joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4017e2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
mov eax, dword [0x41f00c]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
xor ebp, ebp
push edi
mov eax, dword [esi + 0x3c]
mov ebx, dword [eax + esi + 0x78]
add ebx, esi
mov edi, dword [ebx + 0x20]
mov eax, dword [ebx + 0x18]
add edi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x40185a
mov eax, dword [edi]
lea ecx, [esp + 0x14]
add eax, esi
push eax
call fcn.00401215
test esi, esi
je 0x401847
cmp dword [esp + 0x38], 3
jbe 0x401847
lea eax, [esp + 0x14]
push 0x14d
push eax
call fcn.004018cf
pop ecx
pop ecx
test eax, eax
je 0x401847
cmp eax, dword [esp + 0x38]
je 0x401872
lea ecx, [esp + 0x14]
add edi, 4
call fcn.00401639
inc ebp
cmp ebp, dword [esp + 0x10]
jb 0x401813
xor edi, edi
mov ecx, dword [esp + 0x2c]
lea eax, [esi + edi]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004023e8
add esp, 0x20
ret
mov eax, dword [ebx + 0x24]
lea eax, [eax + ebp*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + esi]
lea ecx, [esp + 0x14]
call fcn.00401639
jmp 0x40185c

Function at 0x4018cf
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
lea eax, [esi + 0x10]
mov edi, dword [eax]
mov ebp, edi
xor ebp, dword [esp + 0x24]
cmp dword [esi + 0x14], 0x10
mov dword [esp + 0x18], eax
jb 0x4018f5
mov esi, dword [esi]
mov dword [esp + 0x20], esi
shr edi, 2
xor ebx, ebx
mov dword [esp + 0x14], edi
test edi, edi
je 0x401952
mov dword [esp + 0x24], esi
push ebx
call dword [sym.imp.ADVAPI32.dll_IsValidAcl]
push 4
lea eax, [esp + 0x28]
push esi
push eax
call fcn.00403030
imul ecx, dword [esp + 0x30], 0x5bd1e991
add esp, 0xc
imul ebp, ebp, 0x5bd1e991
add esi, 4
mov eax, ecx
shr eax, 0x18
xor eax, ecx
imul eax, eax, 0x5bd1e991
xor ebp, eax
mov dword [esp + 0x24], eax
sub edi, 1
jne 0x401906
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
and eax, 3
sub eax, 1
je 0x401978
sub eax, 1
je 0x40196e
sub eax, 1
jne 0x401986
movsx ebx, byte [esi + edi*4 + 2]
shl ebx, 0x10
movsx eax, byte [esi + edi*4 + 1]
shl eax, 8
xor ebx, eax
movsx eax, byte [esi + edi*4]
xor eax, ebx
imul eax, eax, 0x5bd1e991
xor ebp, eax
mov eax, ebp
shr eax, 0xd
xor eax, ebp
imul ecx, eax, 0x5bd1e991
pop edi
pop esi
pop ebp
pop ebx
mov eax, ecx
shr eax, 0xf
xor eax, ecx
add esp, 0xc
ret

Function at 0x402cf5
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x402d34
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x402d34
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x402d34
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x402d34
cmp dword [ecx + 0x74], 0xe
jbe 0x402d34
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40b2d4
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x419944
push 0x41993c
push str.FlsAlloc
push 0x1e
call fcn.0040b155
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b308
push dword [ebp + 8]
mov ecx, esi
call dword [0x417144]
call esi
jmp 0x40b30e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40b352
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x419954
push 0x41994c
push str.FlsGetValue
push 0x20
call fcn.0040b155
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b389
push dword [ebp + 8]
mov ecx, esi
call dword [0x417144]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x401000
Capabilities:
Copy file
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x384
mov eax, dword [0x449b6c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [0x44a514], 1
push str._uninstall
mov eax, dword [ebp + 0x10]
push eax
call fcn.00404df0
add esp, 8
test eax, eax
je 0x40114d
push str._proxy
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00404df0
add esp, 8
test eax, eax
jne 0x401143
lea edx, [ebp - 0x20c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x108]
push eax
push 0
push str.dyalog_uninst
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push str..exe
lea edx, [ebp - 0x108]
push edx
call fcn.0040c130
add esp, 8
push 0x104
lea eax, [ebp - 0x310]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x401143
push 0
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x401143
mov dword [ebp - 0x384], 0x44
push 0x40
push 0
lea ecx, [ebp - 0x380]
push ecx
call fcn.00405060
add esp, 0xc
push str.__proxy
lea edx, [ebp - 0x108]
push edx
call fcn.0040c130
add esp, 8
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x108]
push ecx
call fcn.0040c130
add esp, 8
lea edx, [ebp - 0x340]
push edx
lea eax, [ebp - 0x384]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x401143
mov eax, 1
jmp 0x4011e9
mov dword [0x44a514], 0
mov edx, dword [ebp + 8]
push edx
call fcn.00401200
add esp, 4
push str.Riched20.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x314], eax
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401290
add esp, 8
test eax, eax
jne 0x401182
xor eax, eax
jmp 0x4011e9
push 0
push 0
push 0
lea edx, [ebp - 0x330]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x4011cd
lea eax, [ebp - 0x330]
push eax
mov ecx, dword [0x44a540]
push ecx
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x4011cb
lea edx, [ebp - 0x330]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x330]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x401182
cmp dword [ebp - 0x314], 0
je 0x4011e3
mov ecx, dword [ebp - 0x314]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x328]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403eea
mov esp, ebp
pop ebp
ret 0x10
Function at 0x401fc0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x449b6c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x98], 0x94
push 0x90
push 0
lea eax, [ebp - 0x94]
push eax
call fcn.00405060
add esp, 0xc
lea ecx, [ebp - 0x98]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x94], 5
ja 0x402027
cmp dword [ebp - 0x94], 5
jne 0x40201b
cmp dword [ebp - 0x90], 1
jae 0x402027
mov dword [ebp - 0x9c], 0
jmp 0x402031
mov dword [ebp - 0x9c], 1
mov edx, dword [ebp - 0x9c]
mov dword [ebp - 0xa0], edx
cmp dword [ebp - 0xa0], 0
jne 0x40205e
push 0x30
push str.Unsupported_Windows_Version
push str.This_application_is_only_supported_on_Windows_XP__Windows_Server_2003__or_higher.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x402063
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403eea
mov esp, ebp
pop ebp
ret

Function at 0x402080
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0xff
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str.SOFTWARE_s_s
push 0x44a748
call fcn.00403d30
add esp, 0x10
lea edx, [ebp - 8]
push edx
push 0xf003f
push 0
push 0x44a748
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402107
mov dword [ebp - 4], 0xff
lea eax, [ebp - 4]
push eax
push 0x44a748
lea ecx, [ebp - 0x10]
push ecx
push 0
push str.Serial
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4020fd
mov eax, 0x44a748
jmp 0x402109
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x402d50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x44ac58
push 0x44ad58
push pe_nt_image_headers32
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call fcn.00402cd0
push eax
push 0x44a511
push 0x44ad58
push str._s_s__s.log
mov eax, dword [ebp - 4]
push eax
call fcn.00403d30
add esp, 0x14
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x402e20
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0xf0
push 0x68
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x402e9b
push 0
push 0x68
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00402df0
push eax
push 0x69
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 5
push 0x69
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push 0x69
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, 1
pop ebp
ret
Function at 0x402eb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x44b658
push 0x200
push 0x44ba58
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.System32msiexec.exe
push 0x44ba58
push str.__s_s_
push 0x44b658
call fcn.00403d30
add esp, 0x10
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x403470
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x449b6c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x3ff
lea eax, [ebp - 0x404]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
push str.One_of_the_installers_reported_an_error._Additional_installs_have_been_halted.
lea edx, [ebp - 0x804]
push edx
call fcn.0040c120
add esp, 8
push 0
lea eax, [ebp - 0x404]
push eax
lea ecx, [ebp - 0x804]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403eea
mov esp, ebp
pop ebp
ret

Function at 0x42a680
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042a407

Function at 0x42c914
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042c0ee

Function at 0x42c91f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042c329
Function at 0x49629b
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0
add byte [esp + 0x24], dh
cmp esi, 0x7fff0068
jae 0x49635a
add byte [esp + 0x20], bh
mov eax, dword [edi - 0x3f]
add al, dh
jae 0x4962cf
sub esp, 4
inc dword [eax]
add byte [esi + 0x57], dl
call 0x94636b
add esp, 0x10
jmp 0x49634d
cmp esi, 0
add byte [edi - 0x76], bl
dec esp
and al, 0x28
inc esi
add byte [edi + edx*2 - 0x75], dh
dec edi
adc al, 0x39
int1
add byte [eax], al
ja 0x4962e7
mov ebx, ecx
cmp dword [edx - 0x72cb8e00], 0x4f
add al, 0x8b
sub dword [eax], eax
add byte [ecx + edx - 0x7d], dh
in al, dx
add al, 0x33
add byte [ecx - 0x18], dl
push ebx
xor byte [ebp], bh
add dword [eax], 0
mov eax, dword [edi + 0x18]
lea eax, [eax + ebx*4]
cmp eax, 0x1000
jb 0x496314
add byte [eax], al
cld
sub esp, 0xc
push ebp
jo 0x49631a
outsd dx, dword [esi]
jl 0x49631d
add esp, 0x10
mov dword [eax], 0x700
add byte [ecx - 0x3899ffd2], cl
inc esp
pop edi
add al, 0
add byte [eax], al
add byte [ebp - 0x72e98a0a], al
stc
add byte [ebx + 0x27208f8], al
mov ecx, dword [ecx]
add byte [eax], al
adc al, 0
add byte [eax], al
add byte [ecx], dh
add byte [ecx], al
add byte [eax], al
test esi, esi
setne byte [eax]
add ah, al
or al, 0x5e
pop edi
pop ebx
cmp dword [eax], eax
sub esp, 0xc
push 0xd9844c
add byte [ebp + ebp*8 + 0xa83007c], dh
add byte [eax + 0x53e58955], dl
push edi
push esi
add byte [eax], al
mov word [eax], es
add byte [eax], al
mov ecx, dword [0xc4d8b00]
mov edx, dword [ebp + 8]
mov dword [eax], eax
add byte [ecx + 0x4589e84d], cl
adc al, 0
add byte [eax], al
add byte [ebx + 0x4d8b000d], cl
or al, 0x8b
push ebp
or byte [ecx + 0x4d890000], cl
call 0x5da913
jne 0x496374
or esi, 7
mov ebx, dword [ebp]
add byte [ebp - 0x60], al
dec eax
mov al, 0xbe
test byte [eax], 0x45
movsb byte es:[edi], byte [esi]
or al, 0x87
fld dword [eax]
mov dword [eax], eax
add byte [ecx + 0x45c7b065], cl
aas
add byte [esi + 0x40], dl
add byte [ebp + 0xe88445], cl
add byte [esi], bh
cmp esi, 0x7f0026fe
ja 0x4963eb
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
add byte [ecx - 0x45102e31], cl
loopne 0x4963ca
stosb byte es:[edi], al
stosb byte es:[edi], al
mov eax, esi
mul edx
rol dword [eax], 1
add bh, dl
mov ebx, esi
jbe 0x4963eb
jp 0x4963da
invalid
mov ecx, dword [ebp - 0x10]
mov eax, ebx
inc eax
add byte [eax], al
test eax, eax
js 0x49c54f
add eax, eax
cmp eax, 0x1000
add byte [ebp - 0x14], bl
jb 0x496441
mov edx, ebp
add byte [ebx - 0x7cf02208], al
push ecx
add dword [eax], eax
add byte [ebx - 0x3f7c0fb3], cl
mov ebx, 0xc7d84d00
inc ebp
mov word [ebx], es
add byte [eax], al
add byte [ecx - 0x7717dbfc], cl
rol byte [eax], 1
add byte [ecx + 0x23c683c6], cl
add dword [eax], 0
mov dword [esi - 4], eax
jmp 0x496458
add byte [eax], al
invalid
out dx, eax
add ah, ch
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x34], esi
add byte [eax], al
je 0x496464
invalid
invalid
inc edx
pop eax
invalid
Function at 0x419d30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x410015
lea edi, [esi - 0xf015]
push edi
or ebp, 0xffffffff
jmp 0x419d52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419d59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419d48
mov eax, 1
add ebx, ebx
jne 0x419d6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419d60
jne 0x419d7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419d60
xor ecx, ecx
sub eax, 3
jb 0x419d90
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419e02
mov ebp, eax
add ebx, ebx
jne 0x419d9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419da8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x419dcc
inc ecx
add ebx, ebx
jne 0x419db8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x419dad
jne 0x419dc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419dad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x419dec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x419ddd
jmp 0x419d4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x419dec
add edi, ecx
jmp 0x419d4e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x419e0a
cmp byte [edi], 5
jne 0x419e0a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x419e0f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x419e87
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x419e3c
mov ecx, edi
jns 0x419e6b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x419e81
mov dword [ebx], eax
add ebx, 4
jmp 0x419e59
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x419ebb
sub esp, 0xffffff80
jmp 0x404c20

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x4059bd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40fba0
cmp edx, dword [eax]
je 0x4059df
add eax, 8
inc ecx
cmp eax, 0x40fc30
jl 0x4059d0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40fba0]
jne 0x405b0d
mov eax, dword [0x41f1f0]
cmp eax, 1
je 0x405ae7
test eax, eax
jne 0x405a10
cmp dword [0x40faec], 1
je 0x405ae7
cmp edx, 0xfc
je 0x405b0d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x405a47
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004067c0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00405e80
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x405a8a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00405e80
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40841c
push edi
call fcn.00406940
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004067c0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004067d0
lea eax, [ebp - 0xa0]
push 0x4083fc
push eax
call fcn.004067d0
push dword [esi + 0x40fba4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004067d0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004068b0
add esp, 0x2c
pop edi
jmp 0x405b0d
lea eax, [ebp + 8]
lea esi, [esi + 0x40fba4]
push 0
push eax
push dword [esi]
call fcn.00405e80
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x438c9b
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x438a14
add edx, 0xf959d755
call fcn.00438cd5
or ebx, ebx
add edx, ebx
xor dword [eax], ecx
add edx, edx
sub edx, 1
inc eax
add edx, 0x5cb8ce19
cmp eax, esi
jne fcn.00438c9b
and edx, ebx
add ebx, edx
sub edx, 0xc2657529
ret
Function at 0x401740
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edx + 0x3c]
add ecx, edx
mov edx, 0x10b
movzx eax, word [ecx + 0x18]
cmp ax, dx
je 0x401768
mov edx, 0x20b
cmp ax, dx
jne 0x4017d0
movzx eax, word [ecx + 0x14]
lea esi, [ecx + 0x18]
movzx ebx, word [ecx + 6]
add esi, eax
mov dword [ebp - 4], esi
mov dword [ebp - 8], ebx
cmp edi, dword [esi + 0x14]
jae 0x401789
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ecx, ecx
xor eax, eax
cmp cx, bx
jae 0x4017d0
movzx edx, ax
lea ecx, [edx + edx*4]
mov esi, dword [esi + ecx*8 + 0xc]
cmp edi, esi
jb 0x4017b0
mov ebx, dword [ebp - 4]
mov ecx, dword [ebx + ecx*8 + 0x10]
mov ebx, dword [ebp - 8]
add ecx, esi
cmp edi, ecx
jb 0x4017bb
inc eax
cmp ax, bx
jae 0x4017d0
mov esi, dword [ebp - 4]
jmp 0x401792
mov ecx, dword [ebp - 4]
lea eax, [edx + edx*4]
mov eax, dword [ecx + eax*8 + 0x14]
sub eax, esi
add eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403350
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, edx
mov edx, ecx
push esi
push edi
mov dword [ebp - 0xc], ebx
mov eax, dword [edx + 0x3c]
mov dword [ebp - 8], edx
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
add ecx, edx
mov dword [ebp - 0x10], eax
mov eax, ebx
shr eax, 0x10
mov dword [ebp - 4], ecx
test eax, eax
je 0x4033c7
mov esi, dword [ecx + 0x20]
xor edi, edi
mov ebx, dword [ecx + 0x24]
add esi, edx
add ebx, edx
cmp dword [ecx + 0x18], edi
jbe 0x4033c7
mov ecx, dword [esi]
add ecx, edx
xor edx, edx
cmp byte [ecx], dl
je 0x4033a7
nop word [eax + eax]
inc edx
cmp byte [edx + ecx], 0
jne 0x4033a0
push ecx
call fcn.004055e0
add esp, 4
cmp eax, dword [ebp - 0xc]
je 0x4033d9
mov eax, dword [ebp - 4]
inc edi
mov edx, dword [ebp - 8]
add esi, 4
add ebx, 2
cmp edi, dword [eax + 0x18]
jb 0x403390
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
movzx eax, word [ebx]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
push eax
call fcn.00402f30
push dword [ebp - 0x10]
mov edx, dword [ebp - 4]
mov esi, eax
mov ecx, esi
call fcn.00402c30
add esp, 8
test eax, eax
je 0x403407
mov ecx, esi
call fcn.00401c10
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4055e0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x42e008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, edx
lea eax, [ebp - 0x44]
push edi
mov edx, 0x40
nop dword [eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub edx, 1
jne 0x405600
push ebx
mov ebx, esi
lea edx, [ebp - 0x44]
shr ebx, 2
mov edi, ebx
test edi, edi
je 0x40562f
nop word [eax + eax]
mov eax, dword [ecx]
add ecx, 4
mov dword [edx], eax
add edx, 4
sub edi, 1
jne 0x405620
mov edi, esi
and edi, 3
je 0x405643
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
sub edi, 1
jne 0x405638
xor edx, edx
test esi, esi
jle 0x405667
nop dword [eax]
mov cl, byte [ebp + edx - 0x44]
lea eax, [ecx - 0x41]
cmp al, 0x19
ja 0x405662
add cl, 0x20
mov byte [ebp + edx - 0x44], cl
inc edx
cmp edx, esi
jl 0x405650
mov dword [ebp - 0x48], esi
lea edx, [ebp - 0x44]
mov edi, 0xb801fcda
cmp esi, 4
jl 0x4056a3
mov eax, ebx
neg eax
lea esi, [esi + eax*4]
nop
imul ecx, dword [edx], 0x5bd1e995
add edx, 4
imul edi, edi, 0x5bd1e995
mov eax, ecx
shr eax, 0x18
xor eax, ecx
imul ecx, eax, 0x5bd1e995
xor edi, ecx
sub ebx, 1
jne 0x405680
xor ecx, ecx
pop ebx
sub esi, 1
je 0x4056c5
sub esi, 1
je 0x4056bc
sub esi, 1
jne 0x4056ca
movzx ecx, byte [edx + 2]
shl ecx, 0x10
movzx eax, byte [edx + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [edx]
xor ecx, eax
imul edx, dword [ebp - 0x48], 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
mov eax, ecx
shr eax, 0x18
xor eax, ecx
imul ecx, eax, 0x5bd1e995
imul eax, edi, 0x5bd1e995
pop edi
pop esi
xor ecx, eax
mov eax, edx
shr eax, 0x18
xor eax, edx
imul ecx, ecx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor ecx, eax
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041c264
mov esp, ebp
pop ebp
ret