joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409048
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe64
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x19c], ecx
mov dword [ebp - 0x198], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404654
xor eax, eax
push ebp
push 0x40918f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004041ec
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor edx, edx
push ebp
push 0x40915a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.00404664
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x409150
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x409146
cmp dword [ebp - 4], 0
jne 0x409132
mov eax, dword [esi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x198]
call fcn.004043d4
mov edx, dword [ebp - 0x198]
mov eax, 0x4091a8
call fcn.004047a8
dec eax
je 0x409145
mov eax, dword [esi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x19c]
call fcn.004043d4
mov edx, dword [ebp - 0x19c]
mov eax, 0x4091b4
call fcn.004047a8
dec eax
je 0x409145
mov eax, dword [esi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, edi
call fcn.004043d4
jmp 0x409150
mov eax, dword [esi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, edi
call fcn.004043d4
inc ebx
cmp dword [esi + ebx*4], 0
jne 0x4090c3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x409164
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409196
lea eax, [ebp - 0x19c]
mov edx, 2
call fcn.00404210
lea eax, [ebp - 4]
call fcn.004041ec
ret

Function at 0x409208
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404654
xor eax, eax
push ebp
push 0x40925c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov al, bl
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404664
push eax
push 0x409268
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409263
lea eax, [ebp - 4]
call fcn.004041ec
ret

Function at 0x409304
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404654
xor eax, eax
push ebp
push 0x409393
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x105]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
mov ecx, 0x101
call fcn.0040444c
push dword [ebp - 0x10c]
push 0x4093a8
push dword [ebp - 4]
mov eax, ebx
mov edx, 3
call fcn.00404524
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40939a
lea eax, [ebp - 0x10c]
call fcn.004041ec
lea eax, [ebp - 4]
call fcn.004041ec
ret
Function at 0x4093ac
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404654
xor eax, eax
push ebp
push 0x40943b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x105]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetCurrentDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
mov ecx, 0x101
call fcn.0040444c
push dword [ebp - 0x10c]
push 0x409450
push dword [ebp - 4]
mov eax, ebx
mov edx, 3
call fcn.00404524
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409442
lea eax, [ebp - 0x10c]
call fcn.004041ec
lea eax, [ebp - 4]
call fcn.004041ec
ret

Function at 0x409454
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404654
xor eax, eax
push ebp
push 0x4094e3
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
mov ecx, 0x101
call fcn.0040444c
push dword [ebp - 0x10c]
push 0x4094f8
push dword [ebp - 4]
mov eax, ebx
mov edx, 3
call fcn.00404524
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4094ea
lea eax, [ebp - 0x10c]
call fcn.004041ec
lea eax, [ebp - 4]
call fcn.004041ec
ret

Function at 0x4094fc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404654
xor eax, eax
push ebp
push 0x40958b
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
mov ecx, 0x101
call fcn.0040444c
push dword [ebp - 0x10c]
push 0x4095a0
push dword [ebp - 4]
mov eax, ebx
mov edx, 3
call fcn.00404524
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409592
lea eax, [ebp - 0x10c]
call fcn.004041ec
lea eax, [ebp - 4]
call fcn.004041ec
ret
Function at 0x409afc
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe6c
push ebx
xor edx, edx
mov dword [ebp - 0x194], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409b71
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x190]
push eax
mov dl, 1
mov al, 1
call fcn.00405078
push eax
call sub.wsock32.dll_WSAStartup
lea edx, [ebp - 0x194]
xor eax, eax
call fcn.00402b68
mov edx, dword [ebp - 0x194]
mov ecx, dword [ebx + 4]
mov eax, ebx
call fcn.004097b0
call sub.wsock32.dll_WSACleanup
jmp 0x409b1e

Function at 0x409c74
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe68
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x198], edx
mov dword [ebp - 0x194], edx
mov edi, eax
xor eax, eax
push ebp
push 0x409d8a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x190]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor edx, edx
push ebp
push 0x409d5d
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x409d53
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x409d4d
mov eax, dword [esi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x194]
call fcn.004043d4
mov edx, dword [ebp - 0x194]
mov eax, 0x409da0
call fcn.004047a8
dec eax
je 0x409d4c
mov eax, dword [esi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x198]
call fcn.004043d4
mov edx, dword [ebp - 0x198]
mov eax, 0x409dac
call fcn.004047a8
dec eax
je 0x409d4c
mov eax, dword [esi + ebx*4]
mov al, byte [eax]
mov byte [edi + 4], al
mov eax, dword [esi + ebx*4]
mov al, byte [eax + 1]
mov byte [edi + 5], al
mov eax, dword [esi + ebx*4]
mov al, byte [eax + 2]
mov byte [edi + 6], al
mov eax, dword [esi + ebx*4]
mov al, byte [eax + 3]
mov byte [edi + 7], al
jmp 0x409d53
inc ebx
cmp dword [esi + ebx*4], 0
jne 0x409cd3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x409d67
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409d91
lea eax, [ebp - 0x198]
mov edx, 2
call fcn.00404210
ret

Function at 0x409dd8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, edx
mov eax, ebx
call fcn.00404664
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x409df5
and eax, 0x10
cmp eax, 0x10
je 0x409df9
xor eax, eax
jmp 0x409dfb
mov al, 1
neg al
sbb eax, eax
pop ebx
ret
Function at 0x40a62c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebx, eax
xor ebp, ebp
xor edi, edi
lea eax, [ebx + 0x10]
call fcn.004041ec
cmp ebp, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x40a695
mov eax, dword [ebx + 0x10]
mov edx, 0x40a7c8
call fcn.004045b0
jne 0x40a664
lea eax, [ebx + 0x10]
call fcn.004041ec
jmp 0x40a69d
mov eax, dword [ebx + 0x10]
mov edx, 0x40a7d4
call fcn.004045b0
jne 0x40a680
lea eax, [ebx + 0x10]
mov edx, 0x40a7c8
call fcn.00404240
cmp dword [ebx + 0x10], 0
jne 0x40a69d
lea eax, [ebx + 0x10]
mov edx, 0x40a7d4
call fcn.00404240
jmp 0x40a69d
lea eax, [ebx + 0x10]
call fcn.004041ec
mov eax, ebx
call fcn.0040a47c
mov eax, dword [0x40b158]
inc dword [eax]
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov word [esp], 2
push 0x8b
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, dword [ebx + 0x10]
call fcn.00404664
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push 0x10
lea eax, [esp + 4]
push eax
push esi
call sub.wsock32.dll_connect
inc eax
je 0x40a6f7
or edi, 0xffffffff
jmp 0x40a784
mov eax, dword [0x40b170]
inc dword [eax]
mov word [esp], 2
push 0x1bd
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, dword [ebx + 0x10]
call fcn.00404664
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push 0x10
lea eax, [esp + 4]
push eax
push esi
call sub.wsock32.dll_connect
inc eax
je 0x40a73a
or edi, 0xffffffff
jmp 0x40a784
mov eax, dword [0x40b170]
inc dword [eax]
mov word [esp], 2
push 0x75d7
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, dword [ebx + 0x10]
call fcn.00404664
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push 0x10
lea eax, [esp + 4]
push eax
push esi
call sub.wsock32.dll_connect
inc eax
je 0x40a77d
or edi, 0xffffffff
jmp 0x40a784
mov eax, dword [0x40b170]
inc dword [eax]
test edi, edi
je 0x40a7a7
push esi
call sub.wsock32.dll_closesocket
lea eax, [ebx + 0x14]
mov ecx, dword [ebx + 0x10]
mov edx, 0x40a7e0
call fcn.004044b0
mov eax, ebx
call fcn.0040a354
mov ebp, eax
push 0x200
call sub.kernel32.dll_Sleep
jmp 0x40a641
Function at 0x401005
Capabilities:
Terminate process

Disassembly:
jmp 0x40175b
push 0x14
push 0x405870
call fcn.0040106e
push 1
call fcn.0040117c
pop ecx
test al, al
je 0x40167c
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0040119a
mov byte [ebp - 0x24], al
mov eax, dword [0x406130]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x40167c
test eax, eax
jne 0x4015a0
mov dword [0x406130], ecx
push 0x404618
push 0x40430c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x401583
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x40166c
push 0x404208
push section..rdata
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x406130], 2
jmp 0x4015a5
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.004010c3
pop ecx
call fcn.0040102d
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x4015d6
push esi
call fcn.0040109b
pop ecx
test al, al
je 0x4015d6
mov esi, dword [esi]
push edi
push 2
push edi
mov ecx, esi
call dword [section..00cfg]
call esi
call fcn.0040101e
mov esi, eax
cmp dword [esi], edi
je 0x4015f4
push esi
call fcn.0040109b
pop ecx
test al, al
je 0x4015f4
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
call fcn.00401064
movzx esi, ax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_narrow_winmain_command_line
push esi
push eax
push edi
push 0x400000
call fcn.004011d1
mov esi, eax
call fcn.004011a4
test al, al
je 0x401683
test bl, bl
jne 0x401622
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.004010c8
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x40166c
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
push 7
call fcn.004010eb
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
push dword [ebp - 0x20]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__exit
int3
call fcn.004011ea
jmp 0x401516

Function at 0x4011a4
Capabilities:
Parse pe header

Disassembly:
jmp 0x401ec7
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401f06
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401f06
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401f06
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401f06
cmp dword [ecx + 0x74], 0xe
jbe 0x401f06
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x58c790
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x12f000]
push edi
jmp 0x58c7aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x58c7b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x58c7a0
mov eax, 1
add ebx, ebx
jne 0x58c7c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x58c7d4
jne 0x58c7f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x58c7f3
dec eax
add ebx, ebx
jne 0x58c7e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x58c7b8
add ebx, ebx
jne 0x58c7ef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x58c845
xor ecx, ecx
sub eax, 3
jb 0x58c80b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x58c87a
sar eax, 1
mov ebp, eax
jmp 0x58c816
add ebx, ebx
jne 0x58c816
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x58c7e4
inc ecx
add ebx, ebx
jne 0x58c824
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x58c7e4
add ebx, ebx
jne 0x58c831
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x58c826
jne 0x58c842
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x58c826
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x58c864
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x58c856
jmp 0x58c7a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x58c864
add edi, ecx
jmp 0x58c7a6
pop esi
mov edi, esi
mov ecx, 0x40f0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x58c882
cmp byte [edi], 0x11
jne 0x58c882
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x58c887
lea edi, [esi + 0x185000]
mov eax, dword [edi]
or eax, eax
je 0x58c8ff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x233bec]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x233d68]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x58c8b4
mov ecx, edi
jns 0x58c8e3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x233d6c]
or eax, eax
je 0x58c8f9
mov dword [ebx], eax
add ebx, 4
jmp 0x58c8d1
call dword [esi + 0x233d7c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x58c930
cmp al, 0xef
ja 0x58c923
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x58c905
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x58c912
mov ebp, dword [esi + 0x233d70]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x58c964
sub esp, 0xffffff80
jmp 0x420577
Function at 0x404d05
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp + 8]
cmp eax, dword [ebp - 4]
jb 0x404d29
jmp 0x404d33
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x404d19
mov esp, ebp
pop ebp
ret

Function at 0x406869
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x406889
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00409272
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4068aa
test byte [esp + 8], 2
je 0x4068aa
mov dword [0x415ec0], 0xd
mov dword [0x415ec4], 5
jmp 0x406885
xor eax, eax
ret

Function at 0x408b81
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40e978
cmp edx, dword [eax]
je 0x408ba3
add eax, 8
inc ecx
cmp eax, 0x40ea08
jl 0x408b94
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40e978]
jne 0x408cd1
mov eax, dword [0x415f1c]
cmp eax, 1
je 0x408cab
test eax, eax
jne 0x408bd4
cmp dword [0x40e404], 1
je 0x408cab
cmp edx, 0xfc
je 0x408cd1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x408c0b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004056a0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00405790
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x408c4e
lea eax, [ebp - 0x1a4]
push eax
call fcn.00405790
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40d4f4
push edi
call fcn.00406290
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004056a0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004056b0
lea eax, [ebp - 0xa0]
push 0x40d4d4
push eax
call fcn.004056b0
push dword [esi + 0x40e97c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004056b0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040b641
add esp, 0x2c
pop edi
jmp 0x408cd1
lea eax, [ebp + 8]
lea esi, [esi + 0x40e97c]
push 0
push eax
push dword [esi]
call fcn.00405790
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x72c0785a
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section._RDATA
nop
mov ebx, 0x42cd70
mov ecx, 0x41eb1f2f
nop
nop
nop
nop
nop
test eax, eax
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x406f6f
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub ebx, 0x1142d
jmp 0x406e81
pop ebx
push eax
push eax
add esp, 4
jmp 0x406e8d
jmp 0x406e92
pop eax
push ebx
add ebx, 0x13959
pop ebx
mov dword [ebp - 0x3cc], 0
push eax
push edx
add esp, 4
and eax, 0xec3e
sub eax, 0x9ff0
call 0x406ec3
add byte [ecx + 0x45], cl
push eax
inc ebp
dec esp
aas
dec esp
add esp, 4
les eax, [eax + ebp*8]
or byte [eax], al
add byte [eax], al
add byte [edx + 0x3d], cl
cmp edi, dword [edi]
dec eax
dec esi
inc ebp
add esp, 4
pop eax
push edx
push edi
add esp, 4
add edx, 0x11fe
pop edx
push eax
push edx
add esp, 4
add eax, 0x6d9d
pop eax
push edi
and edi, 0x5491
sub edi, 0xddf6
add edi, 0x29ba
or edi, 0x55f7
pop edi
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xb80]
mov dword [ebp - 0x14c8], eax
push esi
call 0x406f2e
add byte [ebx], dh
aas
inc ecx
dec eax
dec esp
cmp al, 0x3e
dec edi
add esp, 4
jmp 0x406f39
call 0x406f46
add byte [ecx + 0x3b], al
cmp esi, dword [0x4850413c]
add esp, 4
or esi, 0x110bc
pop esi
mov dword [ebp - 0x1fac], 0xffffffff
push ebx
jmp 0x406f60
call 0x406f6f
add byte [ebx], dh
cmp byte [esi + 0x4b], al
inc eax
cmp eax, dword [edi + 0x45]
cmp byte [ebx - 0xc7efb3c], al
cmp byte [esi], al
add byte [eax], al
call 0x406f88
add byte [0x343d4e44], bh
xor eax, 0x494c4d4e
add esp, 4
pop ebx
mov ecx, dword [ebp - 0x3c0]
mov dword [ebp - 0x4d0], ecx
jmp 0x406fa9
mov edx, dword [ebp - 0x4d0]
add edx, 1
mov dword [ebp - 0x4d0], edx
push edi
jmp 0x406fb1
add eax, 0x42484046
dec ecx
call 0x406fbe
add byte [ebp + 0x50], al
xor al, 0x45
dec ecx
aaa
xor eax, dword [ebx - 0x187efb3c]
jg 0x406fab
add byte [eax], al
pop edi
push ecx
sub ecx, 0x4e9f
jmp 0x406fd4
add ecx, 0xd28
pop ecx
mov eax, dword [ebp - 0x4d0]
sub eax, dword [ebp - 0x3c0]
cmp eax, 0xffffffff
jb 0x407023
push ecx
jmp 0x406ff3
pop ecx
push ebx
push esi
add esp, 4
and ebx, 0x5525
sub ebx, 0xe30d
sub ebx, 0x14c9b
dec esp
add dword [eax], eax
pop ebx
push esi
jmp 0x407016
jmp 0x40701d
pop esi
jmp 0x407251
mov dword [ebp - 0xc10], 7
mov ecx, dword [ebp - 0x4d0]
mov dword [ebp - 0xa60], ecx
push edx
push eax
add esp, 4
call 0x40704d
add byte [ecx + 0x43], al
aaa
push eax
inc ebp
dec edi
dec esp
inc edi
inc edi
add esp, 4
Function at 0x406f88
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub ebx, 0x1142d
jmp 0x406e81
pop ebx
push eax
push eax
add esp, 4
jmp 0x406e8d
jmp 0x406e92
pop eax
push ebx
add ebx, 0x13959
pop ebx
mov dword [ebp - 0x3cc], 0
push eax
push edx
add esp, 4
and eax, 0xec3e
sub eax, 0x9ff0
call 0x406ec3
add byte [ecx + 0x45], cl
push eax
inc ebp
dec esp
aas
dec esp
add esp, 4
les eax, [eax + ebp*8]
or byte [eax], al
add byte [eax], al
add byte [edx + 0x3d], cl
cmp edi, dword [edi]
dec eax
dec esi
inc ebp
add esp, 4
pop eax
push edx
push edi
add esp, 4
add edx, 0x11fe
pop edx
push eax
push edx
add esp, 4
add eax, 0x6d9d
pop eax
push edi
and edi, 0x5491
sub edi, 0xddf6
add edi, 0x29ba
or edi, 0x55f7
pop edi
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xb80]
mov dword [ebp - 0x14c8], eax
push esi
call 0x406f2e
add byte [ebx], dh
aas
inc ecx
dec eax
dec esp
cmp al, 0x3e
dec edi
add esp, 4
jmp 0x406f39
call 0x406f46
add byte [ecx + 0x3b], al
cmp esi, dword [0x4850413c]
add esp, 4
or esi, 0x110bc
pop esi
mov dword [ebp - 0x1fac], 0xffffffff
push ebx
jmp 0x406f60
call 0x406f6f
add byte [ebx], dh
cmp byte [esi + 0x4b], al
inc eax
cmp eax, dword [edi + 0x45]
cmp byte [ebx - 0xc7efb3c], al
cmp byte [esi], al
add byte [eax], al
call 0x406f88
add byte [0x343d4e44], bh
xor eax, 0x494c4d4e
add esp, 4
pop ebx
mov ecx, dword [ebp - 0x3c0]
mov dword [ebp - 0x4d0], ecx
jmp 0x406fa9
mov edx, dword [ebp - 0x4d0]
add edx, 1
mov dword [ebp - 0x4d0], edx
push edi
jmp 0x406fb1
add eax, 0x42484046
dec ecx
call 0x406fbe
add byte [ebp + 0x50], al
xor al, 0x45
dec ecx
aaa
xor eax, dword [ebx - 0x187efb3c]
jg 0x406fab
add byte [eax], al
pop edi
push ecx
sub ecx, 0x4e9f
jmp 0x406fd4
add ecx, 0xd28
pop ecx
mov eax, dword [ebp - 0x4d0]
sub eax, dword [ebp - 0x3c0]
cmp eax, 0xffffffff
jb 0x407023
push ecx
jmp 0x406ff3
pop ecx
push ebx
push esi
add esp, 4
and ebx, 0x5525
sub ebx, 0xe30d
sub ebx, 0x14c9b
dec esp
add dword [eax], eax
pop ebx
push esi
jmp 0x407016
jmp 0x40701d
pop esi
jmp 0x407251
mov dword [ebp - 0xc10], 7
mov ecx, dword [ebp - 0x4d0]
mov dword [ebp - 0xa60], ecx
push edx
push eax
add esp, 4
call 0x40704d
add byte [ecx + 0x43], al
aaa
push eax
inc ebp
dec edi
dec esp
inc edi
inc edi
add esp, 4