joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420b4b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x420b8a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x420b8a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x420b8a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x420b8a
cmp dword [ecx + 0x74], 0xe
jbe 0x420b8a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x433300
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43332d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43332d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x10001bc0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x10001bfe
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x10001bf6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x10001c00
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x10001be6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10001cd0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x10001d01
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x10001d01
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x10001d01
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x1000624c
Capabilities:
Encode data using xor

Disassembly:
call 0x100061c5
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x100061f5
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x10006211
xor edx, 0
jmp 0x1000621c
xor edx, edx
jmp 0x10006233
jmp 0x1000623f
xor eax, eax
push 0x8427d7c0
call 0x1000624c
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x10006288
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x10006261
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x1000629f
add eax, 0
jno 0x100062a4
add esi, 0
ret 0x10
Function at 0x5236e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xc6000]
mov dword [edi + 0xcf740], 0x26966e90
push edi
jmp 0x52370a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x523711
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x523700
mov eax, 1
add ebx, ebx
jne 0x523723
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x523734
jne 0x523753
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x523753
dec eax
add ebx, ebx
jne 0x523740
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x523718
add ebx, ebx
jne 0x52374f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5237a5
xor ecx, ecx
sub eax, 3
jb 0x52376b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5237da
sar eax, 1
mov ebp, eax
jmp 0x523776
add ebx, ebx
jne 0x523776
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x523744
inc ecx
add ebx, ebx
jne 0x523784
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x523744
add ebx, ebx
jne 0x523791
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x523786
jne 0x5237a2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x523786
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5237c4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5237b6
jmp 0x523706
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5237c4
add edi, ecx
jmp 0x523706
pop esi
mov edi, esi
mov ecx, 0x40f0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5237e2
cmp byte [edi], 0x11
jne 0x5237e2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5237e7
lea edi, [esi + 0x11c000]
mov eax, dword [edi]
or eax, eax
je 0x52385f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1616b8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x161834]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x523814
mov ecx, edi
jns 0x523843
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x161838]
or eax, eax
je 0x523859
mov dword [ebx], eax
add ebx, 4
jmp 0x523831
call dword [esi + 0x161848]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x523890
cmp al, 0xef
ja 0x523883
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x523865
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x523872
mov ebp, dword [esi + 0x16183c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5238c4
sub esp, 0xffffff80
jmp 0x420577
Function at 0x401650
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x431c24
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.004018e0
mov esi, eax
mov dword [ebp - 0x18], esi
push 0
push esi
mov dword [ebp - 4], 0
call fcn.00401c30
mov edi, eax
add esp, 8
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x18], edi
push 0
mov dword [ebp - 0x18], 0
call sub.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsDeleteString
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x4016be
mov eax, dword [esi]
push esi
call dword [eax + 8]
push 0
push edi
mov dword [ebp - 0x14], 0
call sub.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsGetStringRawBuffer
push 2
lea ecx, [ebp - 0x14]
push ecx
push 0x20000070
push eax
call dword [sym.imp.api_ms_win_core_localization_l1_2_1.dll_GetLocaleInfoEx]
test eax, eax
jne 0x4016ec
push ecx
mov ecx, dword [ebp + 4]
call fcn.00406600
xor ebx, ebx
cmp dword [ebp - 0x14], 1
push edi
sete bl
call sub.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsDeleteString
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042f522
mov esp, ebp
pop ebp
ret
Function at 0x406fb8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0xc], 0
jmp 0x406fec
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 0x10]
jae 0x40709e
mov edx, dword [ebp - 8]
add edx, 1
and edx, 0x800000ff
jns 0x40700e
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 8]
movzx ecx, byte [eax]
add ecx, dword [ebp - 0x10]
and ecx, 0x800000ff
jns 0x40702d
dec ecx
or ecx, 0xffffff00
inc ecx
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [ebp - 1], al
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x10]
mov al, byte [edx]
mov byte [ecx], al
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 1]
mov byte [ecx], dl
mov eax, dword [ebp + 8]
add eax, dword [ebp - 8]
movzx ecx, byte [eax]
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x10]
movzx eax, byte [edx]
add ecx, eax
and ecx, 0x800000ff
jns 0x40707a
dec ecx
or ecx, 0xffffff00
inc ecx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x14]
movzx edx, byte [ecx]
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
xor ecx, edx
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0xc]
mov byte [edx], cl
jmp 0x406fe3
mov esp, ebp
pop ebp
ret

Function at 0x4071c8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov byte [ebp - 0x14], 0x59
mov byte [ebp - 0x13], 0x68
mov byte [ebp - 0x12], 0x2d
mov byte [ebp - 0x11], 0x69
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xf], 0x6b
mov byte [ebp - 0xe], 0x6c
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x2d
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x61
mov byte [ebp - 7], 0x6e
mov byte [ebp - 6], 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1cc]
call edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x407245
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x78]
call ecx
cmp eax, 0xb7
jne 0x407240
xor eax, eax
jmp 0x407245
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x407cb8
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x407ce1
mov eax, dword [ebp - 4]
jmp 0x407dfa
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0x4550
je 0x407d00
mov eax, dword [ebp - 4]
jmp 0x407dfa
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x10]
cmp dword [edx + ecx + 0x7c], 0
jne 0x407d1a
mov eax, dword [ebp - 4]
jmp 0x407dfa
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x10]
cmp dword [edx + ecx + 0x78], 0
jne 0x407d34
mov eax, dword [ebp - 4]
jmp 0x407dfa
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
add eax, dword [edx + ecx + 0x78]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 0x18], 0
jne 0x407d5a
mov eax, dword [ebp - 4]
jmp 0x407dfa
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 8], 0
jmp 0x407d90
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x18]
sub ecx, 1
cmp dword [ebp - 8], ecx
jae 0x407df7
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + edx*4]
add ecx, dword [ebp + 8]
push ecx
call fcn.00406af8
add esp, 4
cmp eax, dword [ebp + 0xc]
jne 0x407df5
cmp dword [ebp + 0x10], 0
je 0x407ddd
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + eax*4]
add edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x1c]
mov dword [ebp - 4], eax
jmp 0x407df3
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x20]
movzx eax, word [edx + ecx*2]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + eax*4]
add edx, dword [ebp + 8]
mov dword [ebp - 4], edx
jmp 0x407df7
jmp 0x407d87
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x416ab0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4339ea
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x1c], esi
call fcn.0043107a
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x416b5a
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x438f44
push eax
lea ecx, [ebp - 0x28]
call dword [sym.imp.msvcrt.dll_public:_void___thiscall_exception::constructor_char_const__const_const__]
push 0x446d28
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x449a4c
push eax
call sub.msvcrt.dll__CxxThrowException
push edi
push esi
call fcn.00430f06
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042f522
mov esp, ebp
pop ebp
ret 4

Function at 0x424ce0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4353e7
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [section..data]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea esi, [edi + 0x1c]
push esi
call dword [sym.imp.wincorlib.DLL_public:_void___cdecl_Platform::Object::constructor_void_]
mov dword [edi], 0x44a570
add esp, 4
mov dword [edi + 4], 0x44a4f4
mov dword [edi + 8], 0x44a4d0
mov dword [edi + 0xc], 0x44a4b4
mov dword [edi + 0x10], 0x44a488
mov dword [edi + 0x14], 0x44a41c
mov dword [edi + 0x18], 0x44a3f8
mov dword [esi], 0x44a3dc
mov dword [edi + 0x20], 0x44a3c4
mov dword [edi + 0x24], 0x44a3a8
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
lea eax, [edi + 0x3c]
mov byte [ebp - 4], 1
mov esi, dword [sym.imp.wincorlib.DLL_void___stdcall_Platform::Details::EventSourceInitialize_void___]
push eax
call esi
lea eax, [edi + 0x40]
mov byte [ebp - 4], 2
push eax
call esi
mov byte [ebp - 4], 3
mov esi, dword [0x44caa0]
mov dword [edi + 0x48], 0xffffffff
test esi, esi
je 0x424db3
mov eax, dword [esi]
push esi
call dword [eax]
lea edx, [edi + 0x30]
mov byte [ebp - 4], 4
lea ecx, [edi + 0x28]
call fcn.0042b4a0
mov byte [edi + 0x38], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42fd8f
Capabilities:
Terminate process

Disassembly:
call fcn.00430163
jmp 0x42fd99
push 0x5c
push 0x446838
call fcn.0042ff94
and dword [ebp - 0x24], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_1.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov edi, dword [eax + 4]
xor esi, esi
mov edx, 0x44cd1c
mov ecx, edi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x42fde6
cmp eax, edi
jne 0x42fdf8
mov esi, ebx
cmp dword [0x44cd20], ebx
jne 0x42fe05
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x42fe34
push 0x3e8
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x42fdcf
cmp dword [0x44cd20], 0
jne 0x42fe2e
mov dword [0x44cd20], ebx
push 0x437320
push 0x43730c
call fcn.0042fc53
pop ecx
pop ecx
test eax, eax
je 0x42fe34
jmp 0x42ff6d
mov dword [0x44ca68], ebx
cmp dword [0x44cd20], ebx
jne 0x42fe57
push 0x437308
push 0x4372c8
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x44cd20], 2
test esi, esi
jne 0x42fe64
xor eax, eax
mov ecx, 0x44cd1c
xchg dword [ecx], eax
cmp dword [0x44cd24], 0
je 0x42fe92
push 0x44cd24
call fcn.00430070
pop ecx
test eax, eax
je 0x42fe92
push 0
push 2
push 0
mov esi, dword [0x44cd24]
mov ecx, esi
call dword [0x4372c4]
call esi
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov edi, dword [ebp - 0x24]
mov cl, byte [esi]
cmp cl, 0x20
ja 0x42fef0
test cl, cl
je 0x42feae
test edi, edi
jne 0x42fef0
mov al, byte [esi]
test al, al
je 0x42febe
cmp al, 0x20
ja 0x42febe
inc esi
mov dword [ebp - 0x20], esi
jmp 0x42feae
test byte [ebp - 0x40], 1
je 0x42feca
movzx eax, word [ebp - 0x3c]
jmp 0x42fecd
push 0xa
pop eax
push eax
push esi
push 0
push 0x400000
call main
mov dword [0x44ca64], eax
cmp dword [0x44ca7c], 0
jne 0x42ff49
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cl, 0x22
jne 0x42ff01
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [ebp - 0x24], edi
movzx eax, cl
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x42ff14
inc esi
mov dword [ebp - 0x20], esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x42fe9f
cmp dword [0x44ca68], 0
jne 0x42ff5d
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x44ca64]
mov dword [ebp - 4], 0xfffffffe
jmp 0x42ff79
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.0042ffdc
ret

Function at 0x430020
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x43005e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x430056
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x430060
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x430046
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x430130
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x430146
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x430161
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x430263
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x446880
call fcn.0043031c
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x4302c3
cmp eax, 0xffffffff
je 0x4302c3
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x4302bc
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x4302bc
cmp edx, 0x10000000
jae 0x4302bc
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x4302b9
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
call fcn.00430361
ret 4
Function at 0x4efc4f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x4efc67
mov edi, dword [esi + 0xc]
jmp 0x4efca7
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4efc80
call fcn.0042387f
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4efc95
call fcn.0042387f
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x4efca7
call fcn.0042387f
call fcn.00420b06
cmp dword [eax + 0x3c], 0
je 0x4efcbc
push edi
mov ecx, ebx
call fcn.004eea81
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.004efb69
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x4efcda
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x7c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x4efce6
mov edi, eax
mov dword [ebx + 0x7c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4f0781
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x4f07bc
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x4f07a3
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x4f07b4
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x4f07be
inc edi
add eax, 0x28
cmp edi, esi
jb 0x4f0799
xor eax, eax
pop edi
pop esi
ret

Function at 0x4f0afe
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.004f0751
push eax
push esi
push dword [ebp + 8]
call fcn.004f0706
mov dword [ebp - 0xbc], eax
inc esp
invalid
invalid
dec dword [ebp + 0x5d88d445]
aam 0x50
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.004f0751
push eax