ebx
ret

Function at 0x48eb10
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov ebx, eax
push 0
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov eax, ebx
call fcn.0048ea7c
mov esi, eax
mov eax, ebx
call fcn.004033a8
mov eax, esi
pop esi
pop ebx
ret
Function at 0x4958ac
Capabilities:
Link many functions at runtime

Disassembly:
mov byte [0x4a7330], 0
mov eax, dword [0x4a7afc]
cmp dword [eax], 2
jne 0x495a85
mov eax, dword [0x4a7618]
cmp dword [eax], 5
jl 0x495a85
call fcn.00492a48
test al, al
jne 0x4958dd
call fcn.00492a54
call fcn.00492a40
mov dword [0x4a7338], eax
push 0x495a88
mov eax, dword [0x4a7338]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a72fc], eax
cmp dword [0x4a72fc], 0
jne 0x495938
mov edx, 0x8000
mov eax, 0x495a9c
call fcn.0040e464
mov dword [0x4a7334], eax
mov eax, dword [0x4a7334]
mov dword [0x4a7338], eax
push 0x495a88
mov eax, dword [0x4a7338]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a72fc], eax
cmp dword [0x4a72fc], 0
je 0x495a80
push 0x495aa8
mov eax, dword [0x4a7338]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a7300], eax
cmp dword [0x4a7300], 0
je 0x495a80
push 0x495ab4
mov eax, dword [0x4a7338]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a7304], eax
cmp dword [0x4a7304], 0
je 0x495a80
mov byte [0x4a7330], 1
push 0x495ac4
mov eax, dword [0x4a7338]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a7308], eax
push 0x495ad0
mov eax, dword [0x4a7338]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a730c], eax
push 0x495adc
mov eax, dword [0x4a7338]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a7310], eax
push 0x495aec
mov eax, dword [0x4a7338]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a7314], eax
push 0x495afc
mov eax, dword [0x4a7338]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a7318], eax
mov edx, 0x8000
mov eax, 0x495b14
call fcn.0040e464
mov dword [0x4a733c], eax
cmp dword [0x4a733c], 0
je 0x495a85
push 0x495b24
mov eax, dword [0x4a733c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a731c], eax
push 0x495b40
mov eax, dword [0x4a733c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a7320], eax
push 0x495b60
mov eax, dword [0x4a733c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a7324], eax
push 0x495b7c
mov eax, dword [0x4a733c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a7328], eax
push 0x495b94
mov eax, dword [0x4a733c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4a732c], eax
ret
call fcn.0049582c
ret
Function at 0x4981b8
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4982e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.004980a4
mov eax, dword [esi]
call fcn.00405280
add eax, 0x28
push eax
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x49051c]
call fcn.0040543c
add esp, 4
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x1c]
mov ecx, 0x1c
call fcn.004029c0
mov ebx, 0x1c
mov eax, dword [ebp - 8]
lea edx, [eax + ebx]
lea eax, [ebp - 0x2c]
mov ecx, 0x1c
call fcn.004029c0
add ebx, 0x1c
mov eax, dword [esi]
call fcn.00405280
mov dword [ebp - 0xc], eax
mov eax, dword [0x4a7a0c]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 8]
mov ecx, ebx
call fcn.004911f8
add ebx, 4
mov eax, dword [ebp - 8]
add eax, ebx
xor ecx, ecx
mov edx, 3
call fcn.00402d98
add ebx, 3
mov eax, dword [ebp - 8]
mov byte [eax + ebx], 0x3a
inc ebx
mov eax, dword [esi]
mov byte [eax + 2], 0
mov eax, dword [esi]
mov byte [eax + 3], 0
push ebx
mov eax, dword [esi]
call fcn.00405280
push eax
lea ecx, [ebp - 8]
mov eax, dword [esi]
xor edx, edx
call fcn.00491128
mov edx, dword [ebp - 8]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x94]
mov ebx, eax
mov eax, ebx
call fcn.00491110
mov edx, esi
mov ecx, dword [ebp + 0x10]
call fcn.004911f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4982e7
lea eax, [ebp - 8]
mov edx, dword [0x49051c]
call fcn.00405448
ret
Function at 0x49fcf4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040464c
lea esi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x49fe73
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x49fe43
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov ebx, eax
mov dword [esi], 0x128
push esi
push ebx
call sub.kernel32.dll_Process32First
jmp 0x49fe31
lea eax, [ebp - 0x138]
lea edx, [esi + 0x24]
mov ecx, 0x104
call fcn.0040440c
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.00408de4
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.0049eed0
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.0049eed0
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.004045a8
je 0x49fe15
lea eax, [ebp - 0x144]
lea edx, [esi + 0x24]
mov ecx, 0x104
call fcn.0040440c
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.0049eed0
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.0049eed0
mov edx, dword [ebp - 0x148]
pop eax
call fcn.004045a8
jne 0x49fe2a
push 0
mov eax, dword [esi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
push esi
push ebx
call sub.kernel32.dll_Process32Next
test eax, eax
jne 0x49fd76
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49fe4d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49fe7a
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.004041c0
lea eax, [ebp - 4]
call fcn.0040419c
ret
Function at 0x49fe84
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov eax, dword [ebp - 4]
call fcn.0040464c
mov eax, dword [ebp + 8]
call fcn.0040464c
xor eax, eax
push ebp
push 0x4a00aa
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4a0082
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov ebx, eax
mov dword [ebp - 0x12c], 0x128
lea eax, [ebp - 0x12c]
push eax
push ebx
call sub.kernel32.dll_Process32First
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x4a006a
cmp esi, dword [ebp - 0x124]
jne 0x4a0057
call fcn.0040a9d0
add esp, 0xfffffff8
fstp qword [esp]
wait
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0048c494
cmp eax, 0x1f4
jge 0x4a0072
cmp byte [0x4a8ec0], 1
jne 0x49ff3b
cmp eax, 0x1f4
jge 0x49ff4d
mov edx, 0x1f4
sub edx, eax
push edx
call sub.kernel32.dll_Sleep_1
jmp 0x49ff4d
cmp eax, 0xa
jge 0x49ff4d
mov edx, 0xa
sub edx, eax
push edx
call sub.kernel32.dll_Sleep_1
mov eax, dword [ebp + 8]
mov edx, 0x4a00c4
call fcn.004045a8
jne 0x49ff66
mov eax, dword [ebp + 8]
call fcn.0049fcf4
jmp 0x49ff7e
push 0
mov eax, dword [ebp - 0x124]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
push 0x1f4
call sub.kernel32.dll_Sleep_1
mov eax, dword [ebp + 8]
mov edx, 0x4a00dc
call fcn.004045a8
je 0x49ffa6
mov eax, dword [ebp + 8]
mov edx, 0x4a00f4
call fcn.004045a8
jne 0x49ffcf
push 1
push 0
mov eax, dword [0x4a8ecc]
call fcn.0040465c
push eax
mov eax, dword [ebp - 4]
call fcn.0040465c
push eax
push 0x4a0108
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x4a0072
mov eax, dword [ebp + 8]
mov edx, 0x4a0118
call fcn.004045a8
je 0x4a000b
mov eax, dword [ebp + 8]
mov edx, 0x4a0134
call fcn.004045a8
je 0x4a000b
mov eax, dword [ebp + 8]
mov edx, 0x4a0148
call fcn.004045a8
je 0x4a000b
mov eax, dword [ebp + 8]
mov edx, 0x4a015c
call fcn.004045a8
jne 0x4a0031
push 1
push 0
mov eax, dword [0x4a8ec8]
call fcn.0040465c
push eax
mov eax, dword [ebp - 4]
call fcn.0040465c
push eax
push 0x4a0108
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x4a0072
push 1
push 0
mov eax, dword [0x4a8ec4]
call fcn.0040465c
push eax
mov eax, dword [ebp - 4]
call fcn.0040465c
push eax
push 0x4a0108
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x4a0072
lea eax, [ebp - 0x12c]
push eax
push ebx
call sub.kernel32.dll_Process32Next
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x49feee
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a008c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a00b1
lea eax, [ebp - 4]
call fcn.0040419c
lea eax, [ebp + 8]
call fcn.0040419c
ret
Function at 0x3000f50a
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
call fcn.301df000
jmp 0x3000f50a
push 0x60
push 0x3000f668
call fcn.30012fb4
and dword [ebp - 4], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov edi, 0x94
push edi
push 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x3001d288
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push esi
push 0
test eax, eax
je 0x3001d295
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x28], eax
mov edi, dword [esi + 0xc]
and edi, 0x7fff
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebp - 0x20]
cmp esi, 2
jne 0x3001d2a3
mov ecx, dword [ebp - 0x24]
mov eax, ecx
shl eax, 8
mov edx, dword [ebp - 0x28]
add eax, edx
mov dword [0x3004f6d4], esi
mov dword [0x3004f6dc], eax
mov dword [0x3004f6e0], ecx
mov dword [0x3004f6e4], edx
mov dword [0x3004f6d8], edi
call fcn.300012b8
mov dword [ebp - 0x20], eax
xor ebx, ebx
inc ebx
push ebx
call fcn.300039f6
pop ecx
test eax, eax
je 0x3001d2ae
call fcn.30003498
test eax, eax
je 0x3001d2bb
call fcn.30001357
mov dword [ebp - 4], ebx
call fcn.30003087
test eax, eax
jl 0x3001d2c8
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x3004fc60], eax
call fcn.30003c5a
mov dword [0x3004f6c8], eax
call fcn.30002e1f
test eax, eax
jl 0x3001d2d5
call fcn.30003194
test eax, eax
jl 0x3001d2e2
push ebx
call fcn.30008eb5
pop ecx
test eax, eax
jne 0x3001d2ef
call fcn.300049e2
test byte [ebp - 0x44], bl
je 0x3000f663
movzx ecx, word [ebp - 0x40]
push ecx
push eax
push 0
push 0x30000000
call main
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], 0
jne 0x3001d2fb
push eax
call fcn.3000d18e
push 0xa
pop ecx
jmp 0x3000f642
push 0x12
call fcn.30027bb8
pop ecx
jmp 0x3001d34a
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x3001d34a
or edi, 0x8000
jmp 0x3000f590
push 0x1c
call fcn.30027bb8
pop ecx
jmp 0x3000f5d4
push 0x10
call fcn.30027bb8
pop ecx
jmp 0x3000f5e1
push 0x1b
call fcn.3002862c
pop ecx
jmp 0x3000f5f6
push 8
call fcn.3002862c
pop ecx
jmp 0x3000f618
push 9
call fcn.3002862c
pop ecx
jmp 0x3000f625
push eax
call fcn.3002862c
pop ecx
jmp 0x3000f634
call fcn.30028661
jmp 0x3001d330
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1c]
jmp 0x3001d34f
mov eax, 0xff
call fcn.30013054
ret

Function at 0x3000fbbb
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push esi
push edi
mov edi, ecx
call fcn.3001164b
mov esi, dword [ebp + 0xc]
cmp esi, eax
ja 0x300161e4
mov ecx, edi
call fcn.3001164b
mov ecx, dword [ebp + 0x10]
lea edx, [esi + ecx]
cmp edx, eax
ja 0x300161e4
mov eax, dword [edi + 8]
push ecx
mov ecx, dword [ebp + 8]
lea eax, [eax + esi*2]
push eax
call fcn.30012d0c
pop edi
pop esi
leave
ret 0xc
xor eax, eax
push 0x43
pop ecx
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x30017c9c
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x300190b0
call fcn.30017e54
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x300200e8
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x30017a3b
cmp eax, esi
jne 0x30017a2e
xor esi, esi
inc esi
mov ebx, esi
jmp 0x30017a3e
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x30017a15
xor esi, esi
inc esi
mov eax, dword [0x300200e4]
cmp eax, esi
jne 0x30017a51
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x30017a80
mov eax, dword [0x300200e4]
test eax, eax
jne 0x30017a7a
mov dword [0x300200e4], esi
push 0x30001534
push 0x30001528
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x30017a80
jmp 0x30017ba8
mov dword [0x3001fd94], esi
mov eax, dword [0x300200e4]
cmp eax, esi
jne 0x30017aa4
push 0x30001524
push 0x300014e4
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x300200e4], 2
test ebx, ebx
jne 0x30017ab0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x300200f4], 0
je 0x30017ad4
push 0x300200f4
call fcn.30018076
pop ecx
test eax, eax
je 0x30017ad4
push 0
push 2
push 0
call dword [0x300200f4]
mov eax, dword [sym.imp.MSVCR80.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x30017b30
test al, al
je 0x30017aee
cmp dword [ebp - 0x1c], 0
jne 0x30017b30
mov al, byte [esi]
test al, al
je 0x30017afe
cmp al, 0x20
ja 0x30017afe
inc esi
mov dword [ebp - 0x20], esi
jmp 0x30017aee
test byte [ebp - 0x3c], 1
je 0x30017b0a
movzx eax, word [ebp - 0x38]
jmp 0x30017b0d
push 0xa
pop eax
push eax
push esi
push 0
push 0x30000000
call main
mov dword [0x3001fd90], eax
cmp dword [0x3001fd84], 0
jne 0x30017b84
push eax
call dword [sym.imp.MSVCR80.dll_exit]
cmp al, 0x22
jne 0x30017b3f
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR80.dll__ismbblead]
pop ecx
test eax, eax
je 0x30017b52
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x30017adb
cmp dword [0x3001fd94], 0
jne 0x30017b93
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x3001fd90]
jmp 0x30017bb4
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.30017e99
ret
call 0x3019e000
jmp 0x300179db
Function at 0x457c2d
Capabilities:
Encode data using xor

Disassembly:
aaa
test al, 0x46
or al, 0x57
test eax, 0x24b816ed
or al, 0xaa
adc dword [edi + eax*4], eax
and bh, byte [eax]
sbb byte [ebx + 0x51b3138e], cl
test eax, 0x3801e405
imul ebp, dword [ecx - 0x43c263ca], 0x74c9654d
or eax, 0xde4187de
xchg dword [ecx - 0x22], eax
jmp 0x457ca9
xchg edx, eax
movsd dword es:[edi], dword [esi]
add byte [ebp - 0x23e6e9a7], cl
jo 0x457c55
cli
out 0x15, al
cmp al, byte [edx]
xor ebp, edi
adc eax, 0xef33023a
out 0xff, al
adc dword [ecx + 0x14], esi
mov edx, dword [eax + 0x14]
mov dword [eax + 0x14], esi
sbb byte [ecx + 0x10181651], cl
test eax, 0x18d4a036
mov eax, 0xc6442281
push cs
pop ss
mov al, byte [0xa2a567ec]
shl dword [esi + ebp - 0x33d16af4], 0xc
xchg edx, eax
and ebp, dword [ecx - 2]
add dword [ebp + 0xc], 0x24
add edi, 0xffffffea
or al, 0xf2
movsd dword es:[edi], dword [esi]
xor bl, ah
js 0x457cb5
bound edx, qword gs:[eax]
xor cl, ch
adc dl, byte [esi + 0x55]
pop eax
in eax, dx
lahf
lodsb al, byte [esi]
inc ebx
push ebx
push ebp
mov al, byte [0xa0bd0026]
pop ecx
mov edx, dword ss:[ecx - 0x77]
nop
rol ch, 0x57
aaa
ljmp 0xae9d

Function at 0x4586f9
Capabilities:
Encode data using xor

Disassembly:
js 0x45874e
imul ebx, dword [edx + 0x1e3e58e7], 0x392e3a5e
stc
jnp 0x458742
add ecx, dword [ebx + 0x647a39cb]
nop
lahf
jl 0x45878e
cmp dword [ebx + 8], eax
mov ecx, ebx
cmp dword [ebp + 0xfb9a4c1], esp
inc edi
or esi, dword [eax + 0x24]
popfd
and eax, 0xf93ee2ba
dec edi
xchg ebp, eax
inc ebx
enter 0x4f79, 4
cmp dword [ecx], edi
dec edi
push edi
in al, 0xf
stc
invalid
cmp byte [edi + 0x38], 0xc0
aad 0x80
jnp 0x458782
push ebx
cmp dword [ecx], ebx
cmp ecx, ebx
cmp byte [eax], bh
cmp byte [edx + 0x32], dh
fnstcw word [eax]
cmp byte [eax], bh
jb 0x458786
dec ecx
in eax, 0xc1
bound edi, qword [ecx]
cmp byte [eax], bh
salc
int3
add dword [ecx], edi
in al, 0
mov ebx, esi
pop eax
cmp byte [esi], ah
add bh, byte [ebx - 0x659deef8]
adc dword [edx - 0x66], esp
sidt [esi]
imul edi, dword [ebx + 0xa], 0xd
mov byte [0x8d1043c6], al
pop edi
dec edi
xor byte [esi + 0x5f3ab50], ah
add eax, 0x255a8235
or eax, 0x5c944c90
cmp dword [ecx], edi
jae 0x458788
add eax, 0x38f53c1d
cmp ecx, ebx
add eax, 0x7cc33960
cmp byte [ecx], bh
fld dword [0x7cc33960]
adc edi, ebp
cmp al, 0x22
sub bh, bh
psubb mm3, qword [ecx - 0x77]
jge 0x4587b8
mov dword [ebp - 0x18], edi
test edi, edi
adc eax, esp
ret
Function at 0x45af27
Capabilities:
Encode data using xor

Disassembly:
add ah, bh
mov dl, 0xd6
sbb byte [0x83aeb1c], bl
add bl, byte [0x19d82e41]
stosb byte es:[edi], al
mov dword [0x645a456a], eax
nop
adc byte [esp + ebx*4], dl
mov eax, 0xc4f0df43
mov ah, 0xd5
cmp dword [edi], 0x32
pop ecx
lcall 0x2df0, 0x3a1b2629
mov bl, 0x8d
aas
adc al, 0xf4
cmp dword [esi], eax
invalid
push 0x20
js 0x45af81
and ecx, dword [ebp - 0x15]
dec ebp
sub byte [edi + 0x14], ch
or cl, ah
sbb byte [edx - 0x2fcb95f6], bl
dec dl
adc ah, dl
xor byte [edx + edx*8 + 0x5c96281d], cl
stosb byte es:[edi], al
ror byte [eax], cl
pop ds
bound esi, qword [0xbbb4ec0]
jnp 0x45aed6
inc edi
cwde
je 0x45af71
inc eax
salc
inc eax
invalid
and al, 0x84
cmc
sbb eax, 0xc7ddc680
mov ebx, 0x9ebc48b
push edi
xor dword [eax - 0x5b], edx
movsd dword es:[edi], dword [esi]
mov edi, 0x98d207dd
push edi
cdq
inc ecx
sub byte [ebp - 0x3feb8f8f], al
fcom dword [edx]
call 0xd8ba96fb
ret