joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d930
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1a000]
push edi
jmp 0x42d94a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42d951
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42d940
mov eax, 1
add ebx, ebx
jne 0x42d963
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42d958
jne 0x42d974
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42d958
xor ecx, ecx
sub eax, 3
jb 0x42d988
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42d9fa
mov ebp, eax
add ebx, ebx
jne 0x42d993
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42d9a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42d9c4
inc ecx
add ebx, ebx
jne 0x42d9b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42d9a5
jne 0x42d9c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42d9a5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42d9e4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42d9d5
jmp 0x42d946
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42d9e4
add edi, ecx
jmp 0x42d946
pop esi
mov edi, esi
mov ecx, 0x935
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42da02
cmp byte [edi], 0x11
jne 0x42da02
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x42da07
lea edi, [esi + 0x2a000]
mov eax, dword [edi]
or eax, eax
je 0x42da76
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2d4e4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2d55c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42da34
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2d560]
or eax, eax
je 0x42da70
mov dword [ebx], eax
add ebx, 4
jmp 0x42da51
call dword [esi + 0x2d570]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x42daa7
cmp al, 0xef
ja 0x42da9a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x42da7c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x42da89
mov ebp, dword [esi + 0x2d564]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42dadb
sub esp, 0xffffff80
jmp 0x407c00
Function at 0x432f5a
Capabilities:
Encode data using xor

Disassembly:
enter 0x40, 0
sar ebx, 2
push edi
push ecx
cld
mov eax, 0x30303030
mov ecx, 0xb
lea edi, [ebp - 0x30]
rep stosd dword es:[edi], eax
mov dword [ebp - 4], 0x30
mov eax, 0
mov ecx, 4
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
push ebx
mov ecx, ebx
mov ebx, dword [esi + ecx*4 - 4]
sar ebx, 0x1f
lea edi, [ebp - 0x40]
clc
pushfd
lodsd eax, dword [esi]
xor eax, ebx
popfd
sbb eax, ebx
pushfd
stosd dword es:[edi], eax
loop 0x432f98
add esp, 4
lea edi, [ebp - 0xc]
mov ecx, dword [esp]
lea esi, [ebp + ecx*4 - 0x44]
cmp dword [esi], 0
jne 0x432fbd
sub esi, 4
loop 0x432faf
or ecx, ecx
je 0x432fff
push ebx
mov ebx, 0x3b9aca00
mov dword [esp + 4], ecx
push esi
push ecx
mov esi, dword [esp + 4]
mov ecx, dword [esp + 0xc]
sub edx, edx
mov eax, dword [esi]
div ebx
mov dword [esi], eax
sub esi, 4
loop 0x432fdb
call fcn.00432d5e
sub edi, 0x12
dec dword [esp]
jne 0x432fd1
mov edx, dword [ebp - 0x40]
call fcn.00432d5e
add esp, 8
pop ebx
add esp, 4
pop ecx
mov bl, ch
movzx ecx, cl
pop edi
lea esi, [ebp - 3]
jmp 0x43305a

Function at 0x434e7d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4d30f8
cmp edx, dword [eax]
je 0x434e9f
add eax, 8
inc ecx
cmp eax, 0x4d3188
jl 0x434e90
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4d30f8]
jne 0x434fcd
mov eax, dword [0x4d34ac]
cmp eax, 1
je 0x434fa7
test eax, eax
jne 0x434ed0
cmp dword [0x4d3048], 1
je 0x434fa7
cmp edx, 0xfc
je 0x434fcd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x434f07
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00435530
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004356a0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x434f4a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004356a0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x438488
push edi
call fcn.00436a40
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00435530
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00435540
lea eax, [ebp - 0xa0]
push 0x438468
push eax
call fcn.00435540
push dword [esi + 0x4d30fc]
lea eax, [ebp - 0xa0]
push eax
call fcn.00435540
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004369b1
add esp, 0x2c
pop edi
jmp 0x434fcd
lea eax, [ebp + 8]
lea esi, [esi + 0x4d30fc]
push 0
push eax
push dword [esi]
call fcn.004356a0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40aa00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
xor ecx, ecx
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
mov edx, ecx
sub edx, eax
mov al, byte [edx + edi]
mov byte [ebp + ecx - 0x106], cl
mov byte [ebp + ecx - 0x208], al
inc ecx
cmp ecx, 0x100
jl 0x40aa12
xor eax, eax
lea ebx, [ebx]
movzx ecx, byte [ebp + eax - 0x208]
movzx edx, byte [ebp + eax - 0x106]
add ecx, esi
lea esi, [ecx + edx]
and esi, 0x800000ff
jns 0x40aa75
dec esi
or esi, 0xffffff00
inc esi
mov cl, byte [ebp + eax - 0x106]
mov dl, byte [ebp + esi - 0x106]
mov byte [ebp + eax - 0x106], dl
inc eax
mov byte [ebp + esi - 0x106], cl
cmp eax, 0x100
jl 0x40aa50
xor eax, eax
xor cl, cl
mov byte [ebp - 0x107], 0
cmp dword [ebp + 0xc], eax
jbe 0x40ab21
mov edi, dword [ebp + 8]
push ebx
jmp 0x40aab6
mov cl, byte [ebp - 0x108]
mov dl, byte [eax + edi]
inc cl
mov byte [ebp - 0x108], cl
movzx esi, cl
movzx ebx, byte [ebp + esi - 0x106]
movzx ecx, byte [ebp - 0x107]
add ecx, ebx
mov byte [ebp - 0x107], cl
movzx ebx, byte [ebp + esi - 0x106]
movzx ecx, cl
lea ecx, [ebp + ecx - 0x106]
mov byte [ebp - 1], bl
movzx ebx, byte [ecx]
mov byte [ebp + esi - 0x106], bl
movzx ebx, byte [ebp - 1]
mov byte [ecx], bl
movzx ebx, byte [ebp + esi - 0x106]
add bl, byte [ecx]
inc eax
movzx ecx, bl
mov cl, byte [ebp + ecx - 0x106]
xor cl, dl
mov byte [eax + edi - 1], cl
cmp eax, dword [ebp + 0xc]
jb 0x40aab0
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40b930
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0x77
push esi
mov dword [ebp - 0x20], 0x6f726863
mov dword [ebp - 0x1c], 0x635f656d
mov dword [ebp - 0x18], 0x646c6968
mov dword [ebp - 0x14], 0x6c6c642e
mov byte [ebp - 0x10], 0
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
call fcn.00409c00
add esp, 8
test eax, eax
jne 0x40b993
lea eax, [ebp - 0x20]
push eax
lea ecx, [esi + 0x1c]
push ecx
call fcn.0040ace0
add esp, 8
test eax, eax
je 0x40ba1e
push ebx
push edi
push eax
push esi
call fcn.00406b10
mov edx, dword [esi + 0xca0]
push 0x15db1ddc
push 0
push 0
mov edi, eax
push edx
lea eax, [esi + 0xc94]
push eax
call fcn.00414e40
add esp, 0x1c
mov ebx, eax
call fcn.0041f12a
mov dword [eax + 3], esi
call fcn.0041f13c
mov dword [eax + 3], esi
test edi, edi
je 0x40b9f1
push 1
push 2
call fcn.0041f12a
add eax, 2
push eax
lea ecx, [esi + 0x1934]
push ecx
push edi
push esi
call fcn.004055a0
add esp, 0x18
test ebx, ebx
je 0x40ba13
push 0
push 0
call fcn.0041f13c
add eax, 2
push eax
lea edx, [esi + 0x19b4]
push edx
push ebx
push esi
call fcn.004055a0
add esp, 0x18
push esi
call fcn.004175a0
add esp, 4
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x411e70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x288
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0xb8c], 0
je 0x411e90
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x286]
push ecx
mov word [ebp - 0x288], ax
call fcn.0041be20
push 4
push 0x3000
push 0x1000
push 0
push esi
call fcn.0041bd00
add esp, 0x20
mov dword [esi + 0xb8c], eax
test eax, eax
jne 0x411ed3
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 0x3d], eax
mov dword [ebp - 0x39], eax
mov dword [ebp - 0x35], eax
mov dword [ebp - 0x31], eax
mov dword [ebp - 0x2d], eax
mov dword [ebp - 0x29], eax
mov dword [ebp - 0x25], eax
mov byte [ebp - 0x21], al
mov ecx, 0x65
mov eax, ecx
mov word [ebp - 0x6c], ax
xor eax, eax
push eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov dword [ebp - 6], eax
mov word [ebp - 2], ax
push 1
lea eax, [ebp - 0x288]
push eax
xor edx, edx
push esi
mov word [ebp - 0x40], 0x7d22
mov byte [ebp - 0x3e], 0
mov dword [ebp - 0x80], 0x6f004c
mov dword [ebp - 0x7c], 0x610063
mov dword [ebp - 0x78], 0x20006c
mov dword [ebp - 0x74], 0x740053
mov dword [ebp - 0x70], 0x740061
mov word [ebp - 0x6a], dx
mov dword [ebp - 0x20], 0x72636e65
mov dword [ebp - 0x1c], 0x65747079
mov dword [ebp - 0x18], 0x656b5f64
mov word [ebp - 0x14], 0x79
call fcn.0040b030
add esp, 0x10
push 1
lea ecx, [ebp - 0x288]
push 0x1e
push ecx
call fcn.0041c090
add esp, 4
lea edx, [ebp + eax*2 - 0x288]
push edx
push esi
call fcn.0040b030
lea eax, [ebp - 0x288]
push eax
call fcn.0041c090
add esp, 0x14
cmp eax, 0x16
jb 0x411ecc
push ebx
push edi
xor ecx, ecx
push ecx
lea edx, [ebp - 0x80]
mov word [ebp + eax*2 - 0x2ac], cx
push edx
lea eax, [ebp - 0x288]
push eax
call fcn.0041c200
push 0
push 0x15
lea ecx, [ebp - 0x288]
push ecx
push esi
call fcn.00414a40
push 0
push 1
lea edx, [ebp - 0x288]
push edx
push esi
mov edi, eax
call fcn.00414a40
mov ebx, eax
add esp, 0x2c
test ebx, ebx
je 0x412092
test edi, edi
je 0x412092
lea eax, [ebp - 0x20]
push eax
push ebx
call fcn.0041c120
mov edi, eax
add esp, 8
test edi, edi
je 0x412070
lea ecx, [ebp - 0x20]
push ecx
call fcn.0041c070
lea edx, [ebp - 0x40]
lea edi, [edi + eax + 3]
push edx
push edi
call fcn.0041c120
add esp, 0xc
mov byte [eax], 0
cmp byte [edi], 0
je 0x412070
push edi
call fcn.0041c070
add esp, 4
cmp eax, 0x400
jae 0x412070
push edi
call fcn.0041c070
push eax
mov eax, dword [esi + 0xb8c]
push edi
push eax
call fcn.0041bda0
add esp, 0x10
push esi
call fcn.004016a0
push ebx
push esi
mov dword [esi + 0xb80], eax
call fcn.0041bd80
add esp, 0xc
pop edi
pop ebx
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40501c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x405028
push 0x405024
push 0x405020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x405028]
push dword [0x405024]
push dword [0x405020]
mov dword [0x405014], esp
call fcn.00401507
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0xbfe058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00bfe1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xbfe07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbfe06a
add dl, dl
jne 0xbfe089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbfe0dc
xor eax, eax
add dl, dl
jne 0xbfe096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbfe17d
add dl, dl
jne 0xbfe0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbfe0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbfe0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbfe0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xbfe0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xbfe075
mov eax, 1
add dl, dl
jne 0xbfe0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbfe0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbfe0e1
sub eax, ebx
mov ebx, 1
jne 0xbfe128
mov ecx, 1
add dl, dl
jne 0xbfe10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xbfe119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbfe105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbfe075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xbfe13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xbfe14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbfe136
cmp eax, 0x7d00
jae 0xbfe16d
cmp eax, 0x500
jb 0xbfe168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbfe075
cmp eax, 0x7f
ja 0xbfe170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbfe075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xbfe19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xbfe075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x412cf0
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x412e9a
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
sub byte [esi + ebx], 0x4c
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0x89
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
xor byte [esi + ebx], 0x35
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0x17
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0x27
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
add esp, 0x44
push eax
call fcn.004013a7
add byte [esi + ebx], 0x13
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0x3a
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0x89
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0x92
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 7
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0xe9
add esp, 0x40
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 7
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xb2
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0xde
push str.Protocol_of_Mind
push 0x4d04b0
call fcn.0040349a
push eax
call fcn.004013a7
add byte [esi + ebx], 0x1a
add esp, 0x30
inc esi
cmp esi, edi
jb 0x412d10
pop ebx
pop edi
pop esi
ret

Function at 0x4035d5
Capabilities:
Terminate process

Disassembly:
jmp 0x451b59
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x451b6a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.004058fd
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x403706
Capabilities:
Query environment variable

Disassembly:
jmp 0x49b002
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49b013
pop esi
ret
push ebx
push edi
push esi
call fcn.0049aee9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fd0
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49b03b
push ebx
push esi
push edi
call fcn.004056f0
add esp, 0xc
push 0
call fcn.0040623a
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x7ca41974
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x32c411ab
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x408972
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x4085d8
inc eax
sub ecx, 0xd589ea59
call fcn.0040899d
xor dword [edi], edx
and ecx, eax
inc eax
inc edi
sub ecx, 1
mov eax, 0x888d474a
cmp edi, esi
jne fcn.00408972
ret
Function at 0x402e06
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x402e45
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x402e45
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x402e45
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x402e45
cmp dword [ecx + 0x74], 0xe
jbe 0x402e45
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4062e5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40b508
cmp edx, dword [eax]
je 0x406307
add eax, 8
inc ecx
cmp eax, 0x40b598
jl 0x4062f8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40b508]
jne 0x406435
mov eax, dword [0x40ba54]
cmp eax, 1
je 0x40640f
test eax, eax
jne 0x406338
cmp dword [0x40b1b4], 1
je 0x40640f
cmp edx, 0xfc
je 0x406435
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40636f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004037b0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004038a0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4063b2
lea eax, [ebp - 0x1a4]
push eax
call fcn.004038a0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40957c
push edi
call fcn.004077b0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004037b0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004037c0
lea eax, [ebp - 0xa0]
push 0x40955c
push eax
call fcn.004037c0
push dword [esi + 0x40b50c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004037c0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00407726
add esp, 0x2c
pop edi
jmp 0x406435
lea eax, [ebp + 8]
lea esi, [esi + 0x40b50c]
push 0
push eax
push dword [esi]
call fcn.004038a0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..rsrc
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
je 0x432072
nop
nop
nop
nop
mov ebx, 0x40c7d0
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x7c362333
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x432060
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4320d2
nop
nop
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x17b096c
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219