joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1053e058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1053e1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1053e07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1053e06a
add dl, dl
jne 0x1053e089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1053e0dc
xor eax, eax
add dl, dl
jne 0x1053e096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1053e17d
add dl, dl
jne 0x1053e0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1053e0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1053e0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1053e0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1053e0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1053e075
mov eax, 1
add dl, dl
jne 0x1053e0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1053e0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1053e0e1
sub eax, ebx
mov ebx, 1
jne 0x1053e128
mov ecx, 1
add dl, dl
jne 0x1053e10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1053e119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1053e105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1053e075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1053e13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1053e14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1053e136
cmp eax, 0x7d00
jae 0x1053e16d
cmp eax, 0x500
jb 0x1053e168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1053e075
cmp eax, 0x7f
ja 0x1053e170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1053e075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1053e19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1053e075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401237
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
and dword [ebp - 0x10], 0
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x10]
push edi
mov dword [ebp - 0x30], esi
mov eax, dword [esi + 4]
mov edi, dword [esi]
mov dword [ebp - 0x14], eax
mov eax, dword [0x41b2f8]
mov dword [ebp - 0x20], eax
mov eax, dword [0x41b2fc]
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x24], eax
call fcn.00401230
mov ebx, dword [ebp - 0x10]
mov ecx, dword [0x41b300]
add ebx, 0x23f
mov edx, dword [0x41b304]
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x18], 0x20
mov dword [ebp - 0x14], 2
add dword [ebp - 0x14], 3
mov eax, edi
mov dword [ebp - 0x10], 0xedeb2e40
shl eax, 4
add eax, ecx
cmp dword [0xae31cc], 0xfa9
mov dword [ebp - 4], eax
mov eax, dword [0xae31c8]
cmove eax, dword [ebp - 0x10]
and dword [ebp - 0x10], 0
cmp dword [0xae31cc], 0x3eb
mov dword [0xae31c8], eax
mov eax, dword [0xae3120]
cmove eax, dword [ebp - 0x10]
mov dword [0xae3120], eax
lea eax, [ebx + edi]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
shr eax, 5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
add dword [ebp - 8], edx
and dword [ebp - 0xc], 0
mov dword [0xae31c4], 0xf4ea3dee
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
xor dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
sub esi, eax
mov dword [ebp - 8], eax
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
lea eax, [ebx + esi]
mov edx, esi
lea ebx, [ebx + 0x61c88647]
shr edx, cl
add edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 8], edx
xor edx, eax
mov eax, dword [ebp - 4]
xor eax, edx
mov edx, dword [ebp - 0x2c]
sub edi, eax
mov dword [ebp - 4], eax
dec dword [ebp - 0x18]
mov dword [ebp - 0xc], edi
jne 0x401291
mov dword [ebp - 0x14], esi
mov esi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
mov dword [esi], edi
pop edi
mov dword [esi + 4], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d3fe
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41af20]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00409c0e
mov dword [ebp - 0x14], eax
cmp dword [0x43e9bc], esi
jne 0x40d4f1
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d47e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d5d1
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d5d1
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d5d1
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x43e9bc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x43e9c0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x43e9c4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43e9cc], eax
test eax, eax
je 0x40d4ee
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43e9c8], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d516
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d509
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d52b
push 4
pop eax
jmp 0x40d5d3
cmp dword [ebp - 0x14], esi
je 0x40d52b
push dword [0x43e9bc]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d510
mov eax, dword [0x43e9c8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d589
cmp dword [0x43e9cc], edi
je 0x40d589
push eax
call ebx
push dword [0x43e9cc]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d589
test eax, eax
je 0x40d589
call ecx
test eax, eax
je 0x40d57e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d57e
test byte [ebp - 8], 1
jne 0x40d589
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d5b9
mov eax, dword [0x43e9c0]
cmp eax, edi
je 0x40d5b6
push eax
call ebx
test eax, eax
je 0x40d5b6
call eax
mov esi, eax
test esi, esi
je 0x40d5b6
mov eax, dword [0x43e9c4]
cmp eax, edi
je 0x40d5b6
push eax
call ebx
test eax, eax
je 0x40d5b6
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x43e9bc]
call ebx
test eax, eax
je 0x40d5d1
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d5d3
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404247
mov esp, ebp
pop ebp
ret
Function at 0x101047c1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1027e290]
jne 0x101047cb
repz ret
jmp fcn.1010683f

Function at 0x10107fef
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.101048bc
and dword [ebp - 4], 0
cmp dword [0x1027fdc8], 0
mov ebx, eax
jne 0x101080a0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10108151
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10108151
push eax
call fcn.1010484a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1027fdc8], eax
call esi
push eax
call fcn.1010484a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1027fdcc], eax
call esi
push eax
call fcn.1010484a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1027fdd0], eax
call esi
push eax
call fcn.1010484a
pop ecx
mov dword [0x1027fdd8], eax
test eax, eax
je 0x101080a0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1010484a
pop ecx
mov dword [0x1027fdd4], eax
mov eax, dword [0x1027fdd4]
cmp eax, ebx
je 0x101080f8
cmp dword [0x1027fdd8], ebx
je 0x101080f8
push eax
call fcn.101048c5
push dword [0x1027fdd8]
mov esi, eax
call fcn.101048c5
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x101080f8
test edi, edi
je 0x101080f8
call esi
test eax, eax
je 0x101080ef
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x101080ef
test byte [ebp - 0xc], 1
jne 0x101080f8
or dword [ebp + 0x10], 0x200000
jmp 0x10108131
mov eax, dword [0x1027fdcc]
cmp eax, ebx
je 0x10108131
push eax
call fcn.101048c5
pop ecx
test eax, eax
je 0x10108131
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10108131
mov eax, dword [0x1027fdd0]
cmp eax, ebx
je 0x10108131
push eax
call fcn.101048c5
pop ecx
test eax, eax
je 0x10108131
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1027fdc8]
call fcn.101048c5
pop ecx
test eax, eax
je 0x10108151
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10108153
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10109bb0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x1027dd20], 0
mov byte [0x1027dd24], 0
mov dword [0x1027dd1c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x10109c1e
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [0x1027dd14]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
jmp 0x10109c50
mov eax, 0x1fdd
xor ecx, ecx
mov dword [0x1027dd1c], 0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
jmp 0x10109c50
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x1027dd14], 0x1fdd
mov eax, dword [0x1027dd1c]
add eax, 1
mov dword [0x1027dd1c], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x10109c1e
jmp 0x10109c05
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov edx, 0x100
mov dword [0x1027dd28], 0
mov dword [ebp - 0x2c], eax
xor esi, esi
mov dword [ebp - 0x30], edx
mov edx, esi
mov esi, dword [ebp - 0x10]
div esi
add ecx, 0xfffff6b9
mov edi, dword [0x1027dd20]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x2c]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x1027dd28], esi
mov dword [0x1027dd18], 0x1dfc
mov eax, esi
cdq
mov esi, dword [ebp - 0x30]
idiv esi
mov dword [0x1027dd20], edx
mov dword [0x1027dd14], ecx
mov ecx, dword [ebp - 0x2c]
mov cl, byte [ebx + ecx]
mov byte [0x1027dd24], cl
mov dword [0x1027dd18], 0xe30
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x2c]
mov byte [ebx + edx], cl
mov ecx, dword [0x1027dd18]
add ecx, 0xfffffd81
mov dword [0x1027dd14], ecx
mov cl, byte [0x1027dd24]
mov edx, dword [0x1027dd20]
mov byte [ebx + edx], cl
mov edx, dword [0x1027dd1c]
add edx, 1
mov dword [0x1027dd1c], edx
cmp edx, 0x100
mov dword [ebp - 0x20], edx
jl 0x10109bf5
jmp 0x10109bed
Function at 0x1010adb0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x1027dd14], 0x512
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
je 0x1010ae14
jmp 0x1010ae32
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x1010ae97
jmp 0x1010aeae
mov eax, dword [ebp - 0x18]
mov dword [0x1027dd18], 0x11c4
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x1c], eax
je 0x1010ae4b
jmp 0x1010aeae
mov eax, dword [ebp - 0x14]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], eax
jl 0x1010ade4
jmp 0x1010ae14
mov dword [0x1027dd18], 0x2624
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x1010aeae
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x1010aeae
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x1010aeae
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x1010adfc
jmp 0x1010aeae
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x20], eax
je 0x1010aebd
xor eax, eax
mov dword [0x1027dd18], 0x1864
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
add esp, 0x20
pop ebp
ret
Function at 0x1010b2b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x1027dd1c], 0
mov dword [0x1027dd20], 0
mov dword [0x1027dd2c], 0
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
je 0x1010b418
jmp 0x1010b31a
mov eax, dword [0x1027dd1c]
mov ecx, dword [0x1027dd20]
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
jmp 0x1010b32b
jmp 0x1010b418
xor eax, eax
mov ecx, eax
mov edx, eax
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x2c], eax
jmp 0x1010b32b
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
add edx, 1
mov edi, eax
add edi, 1
mov dword [0x1027dd14], 0x1e8a
mov dword [ebp - 0x30], eax
mov eax, edx
cdq
idiv esi
mov dword [0x1027dd1c], edx
mov ebx, dword [ebp - 0x1c]
movzx ebx, byte [ebx + edx]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x1027dd20], edx
mov dword [0x1027dd14], 0x40c5
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x1027dd24], cl
mov dword [0x1027dd18], 0x471
mov ebx, dword [ebp - 0x1c]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x1027dd24]
mov edx, dword [0x1027dd20]
mov byte [ebx + edx], cl
mov edx, dword [0x1027dd1c]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x1027dd20]
movzx ecx, byte [ebx + ecx]
add ecx, edx
and ecx, 0xff
mov dword [0x1027dd2c], ecx
mov dword [0x1027dd14], 0x1cd9
mov cl, byte [ebx + ecx]
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x30]
mov ch, byte [edx + esi]
mov dword [0x1027dd18], 0xbad
mov dword [0x1027dd14], 0x1439
xor ch, cl
mov edx, dword [ebp - 0x18]
mov byte [edx + esi], ch
mov edx, dword [ebp - 0x10]
cmp edi, edx
mov dword [ebp - 0x20], edi
je 0x1010b315
jmp 0x1010b2fc
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1010b420
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x98
lea eax, [esp + 0x28]
lea ecx, [esp + 0x38]
mov dword [0x1027dd14], 0x20bf
mov dword [esp], eax
mov dword [esp + 0x24], ecx
call fcn.10109d40
lea ecx, [0x10109ab0]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x5c], edx
mov dword [esp + 0x78], 0x15a600
mov edx, dword [0x1027dd00]
mov dword [esp + 0x80], edx
mov edx, dword [0x1027dd04]
mov dword [esp + 0x90], edx
mov edx, dword [0x1027dd08]
mov dword [esp + 0x94], edx
mov edx, dword [0x1027dd0c]
mov dword [esp + 0x7c], edx
mov edx, dword [0x1027dd10]
mov dword [esp + 0x88], edx
mov dword [0x1027dd14], 0x212d
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
jmp 0x1010b537
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x50], eax
mov dword [0x1027dd18], 0x1fcc
mov eax, dword [eax + ecx + 0x50]
mov dword [esp + 0x74], eax
call fcn.1010adb0
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x10], ecx
je 0x1010b501
jmp 0x1010b55a
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
je 0x1010b4b5
jmp 0x1010b546
lea eax, [esp + 0x38]
mov ecx, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.1010a6c0
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [0x1027dd14], 0x1ed4
mov dword [esp + 0x10], eax
jmp 0x1010b55a
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0xc], eax
je 0x1010b4e7
mov eax, dword [esp + 0xc]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x1c], eax
jmp 0x1010b537
mov eax, dword [esp + 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x407e6b
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp + 8]
cmp eax, dword [ebp - 4]
jb 0x407e8f
jmp 0x407e99
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x407e7f
mov esp, ebp
pop ebp
ret

Function at 0x409105
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x409125
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040bc66
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x409146
test byte [esp + 8], 2
je 0x409146
mov dword [0x413cec], 0xd
mov dword [0x413cf0], 5
jmp 0x409121
xor eax, eax
ret

Function at 0x40b575
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4118b0
cmp edx, dword [eax]
je 0x40b597
add eax, 8
inc ecx
cmp eax, 0x411940
jl 0x40b588
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4118b0]
jne 0x40b6c5
mov eax, dword [0x413d40]
cmp eax, 1
je 0x40b69f
test eax, eax
jne 0x40b5c8
cmp dword [0x411338], 1
je 0x40b69f
cmp edx, 0xfc
je 0x40b6c5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40b5ff
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00407ff0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00408140
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40b642
lea eax, [ebp - 0x1a4]
push eax
call fcn.00408140
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4104ec
push edi
call fcn.00408b70
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00407ff0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00408000
lea eax, [ebp - 0xa0]
push 0x4104cc
push eax
call fcn.00408000
push dword [esi + 0x4118b4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00408000
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040e045
add esp, 0x2c
pop edi
jmp 0x40b6c5
lea eax, [ebp + 8]
lea esi, [esi + 0x4118b4]
push 0
push eax
push dword [esi]
call fcn.00408140
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x401d46
Capabilities:
Encode data using xor

Disassembly:
mov ebp, edi
jmp 0x401cce
bswap ebp
cmp esi, 0xe0bd5b01
test dl, 0x3e
jae 0x401ce6
cmp edi, 0xf4cf0ecc
mov ebx, 0x92dcedee
mov eax, 0xcda
xchg edi, edx
xor eax, 0xcda
cmp esi, 0x93cc
js 0x401d00
movzx edx, dl
mov dh, 0xd0
sub eax, 0x9f8c
jo 0x401d0d
or ebx, 0x9454d15f
add eax, 0x90d7
sub ecx, eax
imul edi, edi
sub ecx, 0x337e
cmp ecx, ebp
js 0x401d25
mov ch, 0x2f
sub edi, edx
call 0x401d46
inc ecx
xchg ebp, edi
imul ecx, edi
mov ebp, 0x76e10263
mov edx, ebp
cmp ebp, edx
jne 0x401d3d
mov ch, dl
cmp eax, 0x5740878a
mov esi, edx
test bl, ah
pop ebx
test dh, dh
imul edi, edi
mov edx, ecx
mov ebp, 0x9b4e
xor ebp, 0x5c6b
sbb dh, al
xor ebp, 0x5d5c
sub edx, 0xf2570a72
test bh, bl
imul ecx, esi, 0xa59fe06f
mov ebp, 0xfffaa78e
jmp 0x401d78
xor ebp, 0xbead
add ebp, 0x5ef83
jne 0x401d88
bswap edi
mov eax, esi
sub ebp, 0xfffff955
neg ecx
sub ebp, 0x6ac
mov dl, 0xc5
test edi, 0x92dc7b9a
cmp ebp, 0xb0
jae 0x401d84
movd mm2, ebx
jmp 0x401db0
dec ch
imul edi, ebx, 0xb268d8a
push 0x428d9
pop ebp
movsx esi, dl
sub ebp, 0x41be7
xchg ah, cl
cmp eax, 0x75273ac3
cmp bh, bl
mov edi, 0x803956cc
mov edx, 0xfffff97c
sub edx, 0x495
test ebx, edi
sub ebp, edx
test ah, cl
sub ebp, 0xb1a
xor eax, 0x996d165c
test bl, ah
cmp ebp, 0x115
jae 0x401dc7
movd esi, mm2
ja 0x401e08
imul ebx, eax, 0xe0b18928
mov bl, dh
cmp edx, 0x48f4
ja 0x401e12
inc eax
mov edx, 0x2a83f
imul ecx, eax, 0xdb55bc4e
sub edx, 0xfd6
bswap eax
xadd esi, edx
or eax, edi
sub esi, 0x14db
imul ebp, eax
push 0x8ecfd1
test esi, 0x1025b9c6
bswap edx
xchg bl, dh
movsx edi, dx
cmp ebp, ebp
test ecx, 0x25154c28
cmp edx, esi
jbe 0x401e53
add edi, eax
imul edi, ebx
push ecx
push edi
mov bl, 0xbe
push esi
dec eax
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x72e55b41
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x7b673de1
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219