joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c0100
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x5a4294]
mov edx, dword fs:[0x2c]
mov eax, dword [0x5a55d0]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4c012b
mov ecx, 0x5a55c8
pop ebp
jmp fcn.004815c0
push 0x5a55d0
call fcn.00527357
add esp, 4
cmp dword [0x5a55d0], 0xffffffff
jne 0x4c0120
mov dword [0x5a55cc], 0
mov dword [0x5a55c8], 0
mov ecx, 0x5a55c8
push 0
call fcn.00481630
push 0x5a55d0
call fcn.005273cd
add esp, 4
jmp 0x4c0120

Function at 0x4c0db0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
lea edi, [ecx + 0xc]
lea eax, [ecx + 0x10]
push 0x228
push 0
push eax
call fcn.0052b7c0
add esp, 0xc
mov dword [esi + 0xc], 0x22c
cmp byte [esi + 8], 0
je 0x4c0de5
push edi
push dword [esi + 4]
call sub.KERNEL32.dll_Process32NextW
jmp 0x4c0df2
mov byte [esi + 8], 1
push edi
push dword [esi + 4]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
setne al
pop esi
pop edi
pop ebp
ret

Function at 0x4c15cc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov esi, dword [0x5a05c4]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
xor esi, ebp
mov dword [ebp - 8], esi
mov esi, SysReAllocString
cmp edx, esi
cmovb esi, edx
lea edx, [ebp - 0xc]
push 0
push edx
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4c160f
mov esi, dword [ebp - 0xc]
cmp esi, 0xffffffff
jne 0x4c1612
int3
xor esi, esi
dec esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00527311
mov eax, esi
add esp, 8
pop esi
pop ebp
ret

Function at 0x4c1624
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [0x5a05c4]
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov esi, SysReAllocString
xor ecx, ebp
cmp eax, esi
cmovb esi, eax
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 0x14]
push 0
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4c168a
mov eax, dword [sym.imp.KERNEL32.dll_GetFileType]
mov ebx, dword [ebp - 0x14]
test ebx, ebx
jne 0x4c169c
push edi
mov ebx, eax
call eax
cmp eax, 3
jne 0x4c16b5
push 0
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov eax, ebx
jne 0x4c1662
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x6d
setne bl
neg ebx
jmp 0x4c16a1
cmp ebx, 0xffffffff
je 0x4c16ba
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00527311
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, dword [ebp - 0x14]
jmp 0x4c16a1
int3
Function at 0x4c1c52
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xac
mov eax, dword [0x5a05c4]
mov esi, dword [ebp + 8]
xor ebx, ebx
xor eax, ebp
mov dword [ebp - 0xc], eax
push ebx
push ebx
push ebx
push esi
call fcn.004c1b69
add esp, 0x10
or edx, eax
jne 0x4c1cd5
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov bl, 1
test eax, eax
jne 0x4c1cd5
push 2
call fcn.0043e5e0
add esp, 4
test al, al
je 0x4c1cd3
call fcn.0043ef80
lea esi, [ebp - 0xb4]
mov ecx, esi
push eax
push 2
push 0xf3
push str..._.._third_party_crashpad_crashpad_util_file_file_io_win.cc
call fcn.0043f140
lea eax, [ebp - 0xac]
push 0xc
push 0x56ef76
push eax
call fcn.004058b5
add esp, 0xc
mov ecx, esi
call fcn.0043f200
xor ebx, ebx
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00527311
mov eax, ebx
add esp, 0xac
pop esi
pop ebx
pop ebp
ret
Function at 0x4d67a8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ecx, dword [0x5a4294]
mov edx, dword fs:[0x2c]
mov eax, dword [0x5a5e10]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4d67fa
cmp edi, esi
je 0x4d67f3
xor eax, eax
dec eax
movzx ecx, byte [edi]
movzx edx, al
shr eax, 8
inc edi
xor edx, ecx
xor eax, dword [edx*4 + 0x5a5a10]
cmp esi, edi
jne 0x4d67d8
not eax
jmp 0x4d67f5
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x5a5e10
call fcn.00527357
add esp, 4
cmp dword [0x5a5e10], 0xffffffff
jne 0x4d67d1
xor eax, eax
mov ecx, 8
mov edx, eax
mov ebx, edx
and edx, 1
neg edx
shr ebx, 1
and edx, 0xedb88320
xor edx, ebx
dec ecx
jne 0x4d6819
mov dword [eax*4 + 0x5a5a10], edx
inc eax
cmp eax, 0x100
jne 0x4d6812
push 0x5a5e10
call fcn.005273cd
add esp, 4
jmp 0x4d67d1
Function at 0x4df1a8
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004f3d10

Function at 0x4e749c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0xac
mov eax, dword [0x5a05c4]
mov esi, ecx
xor eax, ebp
mov dword [ebp - 8], eax
xor eax, eax
push eax
push eax
push ecx
push 0x4e7510
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 4], eax
je 0x4e74de
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00527311
add esp, 0xac
pop esi
pop ebp
ret
call fcn.0043ef80
lea esi, [ebp - 0xb0]
mov ecx, esi
push eax
push 3
push 0x19
push str..._.._third_party_crashpad_crashpad_util_thread_thread_win.cc
call fcn.0043f140
mov ecx, esi
call fcn.0043f200
jmp 0x4e74cb
Function at 0x4f078a
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edx, dword [ebp + 0xc]
cmp edx, 0x40
jb 0x4f07de
mov ecx, dword [ebp + 8]
cmp byte [ecx], 0x4d
jne 0x4f07de
cmp byte [ecx + 1], 0x5a
jne 0x4f07de
mov esi, dword [ecx + 0x3c]
mov edi, edx
xor eax, eax
sub edi, esi
cmp edi, 0x18
jb 0x4f07e0
cmp esi, edx
jae 0x4f07e0
cmp esi, 0x40
jb 0x4f07e0
mov edi, esi
and edi, 7
jne 0x4f07e0
cmp byte [ecx + esi], 0x50
jne 0x4f07de
cmp byte [ecx + esi + 1], 0x45
jne 0x4f07de
cmp byte [ecx + esi + 2], 0
jne 0x4f07de
cmp byte [ecx + esi + 3], 0
je 0x4f07e4
xor eax, eax
pop esi
pop edi
pop ebp
ret
add esi, 0x18
xor eax, eax
sub edx, esi
jbe 0x4f07e0
cmp edx, 2
jb 0x4f07e0
movzx eax, word [ebp + 0x10]
cmp word [ecx + esi], ax
sete al
jmp 0x4f07e0

Function at 0x4f3d10
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov esi, dword [ebp + 8]
mov eax, dword [0x5a05c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, esi
cmp byte [esi + 0xb], 0
jns 0x4f3d33
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4f3d66
and eax, 0x410
cmp eax, 0x410
jne 0x4f3d66
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00527311
mov ecx, esi
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.004f3e41
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x4f3d70
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov bl, 1
test eax, eax
jne 0x4f3e2a
push 2
call fcn.0043e5e0
add esp, 4
test al, al
je 0x4f3e28
call fcn.0043ef80
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x94
push str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
call fcn.0043f140
lea eax, [ebp - 0xb0]
push 0xb
push str.DeleteFile
push eax
call fcn.004058b5
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x4f3dd5
mov eax, dword [esi + 4]
mov esi, dword [esi]
lea ebx, [ebp - 0xc4]
push eax
push esi
push ebx
call fcn.00449130
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x4f3dfa
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push edi
call fcn.004058b5
add esp, 0xc
xor eax, eax
cmp byte [ebp - 0xb9], al
jns 0x4f3e1d
push dword [ebp - 0xc4]
call fcn.005272d6
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.0043f200
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00527311
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4f3e41
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov eax, dword [0x5a05c4]
mov esi, ecx
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, ecx
cmp byte [ecx + 0xb], 0
jns 0x4f3e63
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov bl, 1
test eax, eax
jne 0x4f3f1a
push 2
call fcn.0043e5e0
add esp, 4
test al, al
je 0x4f3f18
call fcn.0043ef80
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x2f
push str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
call fcn.0043f140
lea eax, [ebp - 0xb0]
push 0x10
push str.RemoveDirectory
push eax
call fcn.004058b5
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x4f3ec5
mov eax, dword [esi + 4]
mov esi, dword [esi]
lea ebx, [ebp - 0xc4]
push eax
push esi
push ebx
call fcn.00449130
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x4f3eea
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push edi
call fcn.004058b5
add esp, 0xc
xor eax, eax
cmp byte [ebp - 0xb9], al
jns 0x4f3f0d
push dword [ebp - 0xc4]
call fcn.005272d6
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.0043f200
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00527311
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4f64f0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xcc
mov eax, dword [0x5a05c4]
lea esi, [ebp - 0x30]
xor eax, ebp
mov dword [ebp - 0xc], eax
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esi + 0x14], 0x100
jb 0x4f655c
push 1
call fcn.0043e5e0
add esp, 4
test al, al
je 0x4f655c
lea esi, [ebp - 0xd4]
mov ecx, esi
push 1
push 0xb0
push str..._.._third_party_crashpad_crashpad_snapshot_win_system_snapshot_win.cc
call fcn.0043e680
lea eax, [ebp - 0xd0]
push 0x2c
push str.dwNumberOfProcessors_exceeds_uint8_t_storage
push eax
call fcn.004058b5
add esp, 0xc
mov ecx, esi
call fcn.0043ea30
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov ebx, 0xff
cmp eax, 0x100
cmovb ebx, eax
xor ecx, ebp
call fcn.00527311
mov eax, ebx
add esp, 0xcc
pop esi
pop ebx
pop ebp
ret
Function at 0x507eec
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xe8
mov eax, dword [0x5a05c4]
lea edi, [ecx + 0x10]
mov esi, ecx
mov ecx, edi
xor eax, ebp
mov dword [ebp - 0x10], eax
call fcn.00508882
lea ebx, [ebp - 0x50]
mov ecx, esi
push ebx
push 0
push 0x40
push edx
push eax
call fcn.0050c704
test al, al
je 0x507f8a
movzx eax, word [ebp - 0x50]
cmp eax, 0x5a4d
jne 0x507fc7
mov ecx, edi
call fcn.00508882
mov ebx, eax
mov eax, dword [ebp - 0x14]
mov ecx, esi
mov edi, eax
sar edi, 0x1f
add ebx, eax
adc edi, edx
push dword [ebp + 8]
push 0
push 0x108
push edi
push ebx
call fcn.0050c704
test al, al
je 0x508001
mov eax, dword [ebp + 8]
cmp dword [eax], 0x4550
jne 0x50803b
mov eax, dword [ebp + 0xc]
mov ecx, ebx
mov bl, 1
test eax, eax
je 0x508099
mov dword [eax], ecx
mov dword [eax + 4], edi
jmp 0x508099
push 1
call fcn.0043e5e0
add esp, 4
test al, al
je 0x508097
lea edi, [ebp - 0xf4]
mov ecx, edi
push 1
push 0x154
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
call fcn.0043e680
lea eax, [ebp - 0xf0]
push 0x1f
push str.could_not_read_dos_header_from
jmp 0x50806f
push 1
call fcn.0043e5e0
add esp, 4
test al, al
je 0x508097
lea edi, [ebp - 0xf4]
mov ecx, edi
push 1
push 0x15a
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
call fcn.0043e680
lea eax, [ebp - 0xf0]
push 0x21
push str.invalid_e_magic_in_dos_header_of
jmp 0x50806f
push 1
call fcn.0043e5e0
add esp, 4
test al, al
je 0x508097
lea edi, [ebp - 0xf4]
mov ecx, edi
push 1
push 0x162
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
call fcn.0043e680
lea eax, [ebp - 0xf0]
push 0x1f
push str.could_not_read_nt_headers_from
jmp 0x50806f
push 1
call fcn.0043e5e0
add esp, 4
test al, al
je 0x508097
lea edi, [ebp - 0xf4]
mov ecx, edi
push 1
push 0x168
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
call fcn.0043e680
lea eax, [ebp - 0xf0]
push 0x23
push str.invalid_signature_in_nt_headers_of
push eax
call fcn.004058b5
add esp, 0xc
movzx ecx, byte [esi + 0xb]
test cl, cl
jns 0x508085
mov ecx, dword [esi + 4]
mov esi, dword [esi]
push ecx
push esi
push eax
call fcn.004058b5
add esp, 0xc
mov ecx, edi
call fcn.0043ea30
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00527311
mov eax, ebx
add esp, 0xe8
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x5080b2
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xe8
mov eax, dword [0x5a05c4]
lea edi, [ecx + 0x10]
mov esi, ecx
mov ecx, edi
xor eax, ebp
mov dword [ebp - 0x10], eax
call fcn.00508882
lea ebx, [ebp - 0x50]
mov ecx, esi
push ebx
push 0
push 0x40
push edx
push eax
call fcn.0050c704
test al, al
je 0x508150
movzx eax, word [ebp - 0x50]
cmp eax, 0x5a4d
jne 0x50818d
mov ecx, edi
call fcn.00508882
mov ebx, eax
mov eax, dword [ebp - 0x14]
mov ecx, esi
mov edi, eax
sar edi, 0x1f
add ebx, eax
adc edi, edx
push dword [ebp + 8]
push 0
push 0xf8
push edi
push ebx
call fcn.0050c704
test al, al
je 0x5081c7
mov eax, dword [ebp + 8]
cmp dword [eax], 0x4550
jne 0x508201
mov eax, dword [ebp + 0xc]
mov ecx, ebx
mov bl, 1
test eax, eax
je 0x50825f
mov dword [eax], ecx
mov dword [eax + 4], edi
jmp 0x50825f
push 1
call fcn.0043e5e0
add esp, 4
test al, al
je 0x50825d
lea edi, [ebp - 0xf4]
mov ecx, edi
push 1
push 0x154
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
call fcn.0043e680
lea eax, [ebp - 0xf0]
push 0x1f
push str.could_not_read_dos_header_from
jmp 0x508235
push 1
call fcn.0043e5e0
add esp, 4
test al, al
je 0x50825d
lea edi, [ebp - 0xf4]
mov ecx, edi
push 1
push 0x15a
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
call fcn.0043e680
lea eax, [ebp - 0xf0]
push 0x21
push str.invalid_e_magic_in_dos_header_of
jmp 0x508235
push 1
call fcn.0043e5e0
add esp, 4
test al, al
je 0x50825d
lea edi, [ebp - 0xf4]
mov ecx, edi
push 1
push 0x162
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
call fcn.0043e680
lea eax, [ebp - 0xf0]
push 0x1f
push str.could_not_read_nt_headers_from
jmp 0x508235
push 1
call fcn.0043e5e0
add esp, 4
test al, al
je 0x50825d
lea edi, [ebp - 0xf4]
mov ecx, edi
push 1
push 0x168
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
call fcn.0043e680
lea eax, [ebp - 0xf0]
push 0x23
push str.invalid_signature_in_nt_headers_of
push eax
call fcn.004058b5
add esp, 0xc
movzx ecx, byte [esi + 0xb]
test cl, cl
jns 0x50824b
mov ecx, dword [esi + 4]
mov esi, dword [esi]
push ecx
push esi
push eax
call fcn.004058b5
add esp, 0xc
mov ecx, edi
call fcn.0043ea30
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00527311
mov eax, ebx
add esp, 0xe8
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x54edbe
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0054edc9

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x401000
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ebp, esp
add esp, 0xfffffffc
push esi
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
mov dword [0x403cdc], eax
lea ecx, [ebp - 4]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov eax, dword [ebp + 4]
mov dword [0x403b2d], eax
xor eax, eax
mov ecx, 0x16
push eax
dec ecx
jne 0x401031
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
lea ecx, [ebp - 0x5c]
push ecx
mov eax, 0x30
mov dword [ecx], eax
mov eax, dword [0x403b2d]
mov dword [ebp - 0x48], eax
mov eax, 0x40168b
mov dword [ebp - 0x54], eax
mov ecx, str.Hello
mov dword [ebp - 0x34], ecx
call dword [sym.imp.USER32.dll_RegisterClassExA]
xor ecx, ecx
push ecx
push dword [0x403b2d]
push ecx
push ecx
push 0x12e
push 0x7a
push 0x34c
push 0x2aa
push 0x40000
lea eax, str.klavesn
push eax
mov eax, str.Hello
push eax
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x403d28], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x403d28]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor ebx, ebx
lea edi, [ebp - 0x50]
jmp 0x4010ce
push edi
call dword [sym.imp.USER32.dll_TranslateMessage]
push edi
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_GetMessageA]
test al, al
jne 0x4010c0
mov esp, ebp
ret

Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x150b0027
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0xe5c5869
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x2dc73836
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
mov eax, str.pere
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x653078d1
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x423604
Capabilities:
Encode data using xor

Disassembly:
push 0x657fd94a
fnstcw word [edi + 0x65]
out 0x98, eax
xor dword [esi + 0x253ab8c5], ebp
in al, 0xa1
add eax, 0x231c173c
inc dword ds:[edi]
loope 0x423648
sbb dword [edx - 0x15], edi
sbb eax, 0x60a64703
clc
cmc
mov ebx, 0xe668bfaa
jmp 0x5ca4d20e
js 0x423602
outsb dx, byte [esi]
out 0xdd, al
and ebp, dword [edx - 0x19dae3b2]
xchg ecx, eax
insd dword es:[edi], dx
lea edi, [ebx]
das
sbb eax, 0x5fa97c53
xor dword [esi - 0xe], ecx
fnsave dword [edi - 0x59037844]
fcmovnb st(0), st(7)
xchg edi, eax
fld qword [ecx + 0x8f5d620]
push ds
invalid

Function at 0x4f4e1e
Capabilities:
Encode data using xor

Disassembly:
retf 0xdef1
mov dl, 0x7a
iretd
rcl ebp, cl
mov ch, 0xd
xchg ecx, eax
add al, 0xc7
salc
scasd eax, dword es:[edi]
or byte [ebx], bh
push esi
jp 0x4f4e8b
jecxz 0x4f4e89
popal
cmpsd dword [esi], dword es:[edi]
sub al, 0xd8
push ebx
inc ebx
push esp
cmc
or esi, esp
jb 0x4f4dc1
sbb eax, 0x367222a9
pushal
jle 0x4f4e45
les esi, [eax + 0x33fb3316]
lahf
pop esp
stc
pop esi
clc
mov al, 0x16
xor edi, ebx
xor ebx, dword [edi - 0x7a106a4]
dec esp
loopne 0x4f4e43
or cl, byte [eax - 0x56844c81]
jl 0x4f4df9
and dword [esi], 0xffffffa0
add ecx, ebp
add dword [ebx + 0x51], ebx
fild qword [ebx + 0x62a8006f]
mov dl, 0x8f
retf
cmpsb byte [esi], byte es:[edi]
sub byte [edi - 0x532a1d3a], dl
mov ch, 4
push ss
mov eax, 0xbccc5f47
dec eax
mov al, byte [0x88b1a]
popfd
cli
in eax, dx
mov ss, word [esi]
xchg edi, eax
invalid
mov ecx, dword [eax]
add byte [ebp - 0x71991206], bl
push ss
mov dword [edx + ebx*8 + 0x5b], ebx
jnp 0x4f4e9b
lodsb al, byte [esi]
mov dword [0x6adb5165], eax
pop esp
loopne 0x4f4eea
iretd
ret 0x7b3b

Function at 0x51573d
Capabilities:
Encode data using xor

Disassembly:
inc esp
xor eax, 0xeacf96ef
cmp dword [esi + eax*8 + 0x2e70175c], 0x73
xor esi, edx
pop eax
stosd dword es:[edi], eax
insb byte es:[edi], dx
loope 0x5156dd
iretd
loopne 0x5156dc
dec ebp
mov al, byte [0x9478109a]
and al, 0x7f
adc ch, ah
inc edx
sti
fcomp st(6)
invalid

Function at 0x5f4df1
Capabilities:
Encode data using xor

Disassembly:
push ecx
xor ah, byte [bp + si - 0x45f9]
jb fcn.005f4df1
stc
fistp word [ecx]
jae 0x5f4e0e
hlt
dec esp
mov esp, 0xc490429d
fidiv dword [esi]
jns 0x5f4e5a
sub eax, 0x1c30b00
push ds
or al, 0xb1
jmp 0xb7c736f4
or al, 0x80
or al, 0xf0
aas
fucompi st(4)
leave
inc eax
push edx
frstor dword [ecx]
lea esp, [eax]
loopne 0x5f4e16
xchg dword [edx + ebp*4 + 0x7ca37d9d], eax
inc ecx
ljmp 0xc735
pushfd
add byte [ebx - 0x2f], bh
wait
fcom qword [esi]
sar byte [eax - 0xb], 0xce
sub dword [esi], ebx
jnp 0x5f4e38
sbb eax, 0xa568d399
cmp edi, dword [ecx]
enter 0x16c, 0x67
mov dh, 0x44
popal
and dword [ebp - 0x3d664410], 0xfd3c280d
push es
mov edx, 0xfed5ef50
and edx, dword [ecx]
test eax, 0xa2d1d0af
dec eax
daa
jl 0x5f4f02
pop ebp
movsb byte es:[edi], byte [esi]
in al, 8
enter 0x38a3, 0xffffffffffffffe3
xor ebp, ecx
and byte [eax + 0x6b], ah
mov esp, 0xa211dcd6
jecxz 0x5f4e97
lahf
pushfd
adc dl, byte [esi + 0x56bdaf0e]
cmp dh, byte gs:[edx]
jmp 0x5f4e94
inc edi
lds ebp, [eax]
int3
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219