joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48fb48
Capabilities:
Create thread

Disassembly:
push esi
push 0
push 0x400
mov dword [0x4bcdc4], 0
mov dword [0x4bcdb8], 1
push 0x48fb35
call dword [sym.imp.MSVCR71.dll__beginthread]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0xc
push 0x10
call esi
mov dword [0x4bcdb8], 0
push 1
call esi
mov eax, dword [0x4bcdc4]
mov ecx, dword [0x4bcdc4]
shr eax, 3
xor eax, ecx
mov ecx, dword [0x4bcdc0]
shr eax, 3
xor eax, ecx
mov ecx, dword [0x4bcdc4]
xor eax, ecx
mov dword [0x4bcdc4], eax
and dword [0x4bcdc4], 7
mov eax, dword [0x4bcdc4]
mov dword [0x4bcdc0], eax
mov eax, dword [0x4bcdbc]
mov ecx, dword [0x4bcdc4]
shl eax, 3
xor eax, ecx
mov dword [0x4bcdbc], eax
mov eax, dword [0x4bcdbc]
pop esi
ret
call 0x48fb48
call 0x48fb48
call 0x48fb48
call 0x48fb48
call 0x48fb48
call 0x48fb48
call 0x48fb48
call 0x48fb48
call 0x48fb48
call 0x48fb48
jmp 0x48fb48

Function at 0x490320
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x4b9c40]
cmp dword [eax + 0x22c], 0
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 8], ebx
jne 0x4903ec
mov eax, dword [ebx + 8]
test eax, eax
jl 0x4903ec
cmp eax, 1
jg 0x4903ec
push dword [ebx + 4]
call fcn.00491ac0
test eax, eax
pop ecx
je 0x4903ec
cmp dword [ebp + 0x10], 1
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
mov ecx, ebx
push esi
jne 0x49037b
call fcn.004904df
jmp 0x490380
call fcn.0049046a
mov eax, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
add eax, 0xffffffe2
cmp eax, 5
mov dword [edi], eax
jl 0x4903ec
xor edx, edx
test eax, eax
jle 0x4903be
mov dword [ebp + 8], 0xffffffe2
sub dword [ebp + 8], esi
lea ecx, [esi + 0x1e]
mov al, byte [edx + esi]
xor byte [ecx], al
lea eax, [edx + 1]
cdq
push 0x1e
pop ebx
idiv ebx
mov eax, dword [ebp + 8]
inc ecx
add eax, ecx
cmp eax, dword [edi]
jl 0x4903a3
mov ebx, dword [ebp - 8]
push 0x1e
push esi
push dword [edi]
lea eax, [esi + 0x1e]
push eax
push dword [ebx + 8]
mov ecx, ebx
push dword [ebx + 4]
call fcn.00490078
test al, al
je 0x4903ec
push dword [edi]
lea eax, [esi + 0x1e]
push eax
push esi
call dword [sym.imp.MSVCR71.dll_memmove]
add esp, 0xc
mov al, 1
jmp 0x4903ee
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4904df
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 0xc]
push ebx
xor ebx, ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
xor esi, esi
mov dword [edx], ebx
mov byte [ebp - 1], bl
mov byte [ebp - 5], bl
mov byte [ebp - 6], bl
mov byte [ebp - 7], bl
mov byte [ebp - 8], bl
xor ecx, ecx
cmp byte [ebp - 1], bl
jne 0x490570
mov eax, dword [ebp - 0xc]
mov al, byte [eax + edi]
inc dword [ebp - 0xc]
xor ebx, ebx
cmp al, bl
je 0x490567
cmp al, 0x41
jl 0x490528
cmp al, 0x5a
jg 0x490528
sub al, 0x41
jmp 0x49053e
cmp al, 0x61
jl 0x490534
cmp al, 0x7a
jg 0x490534
sub al, 0x47
jmp 0x49053e
cmp al, 0x30
jl 0x490544
cmp al, 0x39
jg 0x490544
add al, 4
mov byte [ebp + ecx - 8], al
jmp 0x49055f
cmp al, 0x2b
jne 0x49054f
mov byte [ebp + ecx - 8], 0x3e
jmp 0x49055f
cmp al, 0x2f
jne 0x49055a
mov byte [ebp + ecx - 8], 0x3f
jmp 0x49055f
cmp al, 0x3d
jne 0x490560
inc esi
inc ecx
cmp ecx, 4
jl 0x490508
jmp 0x490570
push 4
pop esi
mov byte [ebp - 1], 1
sub esi, ecx
cmp ecx, ebx
jne 0x490579
cmp byte [ebp - 1], bl
jne 0x4905de
mov al, byte [ebp - 7]
mov cl, byte [ebp - 8]
mov bl, al
shr bl, 4
and bl, 3
shl cl, 2
or bl, cl
mov cl, byte [ebp - 6]
mov byte [ebp + 8], bl
mov bl, cl
shl al, 4
shr bl, 2
and bl, 0xf
or bl, al
mov al, byte [ebp - 5]
and al, 0x3f
shl cl, 6
or al, cl
mov byte [ebp + 0xa], al
push 3
pop eax
mov byte [ebp + 9], bl
xor ebx, ebx
sub eax, esi
xor ecx, ecx
cmp eax, ebx
jle 0x4905d1
mov edx, dword [edx]
mov bl, byte [ebp + ecx + 8]
mov byte [edi + edx], bl
mov edx, dword [ebp + 0xc]
inc dword [edx]
inc ecx
cmp ecx, eax
jl 0x4905bc
xor ebx, ebx
cmp esi, ebx
jne 0x4905de
cmp byte [ebp - 1], bl
je 0x4904fa
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x490c30
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, 1
push ebp
call fcn.00490910
mov edi, eax
mov ebx, dword [esp + 0x14]
xor eax, eax
mov ecx, 0xe
mov dword [edi + 0x134], eax
mov dword [edi + 0x130], eax
xor dword [edi + 0x9c], ebx
mov ebp, 0x25
mov eax, ecx
sub ebx, esi
add ecx, 0xe
cdq
idiv ebp
mov eax, esi
xor dword [edi + edx*4 + 0x9c], esi
mov esi, ebx
cmp ecx, 0x206
mov ebx, eax
jl 0x490c5d
mov esi, 0x3e8
call fcn.00490ba0
dec esi
jne 0x490c86
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x492010
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
push ebx
push esi
mov ebx, dword [esp + 0x18]
push edi
push ebp
mov edi, 5
mov eax, dword [esp + 0x1c]
push ebx
push eax
call fcn.00491ef0
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x18]
push ebx
push eax
call fcn.00491ef0
mov ecx, dword [esp + 0x2c]
add esp, 8
sub esi, eax
mov eax, dword [esp + 0x28]
mov dword [ecx], 1
mov dword [eax], 0
jne 0x492060
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov dword [esp + 0x10], 0
cmp ebx, 5
jg 0x492077
mov dword [esp + 0x10], 1
mov edi, ebx
test esi, esi
mov esi, 1
jg 0x492085
mov esi, 0xffffffff
lea ebp, [ebx - 1]
sub ebx, edi
cmp ebp, ebx
jle 0x4920c5
mov ecx, dword [esp + 0x24]
add esi, esi
mov eax, dword [esp + 0x1c]
push ebp
push eax
inc dword [ecx]
call fcn.00491ef0
add esp, 8
mov edi, eax
mov eax, dword [esp + 0x18]
push ebp
push eax
call fcn.00491ef0
add esp, 8
sub edi, eax
je 0x4920c0
jle 0x4920bb
inc esi
test edi, edi
jge 0x4920c0
dec esi
dec ebp
cmp ebp, ebx
jg 0x49208e
cmp dword [esp + 0x10], 0
jne 0x4920e2
mov eax, esi
cdq
xor eax, edx
sub eax, edx
and eax, 1
xor eax, edx
sub eax, edx
je 0x4920e2
mov ecx, dword [esp + 0x28]
inc dword [ecx]
mov eax, esi
cdq
xor eax, edx
sub eax, edx
and eax, 1
xor eax, edx
sub eax, edx
jne 0x492116
mov eax, esi
mov ecx, dword [esp + 0x28]
cdq
sub eax, edx
inc dword [ecx]
sar eax, 1
mov edx, dword [esp + 0x24]
mov esi, eax
dec dword [edx]
cdq
xor eax, edx
sub eax, edx
and eax, 1
xor eax, edx
sub eax, edx
je 0x4920f2
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret

Function at 0x495630
Capabilities:
Hash data using sha1

Disassembly:
mov edx, dword [esp + 4]
push edi
xor eax, eax
mov ecx, 0x50
lea edi, [edx + 0x1c]
rep stosd dword es:[edi], eax
mov dword [edx + 4], eax
mov dword [edx], eax
mov dword [edx + 8], 0x67452301
mov dword [edx + 0xc], 0xefcdab89
mov dword [edx + 0x10], 0x98badcfe
mov dword [edx + 0x14], 0x10325476
mov dword [edx + 0x18], 0xc3d2e1f0
pop edi
ret
Function at 0x4956c0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x20
add ecx, 0x1c
push ebx
push esi
mov edx, ecx
push edi
mov esi, 0x40
push ebp
mov eax, dword [edx + 8]
xor eax, dword [edx + 0x20]
xor eax, dword [edx + 0x34]
xor eax, dword [edx]
add edx, 4
mov edi, eax
add eax, eax
shr edi, 0x1f
or edi, eax
dec esi
mov dword [edx + 0x3c], edi
jne 0x4956d5
mov ebx, dword [esp + 0x34]
mov eax, dword [ebx + 8]
mov edx, dword [ebx + 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x20], edx
mov esi, eax
mov ebp, dword [ebx + 0x18]
mov edi, ebp
mov dword [esp + 0x24], eax
mov eax, dword [ebx + 0x14]
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x14
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
shr ebx, 0x1b
xor eax, esi
and eax, edx
mov ebp, dword [esp + 0x10]
shl ebp, 5
xor eax, dword [esp + 0x14]
or ebx, ebp
add ecx, 4
add eax, ebx
add eax, dword [ecx - 4]
lea ebx, [eax + edi + 0x5a827999]
mov edi, dword [esp + 0x14]
mov dword [esp + 0x14], esi
mov esi, edx
shl esi, 0x1e
shr edx, 2
or esi, edx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x10], ebx
dec dword [esp + 0x18]
jne 0x49572d
mov ebx, dword [esp + 0x34]
mov ecx, 0x14
add ebx, 0x6c
mov eax, dword [esp + 0x10]
mov ebp, dword [esp + 0x10]
shr eax, 0x1b
add ebx, 4
shl ebp, 5
or eax, ebp
mov ebp, edx
xor ebp, dword [esp + 0x14]
xor ebp, esi
add eax, ebp
add eax, dword [ebx - 4]
lea ebp, [eax + edi + 0x6ed9eba1]
mov edi, dword [esp + 0x14]
mov dword [esp + 0x14], esi
mov esi, edx
shl esi, 0x1e
shr edx, 2
or esi, edx
mov edx, dword [esp + 0x10]
dec ecx
mov dword [esp + 0x10], ebp
jne 0x495784
mov dword [esp + 0x18], 0x14
mov ecx, dword [esp + 0x34]
add ecx, 0xbc
mov ebx, edx
mov eax, edx
or ebx, esi
and eax, esi
and ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x10]
shl ebp, 5
or ebx, eax
mov eax, dword [esp + 0x10]
add ecx, 4
shr eax, 0x1b
or eax, ebp
add ebx, eax
add ebx, dword [ecx - 4]
lea eax, [ebx + edi - 0x70e44324]
mov edi, dword [esp + 0x14]
mov dword [esp + 0x14], esi
mov esi, edx
shl esi, 0x1e
shr edx, 2
or esi, edx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x10], eax
dec dword [esp + 0x18]
jne 0x4957da
mov ecx, dword [esp + 0x34]
mov ebx, 0x14
add ecx, 0x10c
mov eax, dword [esp + 0x10]
mov ebp, dword [esp + 0x10]
shr eax, 0x1b
add ecx, 4
shl ebp, 5
or eax, ebp
mov ebp, edx
xor ebp, dword [esp + 0x14]
xor ebp, esi
add eax, ebp
add eax, dword [ecx - 4]
lea ebp, [eax + edi - 0x359d3e2a]
mov edi, dword [esp + 0x14]
mov dword [esp + 0x14], esi
mov esi, edx
shl esi, 0x1e
shr edx, 2
or esi, edx
mov edx, dword [esp + 0x10]
dec ebx
mov dword [esp + 0x10], ebp
jne 0x495836
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x34]
add eax, ebp
add edx, dword [esp + 0x20]
add esi, dword [esp + 0x24]
mov dword [ebx + 8], eax
mov eax, dword [esp + 0x28]
add edi, dword [esp + 0x2c]
add eax, dword [esp + 0x14]
mov dword [ebx + 0xc], edx
pop ebp
mov dword [ebx + 0x10], esi
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x18], edi
pop edi
pop esi
pop ebx
add esp, 0x20
ret
Function at 0x4958b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
push ebp
push 0x80
mov edi, dword [esi]
mov ebx, dword [esi + 4]
push esi
call fcn.00495670
add esp, 8
mov eax, dword [esi]
and eax, 0x1ff
cmp eax, 0x1c0
je 0x4958f2
push 0
push esi
call fcn.00495670
add esp, 8
mov eax, dword [esi]
and eax, 0x1ff
cmp eax, 0x1c0
jne 0x4958d9
push esi
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], edi
call fcn.004956c0
mov ebp, dword [esp + 0x1c]
add esp, 4
xor edi, edi
mov eax, edi
mov cl, 3
cdq
and edx, 3
add eax, edx
sar eax, 2
mov ebx, dword [esi + eax*4 + 8]
mov eax, edi
cdq
xor eax, edx
inc edi
sub eax, edx
and eax, 3
xor eax, edx
sub eax, edx
sub cl, al
shl cl, 3
shr ebx, cl
mov byte [edi + ebp - 1], bl
cmp edi, 0x14
jl 0x495907
push esi
call fcn.00495630
add esp, 4
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x497a6c
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x74
push 0x4a45c8
call fcn.00497dcc
xor ebx, ebx
mov dword [ebp - 0x20], ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x497aac
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x497aac
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x497ac4
cmp eax, 0x20b
je 0x497ab1
mov dword [ebp - 0x1c], ebx
jmp 0x497ad8
cmp dword [ecx + 0x84], 0xe
jbe 0x497aac
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x497ad2
cmp dword [ecx + 0x74], 0xe
jbe 0x497aac
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.MSVCR71.dll___set_app_type]
pop ecx
or dword [0x4bcdcc], 0xffffffff
or dword [0x4bcdd0], 0xffffffff
call dword [sym.imp.MSVCR71.dll___p__fmode]
mov ecx, dword [0x4b9c54]
mov dword [eax], ecx
call dword [sym.imp.MSVCR71.dll___p__commode]
mov ecx, dword [0x4b9c50]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR71.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x4bcdc8], eax
call fcn.00497e3c
call fcn.00497edc
cmp dword [0x4b8490], ebx
jne 0x497b38
push fcn.00497edc
call dword [sym.imp.MSVCR71.dll___setusermatherr]
pop ecx
call fcn.00497eca
push 0x4b5054
push 0x4b5050
call sub.MSVCR71.dll__initterm
push 0x497e80
call fcn.00497a0a
mov eax, dword [0x4b9c4c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x4b9c48]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCR71.dll___getmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, ebx
jge 0x497b8c
push 8
call sub.MSVCR71.dll__amsg_exit
pop ecx
push 0x4b504c
push section..data
call sub.MSVCR71.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR71.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x24], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x497c0a
cmp al, bl
je 0x497bb6
cmp dword [ebp - 0x20], ebx
jne 0x497c0a
mov al, byte [esi]
cmp al, bl
je 0x497bc6
cmp al, 0x20
ja 0x497bc6
inc esi
mov dword [ebp - 0x24], esi
jmp 0x497bb6
mov dword [ebp - 0x58], ebx
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x58], 1
je 0x497be2
movzx eax, word [ebp - 0x54]
jmp 0x497be5
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call fcn.00468974
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], ebx
jne 0x497c02
push esi
call dword [sym.imp.MSVCR71.dll_exit]
call dword [sym.imp.MSVCR71.dll__cexit]
jmp 0x497c5f
cmp al, 0x22
jne 0x497c19
xor ecx, ecx
cmp dword [ebp - 0x20], ebx
sete cl
mov dword [ebp - 0x20], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR71.dll__ismbblead]
pop ecx
test eax, eax
je 0x497c2c
inc esi
mov dword [ebp - 0x24], esi
inc esi
jmp 0x497ba4
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.00497e07
ret
Function at 0x40122c
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x74
push 0x402148
call fcn.00401514
xor ebx, ebx
mov dword [ebp - 0x20], ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x40126c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40126c
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x401284
cmp eax, 0x20b
je 0x401271
mov dword [ebp - 0x1c], ebx
jmp 0x401298
cmp dword [ecx + 0x84], 0xe
jbe 0x40126c
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x401292
cmp dword [ecx + 0x74], 0xe
jbe 0x40126c
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.MSVCR71.dll___set_app_type]
pop ecx
or dword [0x403068], 0xffffffff
or dword [0x40306c], 0xffffffff
call dword [sym.imp.MSVCR71.dll___p__fmode]
mov ecx, dword [0x403060]
mov dword [eax], ecx
call dword [sym.imp.MSVCR71.dll___p__commode]
mov ecx, dword [0x40305c]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR71.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x403064], eax
call fcn.00401470
call fcn.00401510
cmp dword [0x403040], ebx
jne 0x4012f8
push fcn.00401510
call dword [sym.imp.MSVCR71.dll___setusermatherr]
pop ecx
call fcn.004014fe
push 0x40300c
push 0x403008
call sub.MSVCR71.dll__initterm
push 0x4014b4
call fcn.0040145e
mov eax, dword [0x403058]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x403054]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCR71.dll___getmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, ebx
jge 0x40134c
push 8
call sub.MSVCR71.dll__amsg_exit
pop ecx
push 0x403004
push section..data
call sub.MSVCR71.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR71.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x24], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x4013ca
cmp al, bl
je 0x401376
cmp dword [ebp - 0x20], ebx
jne 0x4013ca
mov al, byte [esi]
cmp al, bl
je 0x401386
cmp al, 0x20
ja 0x401386
inc esi
mov dword [ebp - 0x24], esi
jmp 0x401376
mov dword [ebp - 0x58], ebx
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x58], 1
je 0x4013a2
movzx eax, word [ebp - 0x54]
jmp 0x4013a5
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call fcn.004011e0
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], ebx
jne 0x4013c2
push esi
call dword [sym.imp.MSVCR71.dll_exit]
call dword [sym.imp.MSVCR71.dll__cexit]
jmp 0x40141f
cmp al, 0x22
jne 0x4013d9
xor ecx, ecx
cmp dword [ebp - 0x20], ebx
sete cl
mov dword [ebp - 0x20], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR71.dll__ismbblead]
pop ecx
test eax, eax
je 0x4013ec
inc esi
mov dword [ebp - 0x24], esi
inc esi
jmp 0x401364
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0040154f
ret
Function at 0x401000
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x5993f0
push eax
push dword fs:[0]
xchg ebx, eax
pop ecx
add byte [eax + 0x64], dl
push dword [0]
mov dword fs:[0], esp
xor eax, eax
mov dword [eax], ecx
push eax
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x401080
arpl word [edx + esi], si
adc ebx, dword [edi - 0x54]
xchg ebx, eax
neg dl
push cs
dec ecx
mov eax, 0x7fb97088
add ah, ah
aam 0xeb
jp 0x40109d
mov byte [eax - 0x47], dh
jg 0x401033
mov ecx, 0xd4e4027f
in al, 0xd4
jmp 0x4010af
test eax, 0xcf33638c
adc ch, bl
js 0x400fd0
sbb ch, ah
daa
stosd dword es:[edi], eax
mov dword [0x540fb128], eax
xchg edi, eax
inc ecx
and dword [esi + esi*8 - 0x78], ebp
rcr byte [eax - 0x2e], 0xa4
sti
push ss
scasd eax, dword es:[edi]
jne 0x40108b
jl 0x40102c
salc
pushal
jbe 0x401085
daa
xchg esp, eax
lcall 0xa4e8, 0x1020bb2d
mov ebx, 0xa4e81020
push eax
in eax, dx
xor bl, ah
sti
bnd jg 0x401002
popal
lea ebp, [edx - 0x70bb56c6]
push ds
pop ss
cmp dword [eax + ebx*8 + 0x46], eax
and byte [eax - 0x702274c0], al
pop eax
test al, 0xc5
fisttp qword [edi + 0x3dc5a858]
lahf
mov ah, 0xc2
sub ecx, dword [0x6e1df55c]
cmp eax, 0x2bc2b49f
or eax, 0x6e1df55c
pop esp
cmc
sbb eax, 0x97530b6e
or edx, dword [ebx - 0x69]
in al, 0x34
sub dword [edi], edx
stosd dword es:[edi], eax
loop 0x4010a6
shr byte [edx - 0x45d61c4d], 1
arpl word [edi - 0x278de9a], dx
sub dword [edx + 0x21669763], edi
xchg ebp, edi
jo 0x4010b7
adc byte [ebx - 0x7b], dh
jae 0x40102e
xlatb
in al, dx
scasd eax, dword es:[edi]
rol dword [0xffffd0cf], 1
fisub dword [edx + 0x3d]
xchg edi, eax
xchg ebp, eax
push 0xa7e35ce0
iretd
loopne 0x401115
jecxz 0x401062
jmp 0x4010fb
and dh, byte es:[esp + ebp*4 - 0x23]
pop edx
enter 0xffffffffffffeae3, 0xffffffffffffff98
stosd dword es:[edi], eax
add eax, 0x6eeca138
out 0x20, eax
fcomp qword [edi + ecx*8 - 0x11]
aas
dec edi
sub bh, byte [eax + 0x37]
xor edx, dword [edx]
rol byte [eax + 0x43], 0xbe
call 0x994340fd
sub dword [edx + edx*8], 0x59
or byte [ebp + 0x4d], 0x13
mov ebp, 0x837088a5
in al, 0xcf
sti
sub dword [eax - 0x26fb9b57], esp
stosd dword es:[edi], eax
xlatb
mov byte [0xfd0f3f20], al
push ebp
cmp byte [esi + esi*2 - 0xf8a4bf2], dh
out dx, eax
in eax, 0x55
iretd
add dword [edi], eax
jp 0x401155
fnstenv [esi]
rcr dword [esi + ecx - 0x3170fcc3], 0xaa
dec ecx
cld
inc edx
inc eax
push ecx
lds edx, [ecx - 0x55b53a8b]
cld
test byte [ebp + edx*4 + 0x19], dh
push cs
loop 0x4010bd
add ebp, dword [ebp - 0x39]
jg 0x401198
fcom qword [0x6d805a99]
fidiv dword [ebx - 7]
inc ebp
movsd dword es:[edi], dword [esi]
xchg ecx, eax
rcl dl, cl
xor esp, dword [ecx - 0x3e5e23c6]
and cl, byte [edx - 0x55]
pop ss
cmp byte [ebp + 0x15], dl
aas
pop edx
sbb dl, dh
push ebp
adc eax, 0xd61a5a3f
dec edx
or al, dl
retf 0x6e55
invalid
Function at 0x4024a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4024b9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4024f4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4024f0
lea ebx, [ebx]
cmp esi, eax
jae 0x4024f4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4024e0
cmp esi, eax
jb 0x4024fa
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x402c40
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x24
lea eax, [esp + 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x402c7c
lea ecx, [esp + 8]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x402c82
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add esp, 0x24
ret
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push 0
push 0
push 0x10
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x14]
push 0
push eax
mov dword [esp + 0x28], 1
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x402ccf
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add esp, 0x24
ret
mov eax, 1
add esp, 0x24
ret
Function at 0x405930
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x108
mov eax, dword [0x443d44]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
mov ebx, ecx
test ebx, ebx
ja 0x405963
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0041e4c4
add esp, 0x108
ret
push 0x103
lea eax, [esp + 9]
push 0
push eax
mov byte [esp + 0x10], 0
call fcn.00420a90
add esp, 0xc
push 0x104
lea ecx, [esp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 4]
push str..exe
push edx
call fcn.0041f370
mov ecx, dword [str..dll]
mov dword [eax], ecx
mov dl, byte [0x43b0ec]
mov byte [eax + 4], dl
add esp, 8
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40594b
call fcn.0040bd20
test eax, eax
je 0x40594b
push ebp
push edi
push ebx
lea ecx, [esp + 0x10]
call fcn.0040c310
mov ebp, eax
xor ebx, ebx
add esp, 4
cmp ebp, ebx
je 0x4059e7
mov dword [esi + 0x1024], ebx
mov eax, dword [esi + 0x1010]
cmp eax, ebx
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x405a00
push eax
call edi
mov dword [esi + 0x1010], ebx
mov eax, dword [esi + 0x1014]
cmp eax, ebx
je 0x405a13
push eax
call edi
mov dword [esi + 0x1014], ebx
mov ecx, dword [esp + 0x110]
pop edi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.0041e4c4
add esp, 0x108
ret

Function at 0x405a30
Capabilities:
Create process on windows
Create process suspended

Disassembly:
sub esp, 0x74
push ebx
push esi
push edi
mov edi, eax
lea edx, [eax + 1]
xor ebx, ebx
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x405a40
sub eax, edx
add eax, 2
push eax
call fcn.0040c8d3
mov esi, eax
mov eax, edi
add esp, 4
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x405a60
sub eax, edx
add eax, 2
push eax
push ebx
push esi
call fcn.00420a90
mov eax, edi
add esp, 0xc
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x405a80
sub eax, edx
push edi
add eax, 2
push eax
push esi
call fcn.0041f2fd
mov eax, edi
add esp, 0xc
lea edi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x405aa0
sub eax, edi
mov byte [eax + esi], 0x20
xor eax, eax
push 0x44
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x3c]
push ebx
push eax
mov dword [esp + 0x34], ebx
call fcn.00420a90
add esp, 0xc
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x3c]
push edx
push ebx
push ebx
push 0x4000000
mov eax, 0xc
push ebx
mov dword [esp + 0x34], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x38]
push ecx
push esi
push ebx
mov dword [esp + 0x60], 0x44
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push esi
mov edi, eax
call fcn.0040c8ce
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x88]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 4
push ecx
mov dword [eax], edx
call esi
mov edx, dword [esp + 0x28]
push edx
call esi
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x74
ret 4