joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a410
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x118
push ebx
push ebp
push esi
lea eax, [esp + 0x10]
push edi
push eax
mov dword [esp + 0x18], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov esi, dword [esp + 0x12c]
mov ecx, dword [sym.imp.USER32.dll_DefWindowProcA]
xor edi, edi
or ebx, 0xffffffff
mov dword [esi + 4], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x20], ecx
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
push str.user32.dll
mov ebp, eax
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
mov word [esi + 0x80], di
mov dword [esi + 0x88], edi
mov dword [esi + 0x8c], edi
mov dword [esi + 0x90], edi
mov dword [esi + 0x94], edi
mov dword [esi + 0x98], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 0xa8], edi
mov dword [esi + 0xac], edi
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xb0], ebx
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xcc], edi
mov dword [esi + 0xd0], edi
mov dword [esi + 0xd4], edi
mov dword [esi + 0xd8], edi
mov dword [esi + 0xdc], edi
mov dword [esi + 0xe0], edi
mov dword [esi + 0x114], edi
mov dword [esi + 0x118], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea edx, [esp + 0x10]
mov ebx, eax
push edx
push ebp
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push str.GetGestureInfo
push ebx
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp ebp, edi
mov dword [esi + 0x11c], eax
je 0x44a55c
mov eax, dword [0x652d44]
push 0x652a78
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CloseGestureInfoHandle
push ebx
call edi
push str.SetGestureConfig
push ebx
mov dword [esi + 0x120], eax
call edi
mov cl, byte [esp + 0x1c]
mov dword [esi + 0x124], eax
mov byte [esi + 0x128], cl
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
invalid
les ebx, [eax]
add dword [eax], eax

Function at 0x48f56f
Capabilities:
Encode data using xor

Disassembly:
clc
sub edi, dword [ecx - 0x3a57175f]
cwde
in al, 0x78
xor dword [ebx - 0x52], edi
sbb eax, 0xd9af0fe6
seto al
scasd eax, dword es:[edi]
adc al, 0x79
jg 0x48f53b
retf 0xc5c0
push es
mov dl, 0xec
sbb bh, ah
aas
mov byte [0xc54f8415], cl
adc eax, 0x1c54f84
out dx, al
rcr byte [esi + ebx*2], 0xd8
cmp dword [ecx + 0x70], 0x9bd9bd0c
leave
jge 0x48f533
push ebx
inc esi
aam 0xa4
Function at 0x60174f
Capabilities:
Encode data using xor

Disassembly:
imul edi, dword [esi + ecx*8 + 5], 0xc2c2b3ce
jae 0x601769
scasb al, byte es:[edi]
or eax, 0xcf493e0b
push edi
jb 0x60176d
stosb byte es:[edi], al
mov ecx, 0xaff428fd
in eax, dx
push edx
sub eax, 0xd8bc0c8c
sub al, 0x28
sub byte [ebp + ebp - 0x27e5fa7c], dl
xchg byte [edx], dh
out 0xf8, eax
fstp xword [ecx + 0x1d]
inc eax
push ss
scasb al, byte es:[edi]
xor dword [edi*4 + 0x6026c2cb], ebx
cdq
sub dword [eax + 0x429ed5cb], edx
nop
retf
inc edx
sbb byte [eax + 0xd3d70ac], dh
pop esi
jnp 0x60172d
pop esi
cmp al, 0xc9
xchg ecx, eax
invalid

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x53392d4b
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x633037b1
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x7860da
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
jmp 0xc15ace
jmp 0xca0683
lea esp, [esp + 4]
je 0x7d442c
push ebx
movzx ebx, byte [eax]
xor ebx, edx
push 0xd387732d
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x88d200]
push 0x87b31683
shr edx, 8
xor edx, ebx
inc eax
xor edx, 0x853a9e09
dec ecx
lea esp, [esp + 8]
jne 0xc15ad9
call fcn.007d4424
mov eax, dword [edi]
mov edx, 0xbf8fcd11
mov edx, dword [edi + 4]
call fcn.00898ce3
ficom dword [ecx + edx*8]
pop ss
pop edx
cwde
imul edx, dword [ebp + 0x2c8a9711], 0xffffffc1
sbb esp, eax
push 2
mov al, 0xe1
aas
pop edx
mov al, 0xdb
adc dword [ecx - 0x6e13c5c5], edi
aas
push 0xd19c2a92
add esp, dword [edx - 0xc]
loope 0xc15b4a
dec edi
xchg edi, eax
fdiv st(4), st(0)
cld
adc ebx, dword [eax + ebx]
adc dword [ecx - 0x191d4f9c], 0xffffffff
or eax, 0xe6e2b064
invalid
mov al, 0xe2
out 0xff, al
cld
or ecx, dword [edx - 0x11def53d]
aaa
adc eax, 0xac5c527b
push 0x7e189f62
cmpsd dword [esi], dword es:[edi]
xor cl, 0x11
stosb byte es:[edi], al
inc edi
aam 0xae
adc dword [edx - 0x512b9ab9], ebp
adc al, 0xcc
jo 0xc15b6c
pop edx
stosd dword es:[edi], eax
pop ds
pop ecx
scasb al, byte es:[edi]
adc eax, 0xdd7ac2c4
jne 0xc15b51
mov dh, 0xdb
jbe 0xc15b4b
imul byte [edi]
loopne 0xc15b53
daa
invalid
push 0xda19323f
not edx
call fcn.00c7985a
Function at 0x7cd052
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not edx
mov dword [ebp], edx
call fcn.007eb3e5

Function at 0x86e142
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp + ebx*4]
mov dword [esp], 0xf31ece1e
not dword [esp]
mov dword [esp], eax
jmp 0xc00ecf
call 0x79daec

Function at 0x89da3b
Capabilities:
Encode data using xor

Disassembly:
not eax
mov dword [edi], eax
jmp 0xc67a23
mov dword [esp], edi
movzx edi, byte [ecx]
push 0xa354d9b
xor edi, eax
sal word [esp + 2], 0xa1
and edi, 0xff
ror dword [esp], 0xab
mov edi, dword [edi*4 + 0x89a0c8]
shr eax, 8
xor eax, edi
inc ecx
xor eax, 0xb7a5e88b
dec ebp
push 0xf709540c
lea esp, [esp + 8]
jne 0x89da3e
mov edi, 0x48abda37
pop edi
jmp 0x898d04
push 0xe99bddac
lea esp, [esp + 4]
jmp fcn.00c0c428

Function at 0xc96f30
Capabilities:
Encode data using xor

Disassembly:
dec edx
shl dword [esp + ebx*8 - 0x7f7fff8], 0xcb
inc eax
neg ch
inc eax
inc ch
inc ecx
inc bl
inc eax
xor ch, 0x1a
call fcn.00830410
call fcn.00c9e63a
xor eax, 0xd00c5da
invalid

Function at 0xcc047b
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
ret
je 0xc00eda
mov eax, 0x5a4d
clc
jmp 0xc491d8
mov eax, dword [edx + 0x3c]
cmp dl, 0xbc
clc
lea eax, [eax + edx]
clc
cmp dword [eax], 0x4550
jmp 0x89c004
pop esi
jmp 0x84ecef
dec edi
test dx, bp
lea eax, [eax + edx]
cmp dl, 0x9d
cmc
sub ebx, ebx
cmp dl, 0x2e
mov dword [ebp - 0xc], eax
clc
stc
test edi, edi
jmp 0x781402
mov esp, ebp
pop ebp
jmp 0x7c051f
je 0x85051a
mov eax, dword [ecx + edx + 0x20]
jmp 0x7e5bb6
mov edi, dword [ecx + edx + 0x18]
cmp dx, 0x1ba4
test edi, edi
jmp 0x85be8e
jne 0xc00eda
mov ecx, dword [eax + 0x78]
test edi, 0x4402983c
mov dword [ebp - 4], ecx
cmp si, 0x44b5
test ecx, ecx
jmp 0x8d5834
mov dword [ebp - 8], 0xffffffff
cmp esi, 0xffff
jmp 0xbcbb64
je 0xc00eda
mov eax, dword [eax + 0x7c]
test esi, ebx
push ebx
stc
push edi
jmp 0xc5991d
ja 0x85e7fd
mov eax, esi
sub eax, dword [ecx + edx + 0x10]
jmp 0xc5ba69
je 0x7cd05d
sub eax, eax
jmp 0x7e089f
je 0xc00eda
mov esi, dword [ebp + 0xc]
test esi, esi
jmp 0x7c9e2d
cmp word [edx], ax
jmp 0xc00ed4
mov dword [ebp - 0x10], eax
jmp 0x89e11c
jmp 0x85050d
push ebp
btr bp, dx
test dx, 0x1d1b
mov ebp, esp
cmovnp edx, eax
mov edx, dword [ebp + 8]
sub esp, 0x114
push esi
test ax, 0x551f
stc
test edx, edx
jmp 0xc1bf06
Function at 0xcc04a0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov esi, dword [ebp]
mov dword [esp], 0xab08a7
mov cl, byte [ebp + 4]
rol dword [esp], 0xed
add ebp, 2
sal esi, cl
not word [esp]
call fcn.007927d5
mov edx, 0x21a58daf
mov ebp, dword [esi + edx - 0x21a58daf]
lea edi, [edx + edx - 0x36d5635d]
push ecx
jb 0xcc0528
fimul word [ebp - 0x635ced44]
sub cl, cl
lea edi, [edi + edx*2 + 0x1632d90f]
call fcn.008294f9
add byte [eax], al
or esi, 0x1c
imul edx, dword [0xaf1e1bfe], 0x398712af
lahf
adc eax, 0x710a9af0
outsb dx, byte [esi]
or al, 0x3a
jbe 0xcc0515
mov dh, 0x6b
jg 0xcc0480
and byte [ebx + 0x78], bl
div dword [ecx + 0x2767c746]
daa
jbe 0xcc04cb
adc byte [ebp + 0xb89c927], bl
pop ss
into
invalid
sub byte [edx - 0x524dc1a0], 0x17
mov dl, 0xad
pop ss
test bl, ah
movsb byte es:[edi], byte [esi]
mov ss, word [edx]
shl dword [ebx - 0x54211807], cl
je 0xcc059a
jno 0xcc0518
out dx, al
lodsb al, byte [esi]
add ecx, ebx
mov edi, 0x8f5d9aa5
mov byte [0xc61afeed], al
jae 0xcc05a1
sub al, cl
add al, 0xd2
jnp 0xcc0507
popfd
inc esp
dec ebx
iretd
ret
int 0xc2
das
inc ch
dec edi
mov ecx, 0x338c2ce
lahf
retf
Function at 0x40dd55
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x415884]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0xffff
push esi
test ecx, ecx
je 0x40dd76
cmp ecx, 1
jne 0x40dd78
mov ecx, eax
cmp ecx, eax
je 0x40dd89
cmp ecx, 2
je 0x40dd89
test edx, 0x2000000
je 0x40ddab
xor esi, esi
mov dword [ebp - 0x38], 1
push esi
push 0x30
lea eax, [ebp - 0x38]
mov dword [ebp - 0x30], ecx
push eax
push 0x1f
mov dword [ebp - 0x2c], esi
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jns 0x40ddaf
xor al, al
jmp 0x40de16
push 0x403fe8
call dword [sym.imp.msvcrt.dll_wprintf]
pop ecx
mov ecx, dword [esi + section..data]
mov eax, ecx
shr eax, 0x1d
mov eax, dword [ebp + eax*4 - 0x28]
and eax, ecx
test eax, 0x1fffffff
je 0x40ddfd
push 0x401100
push dword [esi + 0x415008]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x40ddfd
push dword [esi + 0x415008]
push 0x40401c
call dword [sym.imp.msvcrt.dll_wprintf]
pop ecx
pop ecx
add esi, 0xc
cmp esi, 0x408
jb 0x40ddbb
push 0x403d74
call dword [sym.imp.msvcrt.dll_wprintf]
pop ecx
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00413fa0
leave
ret

Function at 0x40dfc0
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], 0x18
xor ebx, ebx
mov esi, ebx
test edi, edi
je 0x40dfe0
cmp edi, 1
jne 0x40dfe5
mov edi, 0xffff
test esi, esi
je 0x40dff1
push esi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x40e065
push 4
pop eax
mov dword [esi], eax
mov dword [esi + 4], eax
lea eax, [ebp - 4]
push eax
mov dword [esi + 8], edi
mov dword [esi + 0xc], ebx
push dword [ebp - 4]
push esi
push 0x1f
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000023
je 0x40dfe5
test eax, eax
js 0x40e05d
push ebx
lea eax, [ebp - 8]
push eax
push 0xf
push 1
lea eax, [esi + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_ConvertSecurityDescriptorToStringSecurityDescriptorW]
mov bl, al
cmp bl, 1
jne 0x40e05d
push dword [ebp - 8]
push 0x40407c
call dword [sym.imp.msvcrt.dll_wprintf]
pop ecx
pop ecx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x40e06c
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], 0x18
push edi
mov edi, ecx
xor esi, esi
inc ebx
test edi, edi
je 0x40e08d
cmp edi, ebx
jne 0x40e092
mov edi, 0xffff
test esi, esi
je 0x40e09e
push esi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x40e17c
and dword [esi + 0xc], 0
lea eax, [ebp - 4]
push eax
mov dword [esi], 6
mov dword [esi + 8], edi
push dword [ebp - 4]
push esi
push 0x1f
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000023
je 0x40e092
test eax, eax
jns 0x40e0e1
xor bl, bl
jmp 0x40e172
mov edi, dword [ebp - 4]
lea edi, [edi - 0x10]
shr edi, 2
test edi, edi
je 0x40e0da
push 0x4040b8
call dword [sym.imp.msvcrt.dll_wprintf]
pop ecx
test edi, edi
je 0x40e166
lea eax, [esi + 0x10]
mov dword [ebp - 0xc], eax
mov edx, dword [eax]
xor ecx, ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], ecx
movzx eax, word [ecx*8 + 0x415410]
cmp edx, eax
je 0x40e128
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x8a
jb 0x40e10e
jmp 0x40e142
push dword [ecx*8 + 0x415414]
push 0x40401c
call dword [sym.imp.msvcrt.dll_wprintf]
mov edx, dword [ebp - 0x10]
pop ecx
pop ecx
mov ecx, dword [ebp - 8]
cmp ecx, 0x8a
jne 0x40e158
push edx
push 0x4040ec
call dword [sym.imp.msvcrt.dll_wprintf]
pop ecx
pop ecx
mov eax, dword [ebp - 0xc]
add eax, 4
mov dword [ebp - 0xc], eax
sub edi, 1
jne 0x40e104
push 0x403d74
call dword [sym.imp.msvcrt.dll_wprintf]
pop ecx
push esi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
jmp 0x40e17e
xor bl, bl
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x40ea9e
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc18
mov eax, dword [0x415884]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x400
xor ebx, ebx
lea eax, [ebp - 0xc04]
push eax
push ebx
mov dword [ebp - 0xc14], ebx
mov dword [ebp - 0xc18], ebx
mov dword [ebp - 0xc10], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0xc08], eax
test eax, eax
je 0x40ec78
push edi
lea eax, [ebp - 0xc08]
push eax
lea eax, [ebp - 0xc04]
push eax
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeExW]
mov edi, eax
mov dword [ebp - 0xc08], edi
test edi, edi
je 0x40ec77
push esi
push edi
call dword [sym.imp.msvcrt.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x40ec76
push esi
push edi
push ebx
lea eax, [ebp - 0xc04]
push eax
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoExW]
test eax, eax
je 0x40ec6e
lea eax, [ebp - 0xc08]
mov dword [ebp - 0xc0c], ebx
push eax
lea eax, [ebp - 0xc0c]
push eax
push 0x404e18
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
mov ecx, dword [ebp - 0xc0c]
test ecx, ecx
je 0x40ec33
movzx eax, word [ecx + 2]
mov ebx, 0x404e6c
push 0x404e4c
push eax
movzx eax, word [ecx]
mov edi, 0x200
push eax
push ebx
lea eax, [ebp - 0x404]
push edi
push eax
call dword [sym.imp.msvcrt.dll_swprintf_s]
add esp, 0x18
lea eax, [ebp - 0xc08]
push eax
lea eax, [ebp - 0xc14]
push eax
lea eax, [ebp - 0x404]
push eax
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
mov ecx, dword [ebp - 0xc0c]
push 0x404ea8
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
push ebx
lea eax, [ebp - 0x404]
push edi
push eax
call dword [sym.imp.msvcrt.dll_swprintf_s]
add esp, 0x18
lea eax, [ebp - 0xc08]
push eax
lea eax, [ebp - 0xc18]
push eax
lea eax, [ebp - 0x404]
push eax
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
mov ecx, dword [ebp - 0xc0c]
push 0x404ecc
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
push ebx
lea eax, [ebp - 0x404]
push edi
push eax
call dword [sym.imp.msvcrt.dll_swprintf_s]
add esp, 0x18
lea eax, [ebp - 0xc08]
push eax
lea eax, [ebp - 0xc10]
push eax
lea eax, [ebp - 0x404]
push eax
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
cmp dword [ebp - 0xc18], 0
je 0x40ec6e
cmp dword [ebp - 0xc14], 0
je 0x40ec6e
cmp dword [ebp - 0xc10], 0
je 0x40ec6e
push dword [ebp - 0xc10]
push dword [ebp - 0xc14]
push dword [ebp - 0xc18]
push 0x404eec
call dword [sym.imp.msvcrt.dll_wprintf]
add esp, 0x10
push esi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00413fa0
leave
ret
Function at 0x41360e
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
push 0x40
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x28]
pop edx
mov eax, dword [ecx + 0x2c]
xor eax, dword [ecx + 0x18]
xor eax, dword [ecx - 8]
xor eax, dword [ecx]
lea ecx, [ecx + 4]
rol eax, 1
mov dword [ecx + 0x34], eax
sub edx, 1
jne 0x413624
mov ecx, dword [esi + 0x1c]
mov eax, dword [esi + 0xc]
mov ebx, dword [esi + 0x10]
mov edi, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
mov dword [ebp - 8], ecx
lea ecx, [esi + 0x20]
mov dword [ebp - 0x1c], eax
mov esi, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], 0x14
mov edx, eax
mov ecx, ebx
not ecx
rol edx, 5
and ecx, esi
mov eax, edi
and eax, ebx
or ecx, eax
mov eax, dword [ebp - 8]
add edx, ecx
mov dword [ebp - 8], esi
mov ecx, dword [ebp - 0x14]
mov esi, edi
add eax, 0x5a827999
mov edi, ebx
mov ebx, dword [ebp - 0xc]
ror edi, 2
add edx, dword [ecx]
add ecx, 4
add eax, edx
mov dword [ebp - 0x14], ecx
sub dword [ebp - 0x18], 1
mov dword [ebp - 0xc], eax
jne 0x413663
mov ecx, dword [ebp - 0x10]
mov edx, esi
add ecx, 0x70
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], 0x14
mov esi, ecx
mov ecx, eax
mov eax, edx
xor eax, edi
rol ecx, 5
xor eax, ebx
add ecx, eax
mov eax, dword [ebp - 8]
add ecx, dword [esi]
add eax, 0x6ed9eba1
mov dword [ebp - 8], edx
lea esi, [esi + 4]
mov edx, edi
add eax, ecx
mov edi, ebx
mov ebx, dword [ebp - 0xc]
ror edi, 2
sub dword [ebp - 0x18], 1
mov dword [ebp - 0xc], eax
jne 0x4136b5
mov ecx, dword [ebp - 0x10]
mov esi, edx
add ecx, 0xc0
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], 0x14
mov edx, eax
mov ecx, edi
or ecx, ebx
rol edx, 5
add edx, dword [ebp - 8]
mov eax, edi
and eax, ebx
mov dword [ebp - 8], esi
and ecx, esi
mov esi, edi
or ecx, eax
mov edi, ebx
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x14], 4
mov ebx, dword [ebp - 0xc]
ror edi, 2
add ecx, dword [eax]
lea eax, [edx - 0x70e44324]
add eax, ecx
sub dword [ebp - 0x18], 1
mov dword [ebp - 0xc], eax
jne 0x4136ff
mov ecx, dword [ebp - 0x10]
mov edx, esi
add ecx, 0x110
mov dword [ebp - 4], esi
push 0x14
mov dword [ebp - 0x14], ecx
pop esi
mov ecx, eax
mov eax, edx
mov edx, dword [ebp - 0x14]
xor eax, edi
add dword [ebp - 0x14], 4
xor eax, ebx
add eax, dword [ebp - 8]
rol ecx, 5
add ecx, 0xca62c1d6
add ecx, dword [edx]
mov edx, edi
add eax, ecx
mov edi, ebx
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 0xc]
ror edi, 2
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
sub esi, 1
jne 0x41374e
mov esi, dword [ebp - 0x10]
add eax, dword [ebp - 0x1c]
add dword [esi + 0x10], ebx
add dword [esi + 0x14], edi
add dword [esi + 0x18], edx
add dword [esi + 0x1c], ecx
add dword [esi], 0x200
pop edi
adc dword [esi + 4], 0
and dword [esi + 8], 0
mov dword [esi + 0xc], eax
pop esi
pop ebx
leave
ret
Function at 0x4139a3
Capabilities:
Terminate process

Disassembly:
push 0xc
push 0x4142b0
call fcn.00413ef8
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x416688
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x4139e8
cmp eax, esi
jne 0x4139db
xor esi, esi
inc esi
mov edi, esi
jmp 0x4139eb
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4139bf
xor esi, esi
inc esi
cmp dword [0x41668c], esi
jne 0x4139fd
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x413a37
cmp dword [0x41668c], ebx
jne 0x413a31
mov dword [0x41668c], esi
push 0x4010cc
push 0x4010c0
call fcn.00413b1c
pop ecx
pop ecx
test eax, eax
je 0x413a37
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x413b0c
mov dword [0x415894], esi
cmp dword [0x41668c], esi
jne 0x413a5a
push 0x4010bc
push 0x4010b4
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x41668c], 2
test edi, edi
jne 0x413a67
xor eax, eax
mov ecx, 0x416688
xchg dword [ecx], eax
cmp dword [0x416690], 0
je 0x413a93
push 0x416690
call fcn.00413d50
pop ecx
test eax, eax
je 0x413a93
push ebx
push 2
push ebx
mov esi, dword [0x416690]
mov ecx, esi
call dword [0x4171a0]
call esi
push dword [0x4158a0]
push dword [0x41589c]
push dword [0x415898]
call fcn.0040fe42
add esp, 0xc
mov dword [0x415890], eax
cmp dword [0x4158a8], 0
jne 0x413af1
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
push ecx
push eax
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x415894], 0
jne 0x413b05
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x415890]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
call fcn.004a7000
jmp 0x4139a3

Function at 0x413c34
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x4142d0
call fcn.00413ef8
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x413c94
cmp eax, 0xffffffff
je 0x413c94
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x413c8d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x413c8d
cmp edx, 0x10000000
jae 0x413c8d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x413c8a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x413d00
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x413d3e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x413d36
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x413d40
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x413d26
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x413e10
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x413e41
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x413e41
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x413e41
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret