joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6165a1
Capabilities:
Encode data using xor

Disassembly:
invalid
pushfd
inc ebp
mov ch, 0x75
xlatb
sub al, 0x3a
and dword ds:[ecx + 0x72225371], edi
ja 0x61652e
jmp 0x61656a
leave
lds edx, [esi + esi*2 - 0x1eca5419]
call 0xd5bb971d
xor eax, 0x49cef844
enter 0xffffffffffffbfb4, 0xffffffffffffff9f
mov esi, 0x1a47a8ad
xor byte [eax - 0xa09be], ah
mov cl, 0x1f
xchg byte [edx - 0x49], dl
mov esp, 0xe2a34b35
and al, 0x6a
push edi
loop 0x6165bc
push 0x57
dec eax
aad 0x84
jae 0x6165c5
mov bh, 0x74
mov al, 0x9c
je 0x616553
pushfd
movsd dword es:[edi], dword [esi]
xchg ebp, eax
xor al, 0x35
jmp 0xdfd95142
rol dword [ebx + 4], 0xa2
xchg ebp, eax
xchg byte [edx], al
into
pop ebx
xor byte [eax - 0xf8fe15b], dl
nop
movsd dword es:[edi], dword [esi]
push ds
jo 0x6165b1
stosd dword es:[edi], eax
mov ecx, 0x80495aca
jmp 0x6165dc
dec ecx
sub bl, 0x13
int1
salc
xchg ecx, eax
mov cl, 0x55
sub eax, 0x19ee2bff
mov ah, 0x9d
mov al, 0xe4
xchg esp, eax
in al, 0x94
jns 0x6165e0
or byte [esi + 0x22], bh
jle 0x616600
je 0x616596
mov ch, 0x89
ror dword [ebp + 0x28], cl
pushfd
sbb eax, 0x95fb48bc
mov ebx, edx
dec ebp
sub byte [ebp + ebx - 0x6a04b744], bl
adc al, 0x35
lds ebx, [ebx]
inc edi
xchg edi, eax
add dword [edx + 0x15176c14], esp
pop edx
jae 0x61661b
rcr byte [eax + 0xbe4d7de], 0x6d
insd dword es:[edi], dx
xchg ebp, eax
dec esi
lahf
lahf
inc edx
cmp eax, 0x91e3178b
cmp ah, ah
sal byte [0x47490095], 1
add ah, bl
inc esp
mov eax, dword [0x152e6a31]
push ebp
jns 0x616677
adc eax, 0x1587955
mov al, 0x9d
mov ecx, 0xb0ebef9f
xchg edx, eax
mov bl, 0xed
cmc
iretd
add dword [eax - 0x10604663], esi
jmp 0x6165d7
salc
inc eax
insd dword es:[edi], dx
test edx, edi
and al, 0
mov esp, 0x45e71580
push ecx
outsd dx, dword [esi]
movsb byte es:[edi], byte [esi]
shr dword [ebp + edx*8 - 0x1a], 1
rcl ebp, 0xe1
cdq
or dl, byte [edx + 0x15173c15]
cli
xor eax, 0x6ac77641
xor byte [edi - 2], dl
invalid

Function at 0x64ec05
Capabilities:
Encode data using xor

Disassembly:
loopne 0x64ec19
mov bl, 0x99
push ebp
xor eax, 0x6c71465
cmp ecx, dword [ebx - 0x2f]
test eax, 0x8a28b28b
xchg ebx, eax
mov ebp, 0x9d0102a5
popfd
pop edx
aad 0xf3
xchg esi, eax
stosb byte es:[edi], al
lodsb al, byte [esi]
mov dword [edx - 0xa8e2a1c], ebp
xor eax, 0x97800882
jns 0x64ec20
inc ebp
xlatb
invalid
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x2112c3b
nop
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x79b71685
nop
nop
nop
test eax, eax
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x401608
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
test esi, esi
sete dl
test ebx, ebx
sete al
xor ecx, ecx
or dl, al
jne 0x401727
mov edx, dword [ebp + 0xc]
lea eax, [edx*4 + 0xb]
mov edx, 0xc
mov ecx, edx
cdq
idiv ecx
lea eax, [eax*4 + 1]
cmp dword [ebp + 0x14], eax
jge 0x40168f
push 0x6f
call sub.KERNEL32.DLL_SetLastError
xor ecx, ecx
jmp 0x401727
and eax, 3
shl eax, 4
movzx eax, byte [eax + section.l469ghqo]
mov byte [ecx + 2], 0x3d
mov byte [ecx + 3], 0x3d
mov byte [ecx + 1], al
add ecx, 4
jmp 0x40171f
and eax, 0xf
movzx eax, byte [eax*4 + section.l469ghqo]
mov byte [ecx + 3], 0x3d
mov byte [ecx + 2], al
mov ecx, esi
jmp 0x40171f
xor edi, edi
cmp edi, dword [ebp + 0xc]
mov ecx, esi
jge 0x40171f
movzx eax, byte [ebx]
shr al, 2
movzx eax, al
movzx eax, byte [eax + section.l469ghqo]
mov byte [esi], al
mov esi, dword [ebp + 0xc]
movzx eax, byte [ebx]
sub esi, edi
cmp esi, 1
je 0x401656
mov edx, eax
and edx, 3
shl edx, 4
movzx eax, byte [ebx + 1]
shr al, 4
movzx eax, al
or edx, eax
cmp esi, 2
lea esi, [ecx + 4]
movzx eax, byte [edx + section.l469ghqo]
mov byte [ecx + 1], al
movzx eax, byte [ebx + 1]
je 0x401676
mov edx, eax
movzx eax, byte [ebx + 2]
and edx, 0xf
add edi, 3
shl edx, 2
shr al, 6
movzx eax, al
or edx, eax
movzx eax, byte [edx + section.l469ghqo]
mov byte [ecx + 2], al
movzx eax, byte [ebx + 2]
add ebx, 3
and eax, 0x3f
movzx eax, byte [eax + section.l469ghqo]
mov byte [ecx + 3], al
jmp 0x401691
mov byte [ecx], 0
mov ecx, 1
lea esp, [ebp - 0xc]
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x401732
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
push 0
push 0xa7
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
mov dword [ebp - 0x10], 0
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 0x18], eax
cmp eax, 0xffffffff
sete dl
test eax, eax
sete al
xor ecx, ecx
or dl, al
jne 0x401818
push 0
push dword [ebp - 0x18]
call sub.KERNEL32.DLL_GetFileSize
push eax
push 0
mov dword [ebp - 0x14], eax
call sub.KERNEL32.DLL_GetProcessHeap
push eax
call sub.KERNEL32.DLL_HeapAlloc
test eax, eax
mov edi, eax
je 0x4017b9
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push edi
push dword [ebp - 0x18]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x4017c5
push edi
push 0
call sub.KERNEL32.DLL_GetProcessHeap
push eax
call sub.KERNEL32.DLL_HeapFree
push dword [ebp - 0x18]
call sub.KERNEL32.DLL_CloseHandle
xor ecx, ecx
jmp 0x401818
mov eax, dword [ebp - 0x14]
mov edx, 0xc
mov ebx, edx
xor edx, edx
lea ecx, [eax*4 + 0xb]
mov eax, ecx
div ebx
lea esi, [eax*4 + 1]
push esi
push 0x40
call sub.KERNEL32.DLL_GlobalAlloc
push esi
mov ebx, eax
push eax
push dword [ebp - 0x14]
push edi
call fcn.00401608
mov edx, dword [ebp + 0xc]
add esp, 0x10
mov dword [edx], eax
push edi
push 0
call sub.KERNEL32.DLL_GetProcessHeap
push eax
call sub.KERNEL32.DLL_HeapFree
push dword [ebp - 0x18]
call sub.KERNEL32.DLL_CloseHandle
mov ecx, ebx
lea esp, [ebp - 0xc]
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x42c780
Capabilities:
Query environment variable

Disassembly:
push ebx
push edi
push esi
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
call fcn.00433180
test al, al
je 0x42c7b4
push 2
call dword [0x460e34]
add esp, 4
push ebx
push edi
push esi
push str.libunwind:__Unwind_SetGR_context_p__reg_d__value0x_0x__n
push eax
call fcn.0042c000
add esp, 0x14
pop esi
pop edi
pop ebx
jmp fcn.00433260
Function at 0x432ba0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
cmp eax, 3
ja case.default.0x432bb1
jmp dword [eax*4 + 0x459928]
cmp dword [0x4610dc], 0
je 0x432cb3
push 0x4610e0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x4610f8]
test edi, edi
je 0x432ca8
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x432bfb
mov edi, dword [edi + 8]
test edi, edi
je 0x432ca8
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x432bf0
test esi, esi
je 0x432bf0
mov ecx, dword [edi + 4]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
jmp 0x432bf0
cmp dword [0x4610dc], 0
jne 0x432c30
push 0x4610e0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4610dc], 1
jmp case.default.0x432bb1
call fcn.0042b7b0
jmp case.default.0x432bb1
cmp dword [0x4610dc], 0
je case.default.0x432bb1
push 0x4610e0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x4610f8]
test edi, edi
je 0x432d03
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x432c87
mov edi, dword [edi + 8]
test edi, edi
je 0x432d03
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x432c80
test esi, esi
je 0x432c80
mov ecx, dword [edi + 4]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
jmp 0x432c80
push 0x4610e0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x4610dc]
cmp eax, 1
jne case.default.0x432bb1
mov eax, dword [0x4610f8]
test eax, eax
je 0x432ce2
nop word cs:[eax + eax]
mov esi, dword [eax + 8]
push eax
call fcn.00455e46
add esp, 4
mov eax, esi
test esi, esi
jne 0x432cd0
mov dword [0x4610f8], 0
mov dword [0x4610dc], 0
push 0x4610e0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
jmp case.default.0x432bb1
push 0x4610e0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x432e30
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push edi
push esi
mov esi, dword [0x456004]
movzx ecx, word [esi]
xor eax, eax
cmp ecx, 0x5a4d
jne 0x432e96
mov ecx, dword [esi + 0x3c]
cmp dword [esi + ecx], 0x4550
jne 0x432e96
add esi, ecx
movzx ecx, word [esi + 0x18]
cmp ecx, 0x10b
jne 0x432e96
movzx ecx, word [esi + 6]
test ecx, ecx
je 0x432e96
mov edx, dword [esp + 0xc]
sub edx, dword [0x456004]
movzx edi, word [esi + 0x14]
add esi, edi
add esi, 0x18
jmp 0x432e86
add esi, 0x28
dec ecx
je 0x432e96
mov edi, dword [esi + 0xc]
cmp edi, edx
ja 0x432e80
add edi, dword [esi + 8]
cmp edi, edx
jbe 0x432e80
mov eax, esi
pop esi
pop edi
ret
Function at 0x4330d0
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0xc]
cmp byte [0x46226f], 1
jne 0x4330ee
cmp byte [0x46226e], 0
jne 0x43310d
jmp 0x433128
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x46226f], 1
test eax, eax
setne byte [0x46226e]
je 0x433128
push 2
call dword [0x460e34]
add esp, 4
push edi
push esi
push str.libunwind:___unw_init_local_cursor_p__context_p__n
push eax
call fcn.0042caa0
add esp, 0x10
mov dword [esi], 0x459b14
mov dword [esi + 4], 0x462168
movups xmm0, xmmword [edi]
movups xmm1, xmmword [edi + 0x10]
movups xmmword [esi + 8], xmm0
movups xmmword [esi + 0x18], xmm1
movups xmm0, xmmword [edi + 0x20]
movups xmmword [esi + 0x28], xmm0
movups xmm0, xmmword [edi + 0x30]
movups xmmword [esi + 0x38], xmm0
xorps xmm0, xmm0
movups xmmword [esi + 0x48], xmm0
movups xmmword [esi + 0x58], xmm0
movups xmmword [esi + 0x62], xmm0
mov ecx, esi
push 0
call fcn.00433d80
xor eax, eax
pop esi
pop edi
ret

Function at 0x433180
Capabilities:
Query environment variable

Disassembly:
cmp byte [0x46226f], 1
jne 0x433194
cmp byte [0x46226e], 0
setne al
ret
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
test eax, eax
setne al
setne byte [0x46226e]
mov byte [0x46226f], 1
ret

Function at 0x4331c0
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp byte [0x46226f], 1
jne 0x4331e4
cmp byte [0x46226e], 0
jne 0x433203
jmp 0x43321f
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x46226f], 1
test eax, eax
setne byte [0x46226e]
je 0x43321f
push 2
call dword [0x460e34]
add esp, 4
push ebx
push ebp
push esi
push str.libunwind:___unw_get_reg_cursor_p__regNum_d__value_p__n
push eax
call fcn.0042caa0
add esp, 0x14
mov eax, dword [esi]
mov edi, dword [eax + 8]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push ebp
call edi
mov ecx, eax
mov eax, 0xffffe672
test cl, cl
je 0x433252
mov eax, dword [esi]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push ebp
call edi
mov dword [ebx], eax
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x433260
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x44]
mov ebx, dword [esp + 0x40]
mov esi, dword [esp + 0x3c]
cmp byte [0x46226f], 1
jne 0x433287
cmp byte [0x46226e], 0
jne 0x4332a6
jmp 0x4332c2
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x46226f], 1
test eax, eax
setne byte [0x46226e]
je 0x4332c2
push 2
call dword [0x460e34]
add esp, 4
push ebp
push ebx
push esi
push str.libunwind:___unw_set_reg_cursor_p__regNum_d__value0x_x__n
push eax
call fcn.0042caa0
add esp, 0x14
mov eax, dword [esi]
mov edi, dword [eax + 8]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push ebx
call edi
mov edi, 0xffffe672
test al, al
je 0x433352
mov eax, dword [esi]
mov edi, dword [eax + 0x10]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push ebp
push ebx
call edi
xor edi, edi
cmp ebx, 0xffffffff
jne 0x433352
mov eax, dword [esi]
mov ebx, dword [eax + 0x24]
mov ecx, ebx
call dword [section..00cfg]
mov eax, esp
mov ecx, esi
push eax
call ebx
mov eax, dword [esi]
mov ebx, dword [eax + 0x34]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, esi
push 0
call ebx
cmp dword [esp + 0x10], 0
je 0x433352
mov eax, dword [esi]
mov ebx, dword [eax + 0xc]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, esi
push 0xfffffffffffffffe
call ebx
mov ebx, eax
add ebx, dword [esp + 0x10]
mov eax, dword [esi]
mov ebp, dword [eax + 0x10]
mov ecx, ebp
call dword [section..00cfg]
mov ecx, esi
push ebx
push 0xfffffffffffffffe
call ebp
mov eax, edi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x433360
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
cmp byte [0x46226f], 1
jne 0x43337a
cmp byte [0x46226e], 0
jne 0x433399
jmp 0x4333b3
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x46226f], 1
test eax, eax
setne byte [0x46226e]
je 0x4333b3
push 2
call dword [0x460e34]
add esp, 4
push esi
push str.libunwind:___unw_step_cursor_p__n
push eax
call fcn.0042caa0
add esp, 0xc
mov eax, dword [esi]
mov edi, dword [eax + 0x20]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push 0
call edi
pop esi
pop edi
ret

Function at 0x4333d0
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
cmp byte [0x46226f], 1
jne 0x4333ea
cmp byte [0x46226e], 0
jne 0x433409
jmp 0x433423
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x46226f], 1
test eax, eax
setne byte [0x46226e]
je 0x433423
push 2
call dword [0x460e34]
add esp, 4
push esi
push str.libunwind:___unw_step_stage2_cursor_p__n
push eax
call fcn.0042caa0
add esp, 0xc
mov eax, dword [esi]
mov edi, dword [eax + 0x20]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push 1
call edi
pop esi
pop edi
ret
Function at 0x433440
Capabilities:
Query environment variable

Disassembly:
push ebx
push edi
push esi
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
cmp byte [0x46226f], 1
jne 0x43345f
cmp byte [0x46226e], 0
jne 0x43347e
jmp 0x433499
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x46226f], 1
test eax, eax
setne byte [0x46226e]
je 0x433499
push 2
call dword [0x460e34]
add esp, 4
push ebx
push esi
push str.libunwind:___unw_get_proc_info_cursor_p__info_p__n
push eax
call fcn.0042caa0
add esp, 0x10
mov eax, dword [esi]
mov edi, dword [eax + 0x24]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push ebx
call edi
xor ecx, ecx
cmp dword [ebx + 4], 0
mov eax, 0xffffe66b
cmovne eax, ecx
pop esi
pop edi
pop ebx
ret

Function at 0x4334c0
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
cmp byte [0x46226f], 1
jne 0x4334da
cmp byte [0x46226e], 0
jne 0x4334f9
jmp 0x433513
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x46226f], 1
test eax, eax
setne byte [0x46226e]
je 0x433513
push 2
call dword [0x460e34]
add esp, 4
push esi
push str.libunwind:___unw_resume_cursor_p__n
push eax
call fcn.0042caa0
add esp, 0xc
mov eax, dword [esi]
mov edi, dword [eax + 0x28]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
call edi
mov eax, 0xffffe674
pop esi
pop edi
ret

Function at 0x433530
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp byte [0x46226f], 1
jne 0x433554
cmp byte [0x46226e], 0
jne 0x433573
jmp 0x43358f
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x46226f], 1
test eax, eax
setne byte [0x46226e]
je 0x43358f
push 2
call dword [0x460e34]
add esp, 4
push ebp
push ebx
push esi
push str.libunwind:___unw_get_proc_name_cursor_p__buf_p__bufLen_lu__n
push eax
call fcn.0042caa0
add esp, 0x14
mov eax, dword [esi]
mov edi, dword [eax + 0x30]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push dword [esp + 0x20]
push ebp
push ebx
call edi
xor ecx, ecx
test al, al
mov eax, 0xffffe674
cmovne eax, ecx
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x433a30
Capabilities:
Query environment variable

Disassembly:
cmp byte [0x46226d], 1
jne 0x433a44
cmp byte [0x46226c], 0
setne al
ret
push str.LIBUNWIND_PRINT_UNWINDING
call sub.msvcrt.dll_getenv
add esp, 4
test eax, eax
setne al
setne byte [0x46226c]
mov byte [0x46226d], 1
ret
Function at 0x436c40
Capabilities:
Enumerate process modules
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x101c
call fcn.0042bd14
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x1c]
push ecx
push 0x1000
push edx
push eax
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x436da2
mov ecx, dword [esp + 0x18]
xor edx, edx
mov eax, 0
cmp ecx, 4
jb 0x436df9
shr ecx, 2
cmp ecx, 2
mov eax, 1
cmovae eax, ecx
mov dword [esp + 0xc], eax
mov bl, 1
mov dword [esp + 0x10], ecx
jmp 0x436cba
mov edx, dword [esp + 0x14]
inc edx
mov ecx, dword [esp + 0x10]
cmp edx, ecx
setb bl
xor eax, eax
cmp edx, dword [esp + 0xc]
je 0x436df9
mov byte [esp + 3], bl
mov dword [esp + 0x14], edx
mov esi, dword [esp + edx*4 + 0x1c]
mov eax, dword [esi + 0x3c]
movzx ecx, word [esi + eax + 0x14]
mov edx, dword [esp + 0x1034]
mov dword [edx], esi
mov dword [esp + 8], esi
movzx esi, word [esi + eax + 6]
test esi, esi
je 0x436ca0
add eax, dword [esp + 8]
lea ebp, [eax + ecx]
add ebp, 0x18
mov dword [esp + 4], 0
xor ebx, ebx
jmp 0x436d06
add ebp, 0x28
dec esi
je 0x436ca0
mov edi, dword [ebp + 0xc]
add edi, dword [esp + 8]
push 8
push str..text
push ebp
call sub.msvcrt.dll_strncmp
add esp, 0xc
test eax, eax
je 0x436d40
push 8
push str..eh_frame
push ebp
call sub.msvcrt.dll_strncmp
add esp, 0xc
test eax, eax
je 0x436d70
test bl, 1
jne 0x436d8f
jmp 0x436d00
mov eax, dword [ebp + 8]
add eax, edi
mov ecx, dword [esp + 0x1030]
cmp eax, ecx
movzx eax, bl
mov ebx, eax
mov edx, 1
cmova ebx, edx
cmp edi, ecx
cmova ebx, eax
test bl, 1
jne 0x436d8f
jmp 0x436d00
mov ecx, dword [esp + 0x1034]
mov dword [ecx + 4], edi
mov eax, dword [ebp + 8]
mov dword [ecx + 8], eax
mov al, 1
mov dword [esp + 4], eax
test bl, 1
je 0x436d00
mov eax, dword [esp + 4]
and al, 1
je 0x436d00
movzx eax, byte [esp + 3]
jmp 0x436df9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp byte [0x46226d], 1
jne 0x436dbe
cmp byte [0x46226c], 0
jne 0x436ddd
jmp 0x436df7
push str.LIBUNWIND_PRINT_UNWINDING
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x46226d], 1
test eax, eax
setne byte [0x46226c]
je 0x436df7
push 2
call dword [0x460e34]
add esp, 4
push esi
push str.libunwind:_findUnwindSections:_EnumProcessModules_failed__returned_error__d_n
push eax
call fcn.0042caa0
add esp, 0xc
xor eax, eax
and al, 1
add esp, 0x101c
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x414ac0
Capabilities:
Encode data using xor

Disassembly:
add esp, dword [esi]
xor eax, 0x817f539e
sbb dword [esi - 0x52], edx
mov eax, 0xd0ed9488
xor ah, byte [eax - 0x576255b9]
push eax
xor byte [eax - 0x58d1960e], 0xef
scasd eax, dword es:[edi]
xor byte [edx], bl
push esi
adc eax, 0xaf14b8d4
push 0xd0ee3668
mov al, 6
push eax
das
cmpsd dword [esi], dword es:[edi]
mov esi, 0xa9a72ff4
pop ss
sar byte [eax], 0x17
scasd eax, dword es:[edi]
cmp byte [ecx - 0x6ed0af30], cl
xchg ebp, eax
scasd eax, dword es:[edi]
rcr byte [eax + 0x56], 1
scasd eax, dword es:[edi]
rcr byte [eax + 0x56], 1
scasd eax, dword es:[edi]
rcr byte [eax + 0x56], 1
scasd eax, dword es:[edi]
rcr byte [eax - 0x57], 1
push eax
das
cmpsd dword [esi], dword es:[edi]
push esi
scasd eax, dword es:[edi]
rcr byte [eax - 0x57], 1
push eax
das
cmpsd dword [esi], dword es:[edi]
push esi
scasd eax, dword es:[edi]
rcr byte [eax + 0x56], 1
scasd eax, dword es:[edi]
rcr byte [eax + 0x56], 1
scasd eax, dword es:[edi]
rcr byte [eax + 0x56], 1
scasd eax, dword es:[edi]
push ebx
mov ah, 0x52
push 0x7ba7cd4
xchg edx, eax
pop eax
pop edi
push esp
lahf
xor byte [esi - 0x21], dl
xchg ecx, eax
pop eax
sbb al, ch
push 0x5695d480
jecxz 0x414ade
invalid
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
popal
nop
nop
nop
jmp loc.00401219