joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008e40
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x10040f29
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x10050fc0]
xor eax, esp
mov dword [esp + 0x214], eax
push esi
push edi
mov eax, dword [0x10050fc0]
xor eax, esp
push eax
lea eax, [esp + 0x224]
mov dword fs:[0], eax
mov edi, dword [esp + 0x238]
lea eax, [esp + 0x234]
push eax
lea ecx, [esp + 0x18]
push str.CLSID_
push ecx
mov dword [esp + 0x238], 0
mov dword [esp + 0x28], 0x200
call fcn.10007130
push str.InprocServer32
push eax
lea edx, [esp + 0x24]
push edx
mov byte [esp + 0x244], 1
call fcn.10007050
add esp, 0x18
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x22c], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10008eed
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push ecx
push 0xf003f
xor esi, esi
push esi
push edx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10008fc9
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x24]
push ecx
push esi
push esi
push 0x10043690
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10008fbe
lea eax, [esp + 0x20]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10008f40
sub eax, edx
push eax
lea eax, [esp + 0x24]
push eax
mov ecx, edi
call fcn.10001920
mov eax, dword [edi]
mov esi, dword [eax - 0xc]
push 0x5c
push eax
call fcn.100291fb
add esp, 8
test eax, eax
jne 0x10008f6f
or eax, 0xffffffff
jmp 0x10008f71
sub eax, dword [edi]
sub esi, eax
dec esi
push esi
lea ecx, [esp + 0x1c]
push ecx
mov ecx, edi
call fcn.10005e40
push eax
mov ecx, edi
mov byte [esp + 0x230], 4
call fcn.100019b0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x22c], 3
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10008fb9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, 1
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x22c], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10008ff1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x234]
add eax, 0xfffffff0
mov dword [esp + 0x22c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000901f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x224]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1002742c
add esp, 0x224
ret 8
Function at 0x10009a60
Capabilities:
Get common file path
Print debug messages
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x1004114b
mov eax, dword fs:[0]
push eax
sub esp, 0x134
mov eax, dword [0x10050fc0]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push esi
mov eax, dword [0x10050fc0]
xor eax, esp
push eax
lea eax, [esp + 0x140]
mov dword fs:[0], eax
mov esi, dword [esp + 0x150]
xor eax, eax
xor ebx, ebx
push 0x104
mov dword [esp + 0x2d], eax
mov dword [esp + 0x31], eax
mov byte [esp + 0x35], al
lea eax, [esp + 0x39]
push ebx
push eax
mov byte [esp + 0x34], bl
mov byte [esp + 0x40], bl
call fcn.10027470
add esp, 0xc
push 0x104
lea ecx, [esp + 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [esp + 0x34]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x10009ae0
mov edx, dword [0x10043cc0]
mov ecx, dword [0x10043cc4]
mov dword [eax], edx
mov edx, dword [0x10043cc8]
mov dword [eax + 4], ecx
mov cx, word [0x10043ccc]
mov dword [eax + 8], edx
mov dl, byte [0x10043cce]
mov word [eax + 0xc], cx
mov byte [eax + 0xe], dl
lea eax, [esp + 0x34]
push eax
push 0xa
lea ecx, [esp + 0x30]
push ecx
push 0x10043690
push 0x10043cb8
push 0x10043cb0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, 0x10043ca8
lea eax, [esp + 0x28]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10009b60
cmp dl, bl
je 0x10009b5c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10009b60
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x10009b40
xor eax, eax
jmp 0x10009b65
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x10009bf5
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], ebx
mov byte [esp + 0x10], bl
push 0xf
push 0x10043c98
lea ecx, [esp + 0x14]
mov dword [esp + 0x150], ebx
call fcn.10006d20
push 3
push 0x10043c94
lea ecx, [esp + 0x14]
call fcn.10006c10
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10009bb0
sub eax, edx
push eax
push esi
lea ecx, [esp + 0x14]
call fcn.10006c10
mov eax, dword [esp + 0x10]
mov esi, 0x10
cmp dword [esp + 0x24], esi
jae 0x10009bd7
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [esp + 0x24], esi
jb 0x10009bf1
mov edx, dword [esp + 0x10]
push edx
call fcn.1001b206
add esp, 4
mov al, 1
jmp 0x10009bf7
xor al, al
mov ecx, dword [esp + 0x140]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x130]
xor ecx, esp
call fcn.1002742c
add esp, 0x140
ret
Function at 0x1000b1f0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x1004127b
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x10050fc0]
xor eax, esp
mov dword [esp + 0x120], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10050fc0]
xor eax, esp
push eax
lea eax, [esp + 0x138]
mov dword fs:[0], eax
mov esi, dword [esp + 0x148]
mov ebp, dword [esp + 0x14c]
xor ebx, ebx
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
push 0x103
lea eax, [esp + 0x35]
push ebx
push eax
mov dword [esp + 0x14c], ebx
mov byte [esp + 0x3c], bl
call fcn.10027470
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
add esp, 0xc
push ebx
push 0x17
lea ecx, [esp + 0x38]
push ecx
push ebx
call edi
lea eax, [esp + 0x30]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1000b281
sub eax, edx
push eax
lea edx, [esp + 0x34]
push edx
lea ecx, [esp + 0x1c]
call fcn.10006d20
push 1
lea eax, [esp + 0x18]
push esi
push eax
call fcn.1000aaa0
push 0x104
lea ecx, [esp + 0x40]
push ebx
push ecx
call fcn.10027470
add esp, 0x18
push ebx
push 2
lea edx, [esp + 0x38]
push edx
push ebx
call edi
lea eax, [esp + 0x30]
lea edx, [eax + 1]
jmp 0x1000b2d0
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1000b2d0
sub eax, edx
push eax
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x1c]
call fcn.10006d20
push 1
lea ecx, [esp + 0x18]
push ebp
push ecx
call fcn.1000aaa0
push 0x10044458
call fcn.10009a60
add esp, 0x10
cmp dword [esp + 0x2c], 0x10
jb 0x1000b316
mov edx, dword [esp + 0x18]
push edx
call fcn.1001b206
add esp, 4
mov ecx, dword [esp + 0x138]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.1002742c
add esp, 0x130
ret
Function at 0x1000bf20
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x10050074]
push 1
push 0x100439ec
push eax
push 0
mov ecx, 0x10050060
call fcn.100049e0
test eax, eax
je 0x1000bf60
mov ecx, dword [0x10050090]
push 1
push 0x100439ec
push ecx
push 0
mov ecx, 0x1005007c
call fcn.100049e0
test eax, eax
je 0x1000bf60
xor eax, eax
ret 4
call fcn.1000bea0
test eax, eax
je 0x1000bf76
push str.adjust_True_
call fcn.10009a60
add esp, 4
push esi
push str.in_CheckFolderSnap_
call fcn.10009a60
add esp, 4
call fcn.1000be60
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x1000bde0
push 0
push 0
call esi
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0x1000bd60
push 0
push 0
call esi
mov eax, 1
pop esi
ret 4

Function at 0x1000bfd0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x238
mov eax, dword [0x10050fc0]
xor eax, esp
mov dword [esp + 0x234], eax
push esi
push edi
push 0
push 2
mov dword [esp + 0x14], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [esp + 0x10]
push eax
mov edi, 0x128
push esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x18], edi
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x1000c02c
pop edi
pop esi
mov ecx, dword [esp + 0x234]
xor ecx, esp
call fcn.1002742c
add esp, 0x238
ret
push ebx
push 0x10044648
call fcn.10009a60
push 0x103
lea ecx, [esp + 0x145]
push 0
push ecx
mov byte [esp + 0x14c], 0
call fcn.10027470
add esp, 0x10
lea edx, [esp + 0x14]
push edx
push esi
mov dword [esp + 0x1c], edi
call sub.KERNEL32.dll_Process32Next
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1000c130
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ebx, [ebx]
mov eax, dword [esp + 0x20]
push eax
push 0
push 0x1fffff
mov edi, eax
call ebp
mov esi, eax
test esi, esi
je 0x1000c0ff
cmp edi, 0xa
jb 0x1000c0fc
push 0x104
lea eax, [esp + 0x144]
push 0
push eax
call fcn.10027470
lea ecx, [esp + 0x14c]
push ecx
push esi
call fcn.10008ca0
lea edx, [esp + 0x154]
push str.UPAGENT.EXE
push edx
call fcn.10027f00
add esp, 0x1c
test eax, eax
jne 0x1000c120
lea eax, [esp + 0x140]
push str.CUPDATEPROCESS.EXE
push eax
call fcn.10027f00
add esp, 8
test eax, eax
jne 0x1000c120
push esi
call ebx
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1000c0ff
push esi
call ebx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
push edx
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1000c080
jmp 0x1000c12b
push esi
mov dword [esp + 0x18], 1
call ebx
mov esi, dword [esp + 0x10]
pop ebp
push esi
call ebx
mov ecx, dword [esp + 0x240]
mov eax, dword [esp + 0x10]
pop ebx
pop edi
pop esi
xor ecx, esp
call fcn.1002742c
add esp, 0x238
ret
Function at 0x1002742c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10050fc0]
jne 0x10027436
repz ret
jmp fcn.1002dcaf

Function at 0x1002a317
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x1002a348
call fcn.1002baa1
mov dword [eax], esi
call fcn.1002ba8e
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.10029a59
add esp, 0x14
push 0x16
pop eax
jmp 0x1002a39d
test dword [ebp + 0xc], 0xfffffff9
jne 0x1002a324
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1002a375
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1002bab4
pop ecx
call fcn.1002ba8e
mov eax, dword [eax]
jmp 0x1002a39d
test al, 0x10
jne 0x1002a39b
test al, 1
je 0x1002a39b
test byte [ebp + 0xc], 2
je 0x1002a39b
call fcn.1002baa1
mov dword [eax], 5
call fcn.1002ba8e
mov dword [eax], 0xd
jmp 0x1002a36c
xor eax, eax
pop esi
pop ebp
ret

Function at 0x1003a0b7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1002f81e
and dword [ebp - 4], 0
cmp dword [0x10134b90], 0
mov ebx, eax
jne 0x1003a168
push 0x100494cc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1003a219
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100494c0
push edi
call esi
test eax, eax
je 0x1003a219
push eax
call fcn.1002f7ac
mov dword [esp], 0x100494b0
push edi
mov dword [0x10134b90], eax
call esi
push eax
call fcn.1002f7ac
mov dword [esp], 0x1004949c
push edi
mov dword [0x10134b94], eax
call esi
push eax
call fcn.1002f7ac
mov dword [esp], 0x10049480
push edi
mov dword [0x10134b98], eax
call esi
push eax
call fcn.1002f7ac
pop ecx
mov dword [0x10134ba0], eax
test eax, eax
je 0x1003a168
push 0x10049468
push edi
call esi
push eax
call fcn.1002f7ac
pop ecx
mov dword [0x10134b9c], eax
mov eax, dword [0x10134b9c]
cmp eax, ebx
je 0x1003a1c0
cmp dword [0x10134ba0], ebx
je 0x1003a1c0
push eax
call fcn.1002f827
push dword [0x10134ba0]
mov esi, eax
call fcn.1002f827
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1003a1c0
test edi, edi
je 0x1003a1c0
call esi
test eax, eax
je 0x1003a1b7
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1003a1b7
test byte [ebp - 0xc], 1
jne 0x1003a1c0
or dword [ebp + 0x10], 0x200000
jmp 0x1003a1f9
mov eax, dword [0x10134b94]
cmp eax, ebx
je 0x1003a1f9
push eax
call fcn.1002f827
pop ecx
test eax, eax
je 0x1003a1f9
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1003a1f9
mov eax, dword [0x10134b98]
cmp eax, ebx
je 0x1003a1f9
push eax
call fcn.1002f827
pop ecx
test eax, eax
je 0x1003a1f9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10134b90]
call fcn.1002f827
pop ecx
test eax, eax
je 0x1003a219
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1003a21b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4328d0
Capabilities:
Move file

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
push edi
cmp dword [esi + 0x14], 8
jb 0x4328e0
mov eax, dword [esi]
mov edi, dword [esp + 0xc]
mov ecx, edi
cmp dword [edi + 0x14], 8
jb 0x4328ee
mov ecx, dword [edi]
push 3
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x432904
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x432906
xor eax, eax
push str.boost::filesystem::rename
push dword [esp + 0x18]
push esi
push edi
push eax
call fcn.004326e0
add esp, 0x14
pop edi
pop esi
ret

Function at 0x44966e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004494e4
Function at 0x401a40
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8

Function at 0x426200
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x21000]
push edi
jmp 0x42621a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x426221
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x426210
mov eax, 1
add ebx, ebx
jne 0x426233
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x426228
jne 0x426244
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x426228
xor ecx, ecx
sub eax, 3
jb 0x426258
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4262ca
mov ebp, eax
add ebx, ebx
jne 0x426263
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x426270
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x426294
inc ecx
add ebx, ebx
jne 0x426280
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x426275
jne 0x426291
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x426275
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4262b4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4262a5
jmp 0x426216
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4262b4
add edi, ecx
jmp 0x426216
pop esi
lea edi, [esi + 0x24000]
mov eax, dword [edi]
or eax, eax
je 0x42631c
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3a9dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3aa18]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4262d1
mov ecx, edi
jns 0x426300
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3aa20]
or eax, eax
je 0x426316
mov dword [ebx], eax
add ebx, 4
jmp 0x4262ee
call dword [esi + 0x3aa1c]
mov ebp, dword [esi + 0x3aa24]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x426350
sub esp, 0xffffff80
jmp 0x40155c

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x425070
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42509d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42509d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408f6c
nop
mov ecx, 0x43eb65ba
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x67795127
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x405ab0
Capabilities:
Terminate process

Disassembly:
call fcn.004060c5
jmp 0x405aba
push 0x58
push 0x406318
call fcn.00405d50
xor ebx, ebx
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x407e28
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x405b0c
cmp eax, esi
jne 0x405aff
xor esi, esi
inc esi
mov edi, esi
jmp 0x405b0f
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x405ae3
xor esi, esi
inc esi
cmp dword [0x407e2c], esi
jne 0x405b21
push 0x1f
call fcn.00498000
pop ecx
jmp 0x405b5b
cmp dword [0x407e2c], ebx
jne 0x405b55
mov dword [0x407e2c], esi
push 0x401018
push 0x40100c
call fcn.00405c99
pop ecx
pop ecx
test eax, eax
je 0x405b5b
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x405c89
mov dword [0x407a84], esi
cmp dword [0x407e2c], esi
jne 0x405b7e
push 0x401008
push section..text
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x407e2c], 2
test edi, edi
jne 0x405b8b
xor eax, eax
mov ecx, 0x407e28
xchg dword [ecx], eax
cmp dword [0x407e30], 0
je 0x405bb7
push 0x407e30
call fcn.00405fd0
pop ecx
test eax, eax
je 0x405bb7
push ebx
push 2
push ebx
mov esi, dword [0x407e30]
mov ecx, esi
call dword [0x4081c4]
call esi
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x1c], esi
mov edi, dword [ebp - 0x20]
mov cl, byte [esi]
cmp cl, 0x20
ja 0x405c15
test cl, cl
je 0x405be4
test edi, edi
jne 0x405c15
test cl, cl
je 0x405be4
cmp cl, 0x20
ja 0x405be4
inc esi
mov dword [ebp - 0x1c], esi
mov cl, byte [esi]
jmp 0x405bd3
test byte [ebp - 0x3c], 1
je 0x405bf0
movzx eax, word [ebp - 0x38]
jmp 0x405bf3
push 0xa
pop eax
push eax
push esi
push ebx
push 0x400000
call main
mov dword [0x407a80], eax
cmp dword [0x407a98], 0
jne 0x405c6e
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cl, 0x22
jne 0x405c26
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [ebp - 0x20], edi
movzx eax, cl
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x405c39
inc esi
mov dword [ebp - 0x1c], esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x405bc4
cmp dword [0x407a84], 0
jne 0x405c82
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x407a80]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x405eb4
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x406338
call fcn.00405d50
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x405f14
cmp eax, 0xffffffff
je 0x405f14
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x405f0d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x405f0d
cmp edx, 0x10000000
jae 0x405f0d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x405f0a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x408939
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov edi, 0x4085d8
call fcn.00408959
mov ecx, 0xa26e963e
xor dword [esi], edi
add ecx, 1
inc esi
sub ebx, ecx
cmp esi, edx
jne fcn.00408939
dec ecx
ret