joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403c80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
mov eax, dword [0x44a040]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x7c]
push edi
test byte [esi + 0x30], 2
je 0x403d7b
mov edi, dword [esp + 0x88]
sub edi, dword [esi + 0x1c]
push 0xffffffffffffffff
push 1
push esi
mov dword [esp + 0x20], edi
call fcn.00403ad0
mov eax, dword [esi + 0x14]
add esp, 0xc
test byte [eax + 8], 1
jne 0x403d74
cmp dword [eax + 0x14], 0
je 0x403d71
dec dword [eax + 0x14]
mov edi, dword [esi + 0x3c]
test edi, edi
je 0x403d60
cmp byte [esi + 0x31], 0
je 0x403d60
mov eax, dword [esi + 0x14]
mov ebp, dword [esi + 8]
sub ebp, dword [esi + 0x1c]
mov eax, dword [eax + 4]
sub eax, dword [esi + 0x1c]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x18]
sub eax, dword [esi + 8]
mov dword [esp + 0x18], 4
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x74], 0
cmp eax, 0xa0
jg 0x403d29
push 0x14
push esi
call fcn.00403bb0
add esp, 8
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 8]
add ecx, 0xa0
mov dword [eax + 4], ecx
lea eax, [esp + 0x18]
push eax
push esi
mov byte [esi + 0x31], 0
call edi
mov eax, dword [esi + 0x14]
add esp, 8
mov ecx, dword [esi + 0x1c]
add ecx, dword [esp + 0x10]
mov byte [esi + 0x31], 1
mov dword [eax + 4], ecx
mov eax, dword [esi + 0x1c]
add eax, ebp
mov dword [esi + 8], eax
mov eax, dword [esi + 0x14]
cmp dword [eax + 0x14], 0
jne 0x403cd2
mov edi, dword [esp + 0x14]
dec dword [eax + 0x14]
mov ebp, dword [esi + 0x1c]
add ebp, edi
jmp 0x403d82
mov ebp, dword [esp + 0x88]
add dword [esi + 0x14], 0xffffffe8
mov eax, dword [esi + 0x14]
mov edi, dword [esi + 0xc]
mov ebx, dword [esp + 0x84]
sub edi, 8
mov eax, dword [eax]
mov dword [esi + 0xc], eax
test ebx, ebx
je 0x403dd0
nop
cmp ebp, dword [esi + 8]
jae 0x403dbe
mov ecx, ebp
mov edx, edi
add edi, 8
add ebp, 8
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
sub ebx, 1
jne 0x403da0
test ebx, ebx
jle 0x403dd0
dec ebx
mov dword [edi], 0
add edi, 8
test ebx, ebx
jg 0x403dc2
mov ecx, dword [esp + 0x78]
mov dword [esi + 8], edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00416196
add esp, 0x6c
ret
Function at 0x407250
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
mov ebx, ebp
push esi
mov esi, ebp
mov edx, ebp
shr esi, 5
inc esi
push edi
cmp ebp, esi
jb 0x40728f
mov ebp, dword [esp + 0x20]
nop dword [eax]
movzx ecx, byte [edx + ebp - 1]
mov eax, ebx
shl eax, 5
sub edx, esi
add ecx, eax
mov eax, ebx
shr eax, 2
add ecx, eax
xor ebx, ecx
cmp edx, esi
jae 0x407270
mov ebp, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 8]
mov eax, dword [eax]
dec ecx
and ecx, ebx
mov edi, dword [eax + ecx*4]
test edi, edi
je 0x407315
cmp dword [edi + 0xc], ebp
jne 0x40730f
mov edx, dword [esp + 0x20]
lea eax, [edi + 0x10]
mov esi, ebp
sub esi, 4
jb 0x4072c9
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x4072d2
add edx, 4
add eax, 4
sub esi, 4
jae 0x4072b8
cmp esi, 0xfffffffc
je 0x40742a
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x40730f
cmp esi, 0xfffffffd
je 0x40742a
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x40730f
cmp esi, 0xfffffffe
je 0x40742a
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x40730f
cmp esi, 0xffffffff
je 0x40742a
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
je 0x40742a
mov edi, dword [edi]
test edi, edi
jne 0x4072a5
mov edi, dword [esp + 0x1c]
lea eax, [ebp + 0x11]
push eax
push 0
push 0
push edi
call fcn.004071b0
mov esi, eax
push ebp
push dword [esp + 0x34]
mov dword [esp + 0x2c], esi
lea ecx, [esi + 0x10]
mov dword [esi + 0xc], ebp
push ecx
mov dword [esi + 8], ebx
mov word [esi + 4], 4
mov byte [esi + 6], 0
call fcn.00416d90
mov byte [esi + ebp + 0x10], 0
add esp, 0x1c
mov edx, dword [edi + 0x10]
mov ecx, dword [edx + 8]
mov eax, dword [edx]
dec ecx
and ecx, ebx
mov eax, dword [eax + ecx*4]
mov dword [esi], eax
mov eax, dword [edx]
mov dword [eax + ecx*4], esi
inc dword [edx + 4]
mov eax, dword [edx + 8]
cmp dword [edx + 4], eax
jle 0x407420
cmp eax, 0x3ffffffe
jg 0x407420
add eax, eax
mov dword [esp + 0x24], eax
lea esi, [eax*4]
push esi
push 0
push 0
push edi
call fcn.004071b0
mov ecx, dword [esp + 0x34]
add esp, 0x10
mov ebx, dword [edi + 0x10]
mov ebp, eax
mov dword [esp + 0x10], ebx
test ecx, ecx
jle 0x4073bd
shr esi, 2
mov edi, ebp
mov ecx, esi
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x24]
mov eax, dword [ebx + 8]
xor edi, edi
test eax, eax
jle 0x4073fe
mov eax, dword [ebx]
mov esi, dword [eax + edi*4]
test esi, esi
je 0x4073f2
lea ebx, [ecx - 1]
mov eax, dword [esi + 8]
mov edx, dword [esi]
and eax, ebx
lea ecx, [eax*4]
mov eax, dword [ecx + ebp]
mov dword [esi], eax
mov dword [ecx + ebp], esi
mov esi, edx
test edx, edx
jne 0x4073d2
mov ebx, dword [esp + 0x10]
mov eax, dword [ebx + 8]
inc edi
mov ecx, dword [esp + 0x24]
cmp edi, eax
jl 0x4073c6
push 0
shl eax, 2
push eax
push dword [ebx]
mov eax, dword [esp + 0x28]
push eax
call fcn.004071b0
mov eax, dword [esp + 0x34]
add esp, 0x10
mov esi, dword [esp + 0x14]
mov dword [ebx + 8], eax
mov dword [ebx], ebp
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x416240
Capabilities:
Enumerate pe sections

Disassembly:
cmp dword [0x44ace4], 6
jl 0x41625f
vbroadcastss xmm0, xmm0
vcvttps2qq xmm0, xmm0
vmovd eax, xmm0
vpextrd edx, xmm0, 1
ret
movd eax, xmm0
cdq
shl eax, 1
cmp eax, 0x9e000000
jae 0x416273
cvttss2si eax, xmm0
cdq
ret
cmp eax, 0xbe000000
jae 0x416293
mov ecx, eax
bts eax, 0x18
shr ecx, 0x18
shl eax, 7
sub cl, 0xbe
xor eax, edx
sub eax, edx
shld edx, eax, cl
shl eax, cl
ret
jne 0x416299
test edx, edx
js 0x4162a1
cvttss2si ecx, dword [0x437d18]
mov edx, 0x80000000
xor eax, eax
ret

Function at 0x416755
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x416794
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x416794
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x416794
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x416794
cmp dword [ecx + 0x74], 0xe
jbe 0x416794
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4270bc
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x43b3c8
push 0x43b3c0
push str.FlsAlloc
push 0x1f
call fcn.00426f7b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4270f0
push dword [ebp + 8]
mov ecx, esi
call dword [0x4361a0]
call esi
jmp 0x4270f6
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x42713a
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x43b3d8
push 0x43b3d0
push str.FlsGetValue
push 0x21
call fcn.00426f7b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x427171
push dword [ebp + 8]
mov ecx, esi
call dword [0x4361a0]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x427179
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x43b3e0
push 0x43b3d8
push str.FlsSetValue
push 0x22
call fcn.00426f7b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4271b3
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x4361a0]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x427daf
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x44b068]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x427def
cmp byte [ebx], 0xa
jne 0x427def
or byte [edi + eax + 0x28], 4
jmp 0x427df4
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x427ef3
mov dl, byte [eax]
cmp dl, 0x1a
je 0x427ed6
inc eax
cmp dl, 0xd
je 0x427e20
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x427e46
cmp eax, ecx
jae 0x427e54
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x427e08
jmp 0x427ef3
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x427ed1
cmp dword [ebp - 0x10], 0
je 0x427ed1
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x44b068]
test byte [eax + edi + 0x28], 0x48
je 0x427eab
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x427e96
mov byte [esi], dl
jmp 0x427ea7
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x44b068]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x427ef3
cmp byte [ebp - 1], 0xa
jne 0x427eba
cmp esi, ebx
jne 0x427eba
mov byte [esi], 0xa
jmp 0x427ef2
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00430f31
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x427ef3
mov byte [esi], 0xd
jmp 0x427ef2
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x44b068]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x427ef0
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x427ef3
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x427efc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x44b068]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x427f42
cmp word [ebx], dx
jne 0x427f42
or byte [eax + edi + 0x28], 4
jmp 0x427f47
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x4280aa
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x42808a
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x427f88
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x427fbe
cmp eax, edx
jae 0x427fcc
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x427f63
jmp 0x4280aa
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x428085
cmp dword [ebp - 0x18], 0
je 0x428085
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x44b068]
test byte [eax + edi + 0x28], 0x48
je 0x42805b
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x42801f
mov word [esi], cx
jmp 0x428056
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x44b068]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x44b068]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x44b068]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x4280aa
pop eax
cmp word [ebp - 4], ax
jne 0x42806b
cmp esi, ebx
jne 0x42806b
mov word [esi], ax
jmp 0x4280a7
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00430f31
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x4280aa
push 0xd
pop eax
jmp 0x428066
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x44b068]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x4280a4
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x4280aa
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x42ba10
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x42baad
push ebx
push esi
call fcn.0042b9d9
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0042b96d
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x42ba5a
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42baac
push edi
push eax
call fcn.00425980
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x42ba7a
call fcn.0042533e
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42baab
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0042b96d
add esp, 0x20
test eax, eax
jne 0x42ba99
push edi
call fcn.0042533e
jmp 0x42baa1
push ebx
call fcn.0042533e
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x4347e5
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.00434761
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x434954
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x434954
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x434909
jg 0x434841
test eax, eax
je 0x4348ff
push 1
push 0x1000
call fcn.00426deb
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x434864
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x4348f6
push 0x8000
push ebx
call fcn.004239bb
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x43488d
jg 0x434888
cmp ecx, 0x1000
jb 0x43488d
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.00430004
add esp, 0x10
cmp eax, 0xffffffff
je 0x4348d2
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x434888
jl 0x4348b9
test ecx, ecx
jne 0x43487a
push dword [ebp - 0xc]
push ebx
call fcn.004239bb
push esi
call fcn.0042533e
add esp, 0xc
xor ebx, ebx
jmp 0x434962
cmp byte [edi + 0x24], 0
je 0x4348e9
cmp dword [edi + 0x20], 5
jne 0x4348e9
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x4348f4
mov ebx, dword [edi + 0x18]
jmp 0x4348f6
xor ebx, ebx
push esi
call fcn.0042533e
pop ecx
jmp 0x434962
test ecx, ecx
jg 0x4348cb
jl 0x434909
test eax, eax
jae 0x4348cb
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00430f31
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x434929
cmp byte [edi + 0x1c], 0
je 0x4348cb
jmp 0x43495a
push ebx
call fcn.0042c204
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x4348cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x434962
cmp byte [edi + 0x1c], 0
je 0x43495f
mov ebx, dword [edi + 0x18]
jmp 0x434962
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.00430f31
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x434b40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x434b6d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x434b6d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x232e50cf
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x3ac12ffc
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x710c7a
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x7109ec
add edx, edi
and edi, edx
call fcn.00710cbb
or edx, edi
dec edi
and edi, edx
xor dword [eax], ebx
mov edx, 0xb5cb3c68
or edi, edx
inc eax
add edi, edi
and edi, edx
cmp eax, ecx
jne fcn.00710c7a
sub esp, 4
mov dword [esp], 0x4b8dc9c8
mov edx, dword [esp]
add esp, 4
inc edi
and edi, edi
ret
Function at 0x409978
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409a4b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409a64
push ebx
push 0x409a70
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00403388
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402750
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004033e8
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x4099f8
mov al, 0x69
call fcn.0040961c
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040994c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a01
call fcn.0040994c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a52
lea eax, [ebp - 4]
call fcn.0040316c
ret

Function at 0x409b04
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409bb8
jmp 0x409bad
cmp dword [esi + 0x10], 0x1000
jne 0x409b99
test byte [esi + 0x15], 1
jne 0x409b99
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409b58
cmp eax, 2
je 0x409b58
cmp eax, 0x10
je 0x409b58
cmp eax, 0x20
jne 0x409b6d
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409b6d
mov bl, 1
xor ebp, ebp
jmp 0x409b7e
mov eax, dword [esi]
add eax, ebp
call fcn.00409afc
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409b71
test bl, bl
je 0x409b99
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409bb8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409b30
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x401225
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40a01c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [0x40a020], 0x401219
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
mov dword [0x40a038], eax
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
lea eax, [0x40803c]
fnstenv [eax]
push 0
push 0x40a030
push 0x40a02c
push 0x40a028
call sub.CRTDLL.DLL___GetMainArgs
mov ecx, 0x408058
mov edx, dword [ecx]
or edx, edx
je 0x40129f
call ecx
push dword [0x40a030]
push dword [0x40a02c]
push dword [0x40a028]
mov dword [0x40a014], esp
call fcn.004012d4
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x401b10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp edi, 1
je 0x401b9e
cmp edi, 4
jne 0x401b93
mov eax, dword [sym.imp.CRTDLL.DLL__iob]
add eax, 0x40
push eax
push 1
push 7
push str.signal
call sub.CRTDLL.DLL_fwrite
push 0xa
lea eax, [ebp - 0x80]
push eax
push dword [ebp + 0xc]
call sub.CRTDLL.DLL__itoa
add esp, 0x1c
lea ecx, [ebp - 0x80]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x401b57
mov ebx, dword [sym.imp.CRTDLL.DLL__iob]
add ebx, 0x40
push ebx
push 1
push eax
lea esi, [ebp - 0x80]
push esi
call sub.CRTDLL.DLL_fwrite
add esp, 0x10
mov eax, dword [sym.imp.CRTDLL.DLL__iob]
add eax, 0x40
push eax
push 1
push 1
push 0x40a214
call sub.CRTDLL.DLL_fwrite
add esp, 0x10
jmp 0x401b9e
cmp edi, 3
je 0x401b9e
push dword [ebp + 0xc]
call edi
pop ecx
pop edi
pop esi
pop ebx
leave
ret