joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4491e4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
cmp dword [0x460b10], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x44929c
cmp byte [0x44c059], 0
je 0x449256
push 0x50
lea eax, [ebp - 0x54]
push eax
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x54]
push edx
call fcn.004412e8
add esp, 8
mov ebx, eax
test eax, eax
jne 0x44923f
push 0x3a
lea edx, [ebp - 0x54]
push edx
call fcn.004412e8
add esp, 8
mov ebx, eax
test eax, eax
jne 0x44923f
lea ebx, [ebp - 0x54]
jmp 0x449240
inc ebx
call fcn.0044919c
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.dll_MessageBoxA
jmp 0x4492bd
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x460b14
push ebx
call sub.KERNEL32.dll_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00441094
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.dll_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x460b17
push ebx
call sub.KERNEL32.dll_WriteFile
jmp 0x4492bd
cmp dword [0x460b10], 0xffffffff
je 0x4492bd
mov eax, dword [0x460b10]
test eax, eax
je 0x4492bd
cmp byte [eax], 0
je 0x4492bd
push esi
push eax
call fcn.0044934c
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1ae17e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x1ae1805
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x1ae1878
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x1ae183a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x1ae186d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x1ae186b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x1ae1831
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x1ae17fc
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x40a4f7
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
push edx
jmp 0x40a504
call 0x40a510
add byte [eax + eax*2 + 0x34], cl
aas
cmp eax, 0x4c48346
pop edx
mov edx, dword [ebp - 0x2ec]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x238], ecx
cmp dword [ebp - 0x238], 0
jne 0x40a56d
push esi
xor esi, 0x5f80
call 0x40a543
add byte [esi + 0x48], cl
aas
dec ebx
dec esi
cmp byte ds:[ebx - 0x97efb3c], al
hlt
mov edx, dword [ebp - 0x238]
mov dword [ebp - 0xa0], edx
push esi
xor esi, 0xc1c3
sub esi, 0x13355
call 0x40a593
add byte [0x4a484747], dh
cmp al, byte [edi - 0x7d]
les eax, [ecx + eax*4]
invalid

Function at 0x40a510
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
push edx
jmp 0x40a504
call 0x40a510
add byte [eax + eax*2 + 0x34], cl
aas
cmp eax, 0x4c48346
pop edx
mov edx, dword [ebp - 0x2ec]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x238], ecx
cmp dword [ebp - 0x238], 0
jne 0x40a56d
push esi
xor esi, 0x5f80
call 0x40a543
add byte [esi + 0x48], cl
aas
dec ebx
dec esi
cmp byte ds:[ebx - 0x97efb3c], al
hlt
mov edx, dword [ebp - 0x238]
mov dword [ebp - 0xa0], edx
push esi
xor esi, 0xc1c3
sub esi, 0x13355
call 0x40a593
add byte [0x4a484747], dh
cmp al, byte [edi - 0x7d]
les eax, [ecx + eax*4]
invalid

Function at 0x40a543
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
push edx
jmp 0x40a504
call 0x40a510
add byte [eax + eax*2 + 0x34], cl
aas
cmp eax, 0x4c48346
pop edx
mov edx, dword [ebp - 0x2ec]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x238], ecx
cmp dword [ebp - 0x238], 0
jne 0x40a56d
push esi
xor esi, 0x5f80
call 0x40a543
add byte [esi + 0x48], cl
aas
dec ebx
dec esi
cmp byte ds:[ebx - 0x97efb3c], al
hlt
mov edx, dword [ebp - 0x238]
mov dword [ebp - 0xa0], edx
push esi
xor esi, 0xc1c3
sub esi, 0x13355
call 0x40a593
add byte [0x4a484747], dh
cmp al, byte [edi - 0x7d]
les eax, [ecx + eax*4]
invalid

Function at 0x40a593
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
push edx
jmp 0x40a504
call 0x40a510
add byte [eax + eax*2 + 0x34], cl
aas
cmp eax, 0x4c48346
pop edx
mov edx, dword [ebp - 0x2ec]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x238], ecx
cmp dword [ebp - 0x238], 0
jne 0x40a56d
push esi
xor esi, 0x5f80
call 0x40a543
add byte [esi + 0x48], cl
aas
dec ebx
dec esi
cmp byte ds:[ebx - 0x97efb3c], al
hlt
mov edx, dword [ebp - 0x238]
mov dword [ebp - 0xa0], edx
push esi
xor esi, 0xc1c3
sub esi, 0x13355
call 0x40a593
add byte [0x4a484747], dh
cmp al, byte [edi - 0x7d]
les eax, [ecx + eax*4]
invalid
Function at 0x40a5dd
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add edx, 0xa845
pop edx
push edx
and edx, 0x62b6
jmp 0x40a5f7
pop edx
xor eax, eax
mov word [ebp - 0x60], ax
xor ecx, ecx
mov word [ebp - 0x14], cx
push eax
push edi
add esp, 4
add eax, 0xba01
pop eax
push ebx
add ebx, 0x5ff4
pop ebx
push edx
push edx
add esp, 4
and edx, 0x5e5b
sub edx, 0x4c91
xor edx, 0x6fe0
xor edx, 0x3e79
pop edx
mov edx, dword [ebp - 0x230]
mov ax, word [edx]
mov word [ebp - 0x1ca], ax
mov ecx, dword [ebp - 0x230]
add ecx, 2
mov dword [ebp - 0x230], ecx
mov dx, word [ebp - 0x1ca]
mov word [ebp - 0x60], dx
push edi
sub edi, 0x630
or edi, 0x5e3c
and edi, 0x9e3a
add edi, 0xac85
pop edi
push eax
jmp 0x40a682
jmp 0x40a68b
sub eax, 0xb229
pop eax
mov eax, dword [ebp - 0x234]
mov cx, word [eax]
mov word [ebp - 0x1cc], cx
mov edx, dword [ebp - 0x234]
add edx, 2
mov dword [ebp - 0x234], edx
mov ax, word [ebp - 0x1cc]
mov word [ebp - 0x14], ax
push esi
call 0x40a6cd
add byte [ebx], dh
xor eax, dword [ebp + 0x4f]
inc eax
cmp byte [ecx + 0x49], al
inc edx
push eax
add esp, 4
pop esi
push esi
push edx
add esp, 4
jmp 0x40a6db
add esi, 0x6fe9
xor esi, 0x1812c
sub esi, 0x7e0c
pop esi
movzx ecx, word [ebp - 0x14]
test ecx, ecx
jne 0x40a70b
movzx edx, word [ebp - 0x60]
movzx eax, word [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x2f4], edx
jmp 0x40a78e
movzx ecx, word [ebp - 0x60]
movzx edx, word [ebp - 0x14]
cmp ecx, edx
je 0x40a604
movzx eax, word [ebp - 0x60]
xor eax, 0x20
movzx ecx, word [ebp - 0x14]
cmp eax, ecx
je 0x40a604
push edi
push esi
add esp, 4
call 0x40a741
add byte [edx + 0x45], al
inc esp
inc ecx
dec esi
cmp byte [eax + 0x37], dl
add esp, 4
pop edi
push eax
add eax, 0x155b5
call 0x40a75c
add byte [edi + 0x3e], cl
xor cl, byte [ebp + 0x4e]
xor eax, 0x49474c38
add esp, 4
pop eax
movzx edx, word [ebp - 0x60]
movzx eax, word [ebp - 0x14]
cmp edx, eax
jge 0x40a778
mov dword [ebp - 0x2f0], 0xffffffff
jmp 0x40a782
mov dword [ebp - 0x2f0], 1
mov ecx, dword [ebp - 0x2f0]
mov dword [ebp - 0x2f4], ecx
cmp dword [ebp - 0x2f4], 0
jne 0x40a7d7
push ecx
add ecx, 0x1797f
xor ecx, 0x1c68
sub ecx, 0x108c6
and ecx, 0xb9df
pop ecx
push esi
or esi, 0xba35
or esi, 0x1e90
pop esi
push esi
jmp 0x40a7c8
pop esi
mov edx, dword [ebp - 0xa0]
mov dword [ebp - 0x70], edx
jmp 0x40a86e
mov eax, dword [ebp - 0xa0]
mov ecx, dword [eax]
mov dword [ebp - 0xa0], ecx
push ebx
and ebx, 0x6f09
pop ebx
push ecx
add ecx, 0x12f19
sub ecx, 0x6785
jmp 0x40a802
pop ecx
push ecx
xor ecx, 0x21c0
add ecx, 0x10c84
and ecx, 0x4708
pop ecx
mov edx, dword [ebp - 0xa0]
cmp edx, dword [ebp - 0x238]
je 0x40a835
mov eax, dword [ebp - 0xa0]
cmp dword [eax + 0x30], 0
jne 0x40a579
push edi
push edx
add esp, 4
xor edi, 0x16603
pop edi
push edi
push edi
add esp, 4
or edi, 0x47ed
or edi, 0x654a
pop edi
push eax
and eax, 0x17edf
or eax, 0x178d6
and eax, 0xdfe7
pop eax
mov dword [ebp - 0x70], 0
Function at 0x40a6cd
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add edx, 0xa845
pop edx
push edx
and edx, 0x62b6
jmp 0x40a5f7
pop edx
xor eax, eax
mov word [ebp - 0x60], ax
xor ecx, ecx
mov word [ebp - 0x14], cx
push eax
push edi
add esp, 4
add eax, 0xba01
pop eax
push ebx
add ebx, 0x5ff4
pop ebx
push edx
push edx
add esp, 4
and edx, 0x5e5b
sub edx, 0x4c91
xor edx, 0x6fe0
xor edx, 0x3e79
pop edx
mov edx, dword [ebp - 0x230]
mov ax, word [edx]
mov word [ebp - 0x1ca], ax
mov ecx, dword [ebp - 0x230]
add ecx, 2
mov dword [ebp - 0x230], ecx
mov dx, word [ebp - 0x1ca]
mov word [ebp - 0x60], dx
push edi
sub edi, 0x630
or edi, 0x5e3c
and edi, 0x9e3a
add edi, 0xac85
pop edi
push eax
jmp 0x40a682
jmp 0x40a68b
sub eax, 0xb229
pop eax
mov eax, dword [ebp - 0x234]
mov cx, word [eax]
mov word [ebp - 0x1cc], cx
mov edx, dword [ebp - 0x234]
add edx, 2
mov dword [ebp - 0x234], edx
mov ax, word [ebp - 0x1cc]
mov word [ebp - 0x14], ax
push esi
call 0x40a6cd
add byte [ebx], dh
xor eax, dword [ebp + 0x4f]
inc eax
cmp byte [ecx + 0x49], al
inc edx
push eax
add esp, 4
pop esi
push esi
push edx
add esp, 4
jmp 0x40a6db
add esi, 0x6fe9
xor esi, 0x1812c
sub esi, 0x7e0c
pop esi
movzx ecx, word [ebp - 0x14]
test ecx, ecx
jne 0x40a70b
movzx edx, word [ebp - 0x60]
movzx eax, word [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x2f4], edx
jmp 0x40a78e
movzx ecx, word [ebp - 0x60]
movzx edx, word [ebp - 0x14]
cmp ecx, edx
je 0x40a604
movzx eax, word [ebp - 0x60]
xor eax, 0x20
movzx ecx, word [ebp - 0x14]
cmp eax, ecx
je 0x40a604
push edi
push esi
add esp, 4
call 0x40a741
add byte [edx + 0x45], al
inc esp
inc ecx
dec esi
cmp byte [eax + 0x37], dl
add esp, 4
pop edi
push eax
add eax, 0x155b5
call 0x40a75c
add byte [edi + 0x3e], cl
xor cl, byte [ebp + 0x4e]
xor eax, 0x49474c38
add esp, 4
pop eax
movzx edx, word [ebp - 0x60]
movzx eax, word [ebp - 0x14]
cmp edx, eax
jge 0x40a778
mov dword [ebp - 0x2f0], 0xffffffff
jmp 0x40a782
mov dword [ebp - 0x2f0], 1
mov ecx, dword [ebp - 0x2f0]
mov dword [ebp - 0x2f4], ecx
cmp dword [ebp - 0x2f4], 0
jne 0x40a7d7
push ecx
add ecx, 0x1797f
xor ecx, 0x1c68
sub ecx, 0x108c6
and ecx, 0xb9df
pop ecx
push esi
or esi, 0xba35
or esi, 0x1e90
pop esi
push esi
jmp 0x40a7c8
pop esi
mov edx, dword [ebp - 0xa0]
mov dword [ebp - 0x70], edx
jmp 0x40a86e
mov eax, dword [ebp - 0xa0]
mov ecx, dword [eax]
mov dword [ebp - 0xa0], ecx
push ebx
and ebx, 0x6f09
pop ebx
push ecx
add ecx, 0x12f19
sub ecx, 0x6785
jmp 0x40a802
pop ecx
push ecx
xor ecx, 0x21c0
add ecx, 0x10c84
and ecx, 0x4708
pop ecx
mov edx, dword [ebp - 0xa0]
cmp edx, dword [ebp - 0x238]
je 0x40a835
mov eax, dword [ebp - 0xa0]
cmp dword [eax + 0x30], 0
jne 0x40a579
push edi
push edx
add esp, 4
xor edi, 0x16603
pop edi
push edi
push edi
add esp, 4
or edi, 0x47ed
or edi, 0x654a
pop edi
push eax
and eax, 0x17edf
or eax, 0x178d6
and eax, 0xdfe7
pop eax
mov dword [ebp - 0x70], 0
Function at 0x40a741
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add edx, 0xa845
pop edx
push edx
and edx, 0x62b6
jmp 0x40a5f7
pop edx
xor eax, eax
mov word [ebp - 0x60], ax
xor ecx, ecx
mov word [ebp - 0x14], cx
push eax
push edi
add esp, 4
add eax, 0xba01
pop eax
push ebx
add ebx, 0x5ff4
pop ebx
push edx
push edx
add esp, 4
and edx, 0x5e5b
sub edx, 0x4c91
xor edx, 0x6fe0
xor edx, 0x3e79
pop edx
mov edx, dword [ebp - 0x230]
mov ax, word [edx]
mov word [ebp - 0x1ca], ax
mov ecx, dword [ebp - 0x230]
add ecx, 2
mov dword [ebp - 0x230], ecx
mov dx, word [ebp - 0x1ca]
mov word [ebp - 0x60], dx
push edi
sub edi, 0x630
or edi, 0x5e3c
and edi, 0x9e3a
add edi, 0xac85
pop edi
push eax
jmp 0x40a682
jmp 0x40a68b
sub eax, 0xb229
pop eax
mov eax, dword [ebp - 0x234]
mov cx, word [eax]
mov word [ebp - 0x1cc], cx
mov edx, dword [ebp - 0x234]
add edx, 2
mov dword [ebp - 0x234], edx
mov ax, word [ebp - 0x1cc]
mov word [ebp - 0x14], ax
push esi
call 0x40a6cd
add byte [ebx], dh
xor eax, dword [ebp + 0x4f]
inc eax
cmp byte [ecx + 0x49], al
inc edx
push eax
add esp, 4
pop esi
push esi
push edx
add esp, 4
jmp 0x40a6db
add esi, 0x6fe9
xor esi, 0x1812c
sub esi, 0x7e0c
pop esi
movzx ecx, word [ebp - 0x14]
test ecx, ecx
jne 0x40a70b
movzx edx, word [ebp - 0x60]
movzx eax, word [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x2f4], edx
jmp 0x40a78e
movzx ecx, word [ebp - 0x60]
movzx edx, word [ebp - 0x14]
cmp ecx, edx
je 0x40a604
movzx eax, word [ebp - 0x60]
xor eax, 0x20
movzx ecx, word [ebp - 0x14]
cmp eax, ecx
je 0x40a604
push edi
push esi
add esp, 4
call 0x40a741
add byte [edx + 0x45], al
inc esp
inc ecx
dec esi
cmp byte [eax + 0x37], dl
add esp, 4
pop edi
push eax
add eax, 0x155b5
call 0x40a75c
add byte [edi + 0x3e], cl
xor cl, byte [ebp + 0x4e]
xor eax, 0x49474c38
add esp, 4
pop eax
movzx edx, word [ebp - 0x60]
movzx eax, word [ebp - 0x14]
cmp edx, eax
jge 0x40a778
mov dword [ebp - 0x2f0], 0xffffffff
jmp 0x40a782
mov dword [ebp - 0x2f0], 1
mov ecx, dword [ebp - 0x2f0]
mov dword [ebp - 0x2f4], ecx
cmp dword [ebp - 0x2f4], 0
jne 0x40a7d7
push ecx
add ecx, 0x1797f
xor ecx, 0x1c68
sub ecx, 0x108c6
and ecx, 0xb9df
pop ecx
push esi
or esi, 0xba35
or esi, 0x1e90
pop esi
push esi
jmp 0x40a7c8
pop esi
mov edx, dword [ebp - 0xa0]
mov dword [ebp - 0x70], edx
jmp 0x40a86e
mov eax, dword [ebp - 0xa0]
mov ecx, dword [eax]
mov dword [ebp - 0xa0], ecx
push ebx
and ebx, 0x6f09
pop ebx
push ecx
add ecx, 0x12f19
sub ecx, 0x6785
jmp 0x40a802
pop ecx
push ecx
xor ecx, 0x21c0
add ecx, 0x10c84
and ecx, 0x4708
pop ecx
mov edx, dword [ebp - 0xa0]
cmp edx, dword [ebp - 0x238]
je 0x40a835
mov eax, dword [ebp - 0xa0]
cmp dword [eax + 0x30], 0
jne 0x40a579
push edi
push edx
add esp, 4
xor edi, 0x16603
pop edi
push edi
push edi
add esp, 4
or edi, 0x47ed
or edi, 0x654a
pop edi
push eax
and eax, 0x17edf
or eax, 0x178d6
and eax, 0xdfe7
pop eax
mov dword [ebp - 0x70], 0
Function at 0x40a75c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add edx, 0xa845
pop edx
push edx
and edx, 0x62b6
jmp 0x40a5f7
pop edx
xor eax, eax
mov word [ebp - 0x60], ax
xor ecx, ecx
mov word [ebp - 0x14], cx
push eax
push edi
add esp, 4
add eax, 0xba01
pop eax
push ebx
add ebx, 0x5ff4
pop ebx
push edx
push edx
add esp, 4
and edx, 0x5e5b
sub edx, 0x4c91
xor edx, 0x6fe0
xor edx, 0x3e79
pop edx
mov edx, dword [ebp - 0x230]
mov ax, word [edx]
mov word [ebp - 0x1ca], ax
mov ecx, dword [ebp - 0x230]
add ecx, 2
mov dword [ebp - 0x230], ecx
mov dx, word [ebp - 0x1ca]
mov word [ebp - 0x60], dx
push edi
sub edi, 0x630
or edi, 0x5e3c
and edi, 0x9e3a
add edi, 0xac85
pop edi
push eax
jmp 0x40a682
jmp 0x40a68b
sub eax, 0xb229
pop eax
mov eax, dword [ebp - 0x234]
mov cx, word [eax]
mov word [ebp - 0x1cc], cx
mov edx, dword [ebp - 0x234]
add edx, 2
mov dword [ebp - 0x234], edx
mov ax, word [ebp - 0x1cc]
mov word [ebp - 0x14], ax
push esi
call 0x40a6cd
add byte [ebx], dh
xor eax, dword [ebp + 0x4f]
inc eax
cmp byte [ecx + 0x49], al
inc edx
push eax
add esp, 4
pop esi
push esi
push edx
add esp, 4
jmp 0x40a6db
add esi, 0x6fe9
xor esi, 0x1812c
sub esi, 0x7e0c
pop esi
movzx ecx, word [ebp - 0x14]
test ecx, ecx
jne 0x40a70b
movzx edx, word [ebp - 0x60]
movzx eax, word [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x2f4], edx
jmp 0x40a78e
movzx ecx, word [ebp - 0x60]
movzx edx, word [ebp - 0x14]
cmp ecx, edx
je 0x40a604
movzx eax, word [ebp - 0x60]
xor eax, 0x20
movzx ecx, word [ebp - 0x14]
cmp eax, ecx
je 0x40a604
push edi
push esi
add esp, 4
call 0x40a741
add byte [edx + 0x45], al
inc esp
inc ecx
dec esi
cmp byte [eax + 0x37], dl
add esp, 4
pop edi
push eax
add eax, 0x155b5
call 0x40a75c
add byte [edi + 0x3e], cl
xor cl, byte [ebp + 0x4e]
xor eax, 0x49474c38
add esp, 4
pop eax
movzx edx, word [ebp - 0x60]
movzx eax, word [ebp - 0x14]
cmp edx, eax
jge 0x40a778
mov dword [ebp - 0x2f0], 0xffffffff
jmp 0x40a782
mov dword [ebp - 0x2f0], 1
mov ecx, dword [ebp - 0x2f0]
mov dword [ebp - 0x2f4], ecx
cmp dword [ebp - 0x2f4], 0
jne 0x40a7d7
push ecx
add ecx, 0x1797f
xor ecx, 0x1c68
sub ecx, 0x108c6
and ecx, 0xb9df
pop ecx
push esi
or esi, 0xba35
or esi, 0x1e90
pop esi
push esi
jmp 0x40a7c8
pop esi
mov edx, dword [ebp - 0xa0]
mov dword [ebp - 0x70], edx
jmp 0x40a86e
mov eax, dword [ebp - 0xa0]
mov ecx, dword [eax]
mov dword [ebp - 0xa0], ecx
push ebx
and ebx, 0x6f09
pop ebx
push ecx
add ecx, 0x12f19
sub ecx, 0x6785
jmp 0x40a802
pop ecx
push ecx
xor ecx, 0x21c0
add ecx, 0x10c84
and ecx, 0x4708
pop ecx
mov edx, dword [ebp - 0xa0]
cmp edx, dword [ebp - 0x238]
je 0x40a835
mov eax, dword [ebp - 0xa0]
cmp dword [eax + 0x30], 0
jne 0x40a579
push edi
push edx
add esp, 4
xor edi, 0x16603
pop edi
push edi
push edi
add esp, 4
or edi, 0x47ed
or edi, 0x654a
pop edi
push eax
and eax, 0x17edf
or eax, 0x178d6
and eax, 0xdfe7
pop eax
mov dword [ebp - 0x70], 0
Function at 0x40100d
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
pushal
rdtsc
mov ebx, eax
mov ecx, edx
rdtsc
sub eax, ebx
sbb edx, ecx
rdtsc
add eax, ebx
adc edx, ecx
rdtsc
sub eax, ebx
je 0x401033
jne 0x401033
push 0xc8c70ff0
invalid
sbb edx, ecx
test edx, edx
jne 0x40102f
popal
push eax
call fcn.00401041
call 0x9ca6689d
pop eax
pop eax
pushf
Function at 0x40201c
Capabilities:
Check mutex on windows
Execute anti-debugging instructions

Disassembly:
pop eax
jmp 0x401f36
call 0x401f26
ud1
dec ecx
jne 0x401f2a
jmp 0x401f40
jmp 0x401f2f
mov eax, 0x369
mov word [ebp - 4], ax
call fcn.004011fe
je 0x401f53
jne 0x401f53
call 0x12084da
and dword [ebp - 0x20], 0
jmp 0x401f60
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 5
jge 0x402029
push 0x40e194
push 0
call fcn.00405491
pop ecx
pop ecx
mov dword [ebp - 0x50], eax
push dword [ebp - 0x50]
mov eax, dword [ebp - 0x20]
imul eax, eax, 9
add eax, 0x419667
push eax
call fcn.004051c0
pop ecx
pop ecx
jge 0x401f95
jmp 0x401f97
jne 0x401f93
jl 0x401f9b
jmp 0x401f9d
je 0x401f99
jl 0x401fa4
je 0x401fa6
jne 0x401fa6
call 0x45cc191c
loopne 0x402015
je 0x401f9f
mov eax, dword [ebp - 0x20]
imul eax, eax, 9
movsx eax, byte [eax + 0x419667]
cmp eax, 0x30
jne 0x401fba
ror byte [ecx], 0xf
mov esi, 0x41966780
add byte [ebx + 0x27530f8], al
jmp 0x401f59
push 0x40e198
push 0
call fcn.00405491
pop ecx
pop ecx
mov dword [ebp - 0x50], eax
push dword [ebp - 0x50]
mov eax, dword [ebp - 0x20]
imul eax, eax, 9
add eax, 0x419669
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jne 0x401fe5
je 0x401fe5
jmp 0x4121bc51
push 0x40e19c
push 0
call fcn.00405491
pop ecx
pop ecx
mov dword [ebp - 0x50], eax
push dword [ebp - 0x50]
mov eax, dword [ebp - 0x20]
imul eax, eax, 9
add eax, 0x41966b
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pushf
jb 0x402019
jmp 0x402012
call 0x40201c
add byte [eax], al
call 0xe9349304
add esp, 4
popf
jb 0x40200f
call 0x6644e4a3
popfd
jmp 0x402024
jmp 0x401f59
nop
nop
nop
nop
call fcn.00401203
and dword [ebp - 0x20], 0
jmp 0x40203f

Function at 0x4020ec
Capabilities:
Check mutex on windows
Execute anti-debugging instructions

Disassembly:
jb 0x4020e5
jmp 0x4020ea
call fcn.004020ec
jae 0x4020e5
add esp, 4
jmp 0x4020f1
dec dword [esp]
jno 0x4020f6
jns 0x4020e1
jp 0x4020fa
add esp, 4
popf
je 0x402104
jne 0x402104
call 0x8bf09707
inc ebp
loopne 0x402174
push dword [ebp - 0x50]
shr byte [eax + 0x5000001], 0x35
xchg edi, eax
inc ecx
add byte [eax - 0x18], dl
movsd dword es:[edi], dword [esi]
xor byte [eax], al
add byte [ecx + 0x59], bl
test al, dl
Function at 0x402cb1
Capabilities:
Accept command line arguments

Disassembly:
add byte [ecx], 0xff
xor eax, 0x419ff8
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x68], eax
je 0x402cc9
jne 0x402cc9
int 0x20
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
push dword [ebp + 8]
call dword [ebp - 0x68]
test eax, eax
jne 0x402cf5
xor eax, eax
jmp 0x402fa7
jnp 0x402cfa
jp 0x402cfa
call 0xdc9281
and dword [ebp - 0x64], 0
push 0x41806c
push dword [0x41a000]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x64], eax
pushf
jb 0x402d20
je 0x402d1b
jne 0x402d1b
call fcn.00403007
add byte [edx - 0xc], dh
call 0x402d22
jb 0x402d16
add esp, 4
popf
je 0x402d2c
jne 0x402d2c
call 0xffe472bb
jo 0x402d66
mov eax, dword [ebp - 0x5c]
push dword [eax + 0x34]
push dword [ebp - 0x7c]
call dword [ebp - 0x64]
push 0x40
push 0x3000
mov eax, dword [ebp - 0x5c]
push dword [eax + 0x50]
mov eax, dword [ebp - 0x5c]
push dword [eax + 0x34]
push dword [ebp - 0x7c]
call dword [0x41a034]
test eax, eax
jne 0x402d5f
xor eax, eax
jmp 0x402fa7
call fcn.00401132
jb 0x402d69
jae 0x402d69
call 0x13c92f0
and dword [ebp - 4], 0
push 0x418084
Function at 0x404058
Capabilities:
Check for vm using instruction vpcext

Disassembly:
pop eax
pop eax
mov eax, 0x11ef
mov word [ebp - 0x24], ax
mov eax, 0x136d
mov word [ebp - 0x1c], ax
pushf
push 0xa

Function at 0x40407b
Capabilities:
Check for vm using instruction vpcext

Disassembly:
jae 0x404079
jmp 0x404074
call 0x40407b
add byte [eax], al
jae 0x404074
add esp, 4
jmp 0x404080
dec dword [esp]
jno 0x404085
jns 0x404070
jp 0x404089
add esp, 4
popf
jmp 0x404090
mov dword [ebp - 0x20], 0x32
pushf
jb 0x4040a5
je 0x4040a0
jne 0x4040a0
call fcn.0040438c
add byte [edx - 0xc], dh
call 0x4040a7
jb 0x40409b
add esp, 4
popf
je 0x4040b1
jne 0x4040b1
call 0x10739d
inc dword [ebx - 0x47ff039b]
add dword [eax], eax
add byte [eax], al
call fcn.004010e8
and dword [ebp - 4], 0
mov eax, 1
invalid

Function at 0x4040a7
Capabilities:
Check for vm using instruction vpcext

Disassembly:
jae 0x404079
jmp 0x404074
call 0x40407b
add byte [eax], al
jae 0x404074
add esp, 4
jmp 0x404080
dec dword [esp]
jno 0x404085
jns 0x404070
jp 0x404089
add esp, 4
popf
jmp 0x404090
mov dword [ebp - 0x20], 0x32
pushf
jb 0x4040a5
je 0x4040a0
jne 0x4040a0
call fcn.0040438c
add byte [edx - 0xc], dh
call 0x4040a7
jb 0x40409b
add esp, 4
popf
je 0x4040b1
jne 0x4040b1
call 0x10739d
inc dword [ebx - 0x47ff039b]
add dword [eax], eax
add byte [eax], al
call fcn.004010e8
and dword [ebp - 4], 0
mov eax, 1
invalid
Function at 0x404bad
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
je 0x404bdb
jne 0x404bdb
pushal
rdtsc
mov ebx, eax
mov ecx, edx
rdtsc
sub eax, ebx
sbb edx, ecx
rdtsc
add eax, ebx
adc edx, ecx
rdtsc
sub eax, ebx
push 0xc8c70ff0
sbb edx, ecx
test edx, edx
popal
jl 0x404be2
je 0x404be4
jne 0x404be4
call 0xab455a
je 0x404bdd
push 0
push 0x18
lea eax, [ebp - 0x18]
push eax
push 0
push dword [ebp + 8]
call dword [0x41a030]
jge 0x404bfe
je 0x404c00
jne 0x404c00
call 0x45cc4577
in al, dx
jne 0x404bf9
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x404d2a
Capabilities:
Get file system object information

Disassembly:
pop eax
pop eax
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_PolyTextOutA]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
pushf
push 0xa
jae 0x404d55
jmp 0x404d50
call 0x404d57
jae 0x404d50
add esp, 4
jmp 0x404d5c
dec dword [esp]
jno 0x404d61
jns 0x404d4c
jp 0x404d65
add esp, 4
popf
jmp 0x404d6c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
add bh, bh
adc eax, sym.imp.USER32.dll_CreateWindowExA
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
pushf
jb 0x404da0
je 0x404d9b
jne 0x404d9b
call fcn.00405087
add byte [edx - 0xc], dh
call 0x404da2
jb 0x404d96
add esp, 4
popf
je 0x404dac
jne 0x404dac
call 0x163f4e1a
jl 0x404d83
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
inc eax
add byte [edx], ch
push 0
push 0
push 0
add byte [edx], ch