joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403fd4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x404028
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00403b9d
push eax
push esi
push dword [ebp + 8]
call fcn.00403b52
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00403b8d
outsd dx, dword [esi]
xor al, 0xb6
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.00403b8d
test al, 0xd5
stosd dword es:[edi], eax
adc al, 0x8d
test dword [edi + edi*8 - 1], edi
call dword [eax - 0x18]
sbb al, 0xfb
invalid

Function at 0x405f90
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x405fad
and eax, 0xfffffffe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
ret 4

Function at 0x405fb0
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [eax + 1]
push 0
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc

Function at 0x405fe0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x40968c]
mov dword [ebp - 8], eax
mov eax, dword [0x409690]
dec edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
add word [ebp - 4], dx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x406030
test edi, edi
jne 0x405fed
mov word [esi], ax
pop edi
pop esi
leave
ret 8
mov eax, esi
jmp 0x40602a
Function at 0x406034
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
xor eax, eax
mov word [esi], ax
lea eax, [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4060ad
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp + 0x14]
push eax
push 0
push dword [ebp + 0x10]
mov dword [ebp + 0xc], 0x4008
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x406096
cmp dword [ebp + 0x14], 1
je 0x40609b
cmp dword [ebp + 0x14], 2
je 0x40609b
xor eax, eax
mov word [esi], ax
push dword [ebp + 0x18]
xor eax, eax
mov word [esi + 0x4006], ax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
ret 0x14

Function at 0x406248
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x406271
mov eax, dword [0x40b058]
cmp eax, 0xffffffff
je 0x406265
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x40b058], 0xffffffff
jmp 0x40631c
cmp dword [0x461530], ebx
je 0x40631c
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
cmp word [0x46a560], bx
je 0x4062e8
cmp dword [0x40b058], 0xffffffff
jne 0x4062f1
mov esi, 0x46a560
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 4
push 0x40000000
push esi
mov dword [ebp + 8], eax
call fcn.00405fb0
mov dword [0x40b058], eax
cmp eax, 0xffffffff
je 0x40631a
cmp dword [ebp + 8], 0xffffffff
jne 0x4062dd
push ebx
lea ecx, [ebp - 4]
push ecx
push 2
lea ecx, [ebp + 8]
push ecx
push eax
mov dword [ebp + 8], 0xfeff
call edi
mov eax, dword [0x40b058]
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x40b058], 0xffffffff
je 0x40631a
push 0x4096a8
mov esi, 0x461540
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
lea ecx, [ebp + 8]
push ecx
add eax, eax
push eax
push esi
push dword [0x40b058]
call edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10028420
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, 0x55555556
push esi
push edi
lea ecx, [ebx*4]
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, 4
add eax, edx
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
mov dword [ebp + 0xc], edi
mov esi, edi
test edi, edi
jne 0x1002845e
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
test ebx, ebx
jle 0x100284f0
mov edi, dword [ebp + 8]
nop dword [eax + eax]
movzx edx, byte [eax + edi]
inc eax
shl edx, 8
cmp eax, ebx
jge 0x10028482
movzx ecx, byte [eax + edi]
add edx, ecx
inc eax
shl edx, 8
cmp eax, ebx
jge 0x10028490
movzx ecx, byte [eax + edi]
add edx, ecx
mov ecx, edx
inc eax
sar ecx, 0x12
and ecx, 0x3f
movzx ecx, byte [ecx + section..data]
mov byte [esi], cl
mov ecx, edx
sar ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + section..data]
mov byte [esi + 1], cl
mov ecx, edx
sar ecx, 6
and edx, 0x3f
and ecx, 0x3f
movzx ecx, byte [ecx + section..data]
mov byte [esi + 2], cl
movzx ecx, byte [edx + section..data]
mov byte [esi + 3], cl
cmp eax, ebx
jle 0x100284db
mov byte [esi + 3], 0x3d
lea ecx, [ebx + 1]
cmp eax, ecx
jle 0x100284e6
mov byte [esi + 2], 0x3d
add esi, 4
cmp eax, ebx
jl 0x10028470
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
lea ecx, [edi + 1]
mov byte [esi], 0
mov dword [eax], edi
nop dword [eax + eax]
mov al, byte [edi]
inc edi
test al, al
jne 0x10028500
sub edi, ecx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x100292f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x10029321
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x10029310
pop edi
mov eax, edx
pop esi
pop ebp
ret 8

Function at 0x100294c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x1c], 0x10
push ebx
mov ebx, dword [eax + 0x18]
push esi
lea esi, [eax + 8]
mov dword [ebp - 4], ecx
push edi
jb 0x100294db
mov esi, dword [esi]
xor edx, edx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x100294f7
movzx ecx, byte [esi + edx]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, ebx
jb 0x100294e6
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x18]
and ecx, edi
lea esi, [ecx*8]
mov ecx, dword [edx + 0xc]
add ecx, esi
cmp dword [ecx + 4], eax
jne 0x1002952d
cmp dword [ecx], eax
jne 0x10029525
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [ecx + esi + 4], eax
jmp 0x10029535
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
jmp 0x10029535
cmp dword [ecx], eax
jne 0x10029538
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lea ecx, [edx + 4]
push eax
push esi
call fcn.10029dd0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1002d050
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003785c
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x1004a0e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 0x14]
mov ebx, dword [edi + 0x10]
mov dword [ebp - 0x24], eax
cmp eax, 0x10
jb 0x1002d090
mov esi, dword [edi]
jmp 0x1002d092
mov esi, edi
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x1002d0b1
nop dword [eax]
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x1002d0a0
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 0x18]
and eax, edx
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x1c], edx
mov esi, dword [edx + eax*8]
add eax, eax
lea edi, [eax*4 + 4]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x20], eax
mov edi, dword [ebp + 0xc]
cmp eax, dword [ecx + 4]
jne 0x1002d0e1
mov eax, dword [ecx + 4]
jmp 0x1002d0e9
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + edx]
mov eax, dword [eax]
cmp esi, eax
je 0x1002d1fd
lea ecx, [esi + 8]
cmp dword [edi + 0x14], 0x10
jb 0x1002d0fc
mov edi, dword [edi]
cmp dword [ecx + 0x14], 0x10
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x14], eax
jb 0x1002d10a
mov ecx, dword [ecx]
cmp eax, ebx
mov edx, ebx
cmovb edx, eax
test edx, edx
je 0x1002d173
sub edx, 4
jb 0x1002d131
nop word [eax + eax]
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x1002d136
add ecx, 4
add edi, 4
sub edx, 4
jae 0x1002d120
cmp edx, 0xfffffffc
je 0x1002d16a
mov al, byte [ecx]
cmp al, byte [edi]
jne 0x1002d163
cmp edx, 0xfffffffd
je 0x1002d16a
mov al, byte [ecx + 1]
cmp al, byte [edi + 1]
jne 0x1002d163
cmp edx, 0xfffffffe
je 0x1002d16a
mov al, byte [ecx + 2]
cmp al, byte [edi + 2]
jne 0x1002d163
cmp edx, 0xffffffff
je 0x1002d16a
mov al, byte [ecx + 3]
cmp al, byte [edi + 3]
je 0x1002d16a
sbb eax, eax
or eax, 1
jmp 0x1002d16c
xor eax, eax
test eax, eax
jne 0x1002d186
mov eax, dword [ebp - 0x14]
cmp eax, ebx
jae 0x1002d17c
or eax, 0xffffffff
jmp 0x1002d184
xor eax, eax
cmp dword [ebp - 0x14], ebx
setne al
test eax, eax
sete al
test al, al
sete al
test al, al
je 0x1002d1a2
mov esi, dword [esi]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
jmp 0x1002d0d4
lea ecx, [esi + 8]
cmp dword [ecx + 0x14], 0x10
mov edi, dword [ecx + 0x10]
jb 0x1002d1b0
mov ecx, dword [ecx]
cmp dword [ebp - 0x24], 0x10
mov edx, dword [ebp + 0xc]
jb 0x1002d1bb
mov edx, dword [edx]
cmp ebx, edi
mov eax, edi
cmovb eax, ebx
push eax
push ecx
push edx
call fcn.100289c0
add esp, 0xc
test eax, eax
jne 0x1002d1de
cmp ebx, edi
jb 0x1002d1de
cmp ebx, edi
setne al
test eax, eax
je 0x1002d1e4
mov ecx, dword [ebp - 0x10]
mov esi, dword [ecx + 4]
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
mov ecx, dword [ecx + 4]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4108d1
Capabilities:
Encode data using xor

Disassembly:
iretd
jo 0x410864
push edi
cli
push ebp
imul edx, dword [ebp - 0x433079e9], 0xe
popal
add eax, 0x117fd581
call 0xfa426ab8
fcmovnb st(0), st(6)
mov ebx, 0x84da9c51
enter 0xffffffffffffcdd5, 0x59
in al, 0xaa
loop 0x41095d
or dword [ecx + esi*8 - 0x2c], edx
imul dword [ebp + ebx*4 + 4]
sub dword [edi - 0x438641f2], 0xf6a2558b
and dword [ebp - 0x6fbe302f], esp
fmul st(7), st(0)
push es
fmul dword [ebp + 0x1f64d1f0]
add al, 0x10
adc dword [eax - 0x20], esi
xor al, 0xb9
rol dword [edx - 0x17], 1
jo 0x4108ff
add al, 0x81
scasd eax, dword es:[edi]
push cs
mov esi, 0x558bbc79
mov byte [0xd1a521f6], al
iretd
test eax, 0xf2b7dc6c
idiv byte [edi - 0x4b4c9b7f]
insb byte es:[edi], dx
fdiv qword [edi - 0x7e40090e]
mov bl, 0xb4
adc eax, 0x92ec7d5e
add byte [ecx + 0x5b], bl
int1
sub byte [edi], 0xb0
sbb eax, 0x705f1b80
inc ecx
in al, dx
fbld tbyte [ebx + 0x40]
lds edx, [eax + 0x45]
jp 0x4108d3
dec edx
adc eax, 0xb8c2a348
fmulp st(0)
invalid
in eax, dx
push ecx
inc ebp
push esp
jmp 0x410927

Function at 0x580a01
Capabilities:
Encode data using xor

Disassembly:
pushal
xor dword [ebx - 0x27440fbc], esi
invalid
sal dword [edi], cl
or dword [esi - 6], 0x62
adc dword [edx + eax*2], ebp
popfd
daa
mov esp, 0xb0dbd2bf
mov dword [ebx], 0x1c6d147d
dec edx
sbb byte [edx], bl
sbb byte [edx + 0x29], al
push ss
popal
out 0x1f, al
adc al, 0xa7
nop
lea ecx, [eax]
sbb byte [edx - 0x7eb074bd], 0x23
dec ebx
dec edi
xchg esp, eax
mov eax, dword [0xd187dd88]
movsb byte es:[edi], byte [esi]
jecxz 0x580a80
bound ebp, qword [edi]
mov ah, 0xfc
jecxz 0x5809b7
bound esp, qword [ecx - 0x33bdb5fe]
mov cl, 0x1a
mov ch, 0x3f
loopne 0x5809e3
dec eax
ror edi, cl
and byte [ebx + 0x4f], dh
ret 0xfb45
xchg esp, eax
xor al, 0xc6
add edx, dword [edi]
leave
arpl word [esp + eax*8 - 0x13ce0cd4], cx
mov esp, es
sub al, 0xf3
xor esp, ebp
push edi
push ebx
js 0x580a87
out dx, al
mov byte [0xac81cab1], al
push ebx
sbb edi, ecx
ljmp 0x10f4
Function at 0x598650
Capabilities:
Encode data using xor

Disassembly:
jmp 0x5986cb
movsd dword es:[edi], dword [esi]
xor al, byte [edx - 0x52fb1d2c]
xor al, 0xa2
inc ebp
xchg edx, eax
sub al, 0x17
and eax, 0x3cfaf0c4
lea eax, [ecx*8 + 0x25fef3b1]
inc esi
in al, 0xc9
shl byte [eax - 0x7eee992f], 0x6c
or al, 0x71
aam 0x8a
and byte [eax - 0x1aee51b], dh
mov ch, 0xec
pushfd
dec ecx
xlatb
mov byte [ebp + 0x3856b936], dl
das
wait
cli
test al, 0x52
aam 0xbe
lahf
mov dh, 0x7b
push ebx
push ebx
movsd dword es:[edi], dword [esi]
inc esp
in al, dx
fdivp st(2)
xor ch, 0x57
stosd dword es:[edi], eax
mov ecx, 0x44365b2c
out dx, al
push es
mov bh, 1
pop es
out 0x4a, al
in al, 0x1b
mov ch, 0x44
jbe 0x59870f
dec esp
adc eax, 0x810302af
insb byte es:[edi], dx
mov bh, 0xb8
xor eax, dword [ebx - 0x27]
wait
mov bh, 0xb1
adc cl, al
loop 0x5986fc
xor byte [ecx + 0x3b], ch
imul ebx, dword [edx - 0x59550c89], 0x62441c0e
xor eax, 0xc7c7e776
add al, 0xa8
jb 0x5987bc
mov esi, 0x55c8564
and al, 0xc6
xor al, 0xd6
add eax, 0xeb2218c4
xor edi, eax
pop es
add bl, dl
loop 0x5987da
cli
add al, 0x3b
sub bh, byte [eax]
cld
mov ebp, ebx
popfd
or bl, cl
stosd dword es:[edi], eax
outsb dx, byte [esi]
mov word [edx + 2], es
or dh, byte [eax + 0x14e9f3f0]
or bl, byte [edx]
out 0x12, eax
ror ch, cl
mov ebx, 0xbe2fd2dc
xor esi, dword [ebx + eax]
aas
dec eax
rcl byte fs:[ecx]
out 0xec, al
js 0x5987fb
and dl, byte [esi + 0x4366c8f8]
cmpsd dword [esi], dword es:[edi]
push esp
pop es
sbb dword [eax + 0x4eac2924], esi
inc eax
pop edx
ret 0x4772
adc byte es:[ebp - 0x7f2637ec], bl
xchg dl, al
out 0x23, al
movsd dword es:[edi], dword [esi]
inc edi
dec esp
jecxz 0x5987df
lahf
shl byte [edx], 0xfa
pop edx
popal
rcl byte [edi + 0x60], 0x81
adc byte [ebx], 0xaf
scasd eax, dword es:[edi]
sbb byte ss:[eax + 4], dh
iretd
cmpsd dword [esi], dword es:[edi]
dec esp
aaa
jg 0x5987d9
int 0x2b
invalid
lodsb al, byte [esi]
mov edi, 0x1567a482
aas
push esp
jbe 0x59883b
mov bl, 0x15
sti
push esp
aaa
add al, bh
int 0xb4
dec eax
inc ebx
daa
xchg esp, eax
cmc
jecxz 0x5987e8
and esi, esp
adc al, 0x40
and bh, dh
fimul dword [ebx + 0x4d86b224]
push ds
call 0x67be2b69
dec esi
xor ah, byte [ecx + esi*8]
inc ebx
mov dl, 0x3d
xchg ecx, eax
inc edi
in al, dx
mov edx, 0x592af7a
add al, ah
add ch, byte [ebx]
push 0xf290ffa4
enter 0xffffffffffff9a62, 0xffffffffffffff99
cwde
sal dword [esi - 0x216fa85d], 1
or ah, dh
lodsb al, byte [esi]
push esi
retf 0xca17
Function at 0x41e7c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x19000]
push edi
or ebp, 0xffffffff
jmp 0x41e7e2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41e7e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41e7d8
mov eax, 1
add ebx, ebx
jne 0x41e7fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41e7f0
jne 0x41e80c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41e7f0
xor ecx, ecx
sub eax, 3
jb 0x41e820
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41e892
mov ebp, eax
add ebx, ebx
jne 0x41e82b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41e838
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41e85c
inc ecx
add ebx, ebx
jne 0x41e848
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41e83d
jne 0x41e859
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41e83d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41e87c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41e86d
jmp 0x41e7de
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41e87c
add edi, ecx
jmp 0x41e7de
pop esi
mov edi, esi
mov ecx, 0x88
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41e89a
cmp byte [edi], 3
jne 0x41e89a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41e89f
lea edi, [esi + 0x1c000]
mov eax, dword [edi]
or eax, eax
je 0x41e917
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x204f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x20570]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41e8cc
mov ecx, edi
jns 0x41e8fb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x20578]
or eax, eax
je 0x41e911
mov dword [ebx], eax
add ebx, 4
jmp 0x41e8e9
call dword [esi + 0x20574]
mov ebp, dword [esi + 0x2057c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41e94b
sub esp, 0xffffff80
jmp 0x401745

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401b10
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._vfprintf
call sym._abort
jmp dbg.mark_section_writable

Function at 0x401b70
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x405050]
test esi, esi
jle 0x401c5d
mov edi, dword [0x405054]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x401ba4
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x401c56
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x401b90
mov dword [esp], eax
mov ebx, eax
call dbg.__mingw_GetSectionForAddress
test eax, eax
mov edi, eax
je 0x401c9a
lea ebx, [esi + esi*2]
mov esi, dword [0x405054]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call dbg._GetPEImageBase
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x405054]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401c7a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x401c4f
sub eax, 0x40
and eax, 0xffffffbf
je 0x401c4f
mov eax, dword [esp + 0x20]
add ebx, dword [0x405054]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x401c64
add dword [0x405050], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x401bae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
mov eax, dword [0x405054]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
Function at 0x402160
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x405408
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x405400]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x4021b5
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4021ae
test esi, esi
je 0x4021ae
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402190
mov dword [esp], 0x405408
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4023d0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x402408
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x4023fe
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40240a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x4023f0
xor eax, eax
pop ebx
pop esi
ret