joyce8/EMBER2024-capa huggingface dataset:
Function at 0x492630
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x18], 0
je 0x492701
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x20]
push ebx
push edi
mov edi, dword [ebp + 0xc]
add eax, edi
cmp eax, ecx
jb 0x4926df
add ecx, ecx
cmp ecx, eax
jbe 0x492663
mov edi, ecx
mov dword [ebp - 4], edi
jmp 0x492668
mov dword [ebp - 4], eax
mov edi, eax
push 0
push edi
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
test ebx, ebx
je 0x49269d
push edi
push 0
push 0
push 0xf001f
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
jne 0x4926ab
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
mov eax, 0x300
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x18]
push ecx
push edx
push edi
call fcn.004965f0
mov eax, dword [esi + 0x18]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [esi + 0x18], edi
mov edi, dword [ebp + 0xc]
mov dword [esi + 0x20], edx
mov dword [esi + 4], ebx
mov ecx, dword [esi + 0x1c]
mov eax, dword [ebp + 8]
add ecx, dword [esi + 0x18]
push edi
push eax
push ecx
call fcn.004965f0
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi]
test eax, eax
je 0x49272d
mov ecx, dword [ebp + 0xc]
push 0
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp + 8]
push ecx
push edx
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret 8
mov dword [esi + 0xc], 0x1000000
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x4951ca
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4f3958]
jne 0x4951d4
repz ret
jmp fcn.004a03ec
Function at 0x4ae29b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0049fd29
and dword [ebp - 4], 0
cmp dword [0x4f85fc], 0
mov ebx, eax
jne 0x4ae34c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4ae3fd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4ae3fd
push eax
call fcn.0049fcb7
mov dword [esp], 0x4db600
push edi
mov dword [0x4f85fc], eax
call esi
push eax
call fcn.0049fcb7
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4f8600], eax
call esi
push eax
call fcn.0049fcb7
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4f8604], eax
call esi
push eax
call fcn.0049fcb7
pop ecx
mov dword [0x4f860c], eax
test eax, eax
je 0x4ae34c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0049fcb7
pop ecx
mov dword [0x4f8608], eax
mov eax, dword [0x4f8608]
cmp eax, ebx
je 0x4ae3a4
cmp dword [0x4f860c], ebx
je 0x4ae3a4
push eax
call fcn.0049fd32
push dword [0x4f860c]
mov esi, eax
call fcn.0049fd32
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4ae3a4
test edi, edi
je 0x4ae3a4
call esi
test eax, eax
je 0x4ae39b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4ae39b
test byte [ebp - 0xc], 1
jne 0x4ae3a4
or dword [ebp + 0x10], 0x200000
jmp 0x4ae3dd
mov eax, dword [0x4f8600]
cmp eax, ebx
je 0x4ae3dd
push eax
call fcn.0049fd32
pop ecx
test eax, eax
je 0x4ae3dd
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4ae3dd
mov eax, dword [0x4f8604]
cmp eax, ebx
je 0x4ae3dd
push eax
call fcn.0049fd32
pop ecx
test eax, eax
je 0x4ae3dd
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4f85fc]
call fcn.0049fd32
pop ecx
test eax, eax
je 0x4ae3fd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4ae3ff
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4b2a30
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4f3958]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
mov ebx, dword [esp + 0x214]
test ebx, ebx
jne 0x4b2a68
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.004951ca
add esp, 0x20c
ret
push esi
push 0x208
lea eax, [esp + 0xc]
push 0
push eax
call fcn.004953b0
add esp, 0xc
push 0x104
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jbe 0x4b2b33
mov ecx, ebx
lea esi, [ecx + 2]
lea ebx, [ebx]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x4b2aa0
sub ecx, esi
sar ecx, 1
mov edx, 0x103
sub edx, ecx
cmp eax, edx
jae 0x4b2b33
push edi
lea edi, [esp + 0xc]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4b2ac2
mov eax, dword [0x4c1884]
mov dword [edi], eax
mov eax, ebx
mov edx, ebx
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b2ae0
lea edi, [esp + 0xc]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4b2af4
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.004951ca
add esp, 0x20c
ret
mov ecx, dword [esp + 0x210]
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004951ca
add esp, 0x20c
ret
Function at 0x4b3620
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x2ec
mov eax, dword [0x4f3958]
xor eax, esp
mov dword [esp + 0x2e8], eax
push edi
mov edi, dword [esp + 0x2f4]
mov dword [esp + 0x18], edi
test edi, edi
je 0x4b3821
cmp dword [esp + 0x2f8], 0
je 0x4b3821
push 0x64
lea eax, [esp + 0x20]
push 0
push eax
call fcn.004953b0
add esp, 0xc
lea ecx, [esp + 4]
push ecx
push 8
push 0
push 0x4db6bc
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4b37e8
mov ecx, dword [esp + 4]
push ebx
push esi
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x100]
push eax
push ebx
mov esi, 0x104
push ecx
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x4b37db
lea ebx, [ebx]
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
push 1
push 0
lea eax, [esp + 0xf8]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4b37a9
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x1f4]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0
push str.ServiceName
push edx
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4b379e
push 0x64
push eax
lea eax, [esp + 0x90]
push eax
call fcn.004953b0
lea ecx, [esp + 0x1fc]
push 0x64
push ecx
lea edi, [esp + 0x9c]
call fcn.004b3510
add esp, 0x14
test eax, eax
je 0x4b379e
cmp byte [esp + 0x24], 0
je 0x4b3762
lea edx, [esp + 0x24]
push edx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jge 0x4b379e
lea eax, [esp + 0x24]
lea esi, [esp + 0x88]
mov ecx, eax
mov edx, 0x64
sub esi, ecx
lea ecx, [edx + 0x7fffff9a]
test ecx, ecx
je 0x4b3791
mov cl, byte [esi + eax]
test cl, cl
je 0x4b3791
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x4b3776
jmp 0x4b3795
test edx, edx
jne 0x4b3796
dec eax
mov byte [eax], 0
mov esi, 0x104
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0xc]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x100]
push ecx
inc ebx
push ebx
push edx
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x4b36c0
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
cmp byte [esp + 0x1c], 0
je 0x4b3821
mov edx, dword [esp + 0x2f8]
lea ecx, [esp + 0x1c]
push ecx
push edx
push edi
call fcn.0040a2e0
xor ecx, ecx
test eax, eax
setge cl
pop edi
mov eax, ecx
mov ecx, dword [esp + 0x2e8]
xor ecx, esp
call fcn.004951ca
add esp, 0x2ec
ret
mov ecx, dword [esp + 0x2ec]
pop edi
xor ecx, esp
xor eax, eax
call fcn.004951ca
add esp, 0x2ec
ret
Function at 0x4b3bc0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x50c
mov eax, dword [0x4f3958]
xor eax, esp
mov dword [esp + 0x508], eax
push ebp
mov ebp, dword [esp + 0x514]
test edi, edi
je 0x4b3d3d
cmp ebp, 0x20
jb 0x4b3d3d
push 0x400
lea eax, [esp + 0x110]
push 0
push eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0x400
call fcn.004953b0
add esp, 0xc
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x110]
push edx
lea eax, [esp + 0x10]
push eax
push 0x4cb518
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x4b3d3d
lea eax, [esp + 0x10c]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4b3c50
sub eax, edx
cmp eax, 0x40
jne 0x4b3d3d
push ebx
lea edx, [eax + 0x40]
push esi
lea eax, [esp + 0x14]
lea esi, [esp + 0x114]
mov ecx, eax
sub esi, ecx
lea ecx, [edx - 0x60]
test ecx, ecx
je 0x4b3c8e
mov cl, byte [esi + eax]
test cl, cl
je 0x4b3c8e
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x4b3c76
jmp 0x4b3c92
test edx, edx
jne 0x4b3c93
dec eax
mov byte [eax], 0
lea eax, [esp + 0x94]
lea edx, [esp + 0x134]
mov ecx, eax
mov esi, 0x80
sub edx, ecx
lea ecx, [ecx]
lea ecx, [esi + 0x7fffff7e]
test ecx, ecx
je 0x4b3ccb
mov cl, byte [edx + eax]
test cl, cl
je 0x4b3ccb
mov byte [eax], cl
inc eax
sub esi, 1
jne 0x4b3cb0
jmp 0x4b3ccf
test esi, esi
jne 0x4b3cd0
dec eax
push 0x400
lea edx, [esp + 0x118]
push 0
push edx
mov byte [eax], 0
call fcn.004953b0
push 0x400
lea ebx, [esp + 0x124]
lea ecx, [esp + 0x24]
call fcn.004b2c90
add esp, 0x10
lea eax, [esp + 0x94]
push eax
mov ecx, ebx
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
pop esi
pop ebx
test eax, eax
jne 0x4b3d3d
lea edx, [esp + 0xc]
push edx
push ebp
push edi
call fcn.0040a2e0
neg eax
sbb eax, eax
inc eax
pop ebp
mov ecx, dword [esp + 0x508]
xor ecx, esp
call fcn.004951ca
add esp, 0x50c
ret
mov ecx, dword [esp + 0x50c]
pop ebp
xor ecx, esp
xor eax, eax
call fcn.004951ca
add esp, 0x50c
ret
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x40388f
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x4038b8
cmp al, 0x22
je 0x4038b0
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x4038a4
cmp byte [esi], 0x22
jne 0x4038c2
inc esi
jmp 0x4038c2
cmp al, 0x20
jle 0x4038c2
inc esi
cmp byte [esi], 0x20
jg 0x4038bc
mov al, byte [esi]
test al, al
je 0x4038cc
cmp al, 0x20
jle 0x4038b5
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
call fcn.0040393a
push 0x405004
push section..data
call fcn.00403920
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x4038fc
movzx eax, word [ebp - 0x14]
jmp 0x4038ff
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.00403952
push esi
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x423b47
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x423b75
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x423b93
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00423ab1
jmp 0x423b93
mov eax, dword [esi + 0x14]
test eax, eax
je 0x423b93
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00423ab1
test edi, edi
mov eax, edi
jne 0x423b7d
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x438c24]
test ecx, ecx
je 0x423c46
jmp 0x423b46
ret 8

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408e84
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x642428f0
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x321d421e
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x404d00
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebx, eax
cmp byte [ebx], 0
jne 0x404d32
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ebx, [ebp - 0x10c]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push ebx
call fcn.00404b70
add esp, 0x14
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
lea eax, [edx + eax*4]
push eax
call fcn.004054e0
pop ecx
mov esi, eax
test esi, esi
jne 0x404d65
push 1
call fcn.00404530
pop ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
lea eax, [esi + eax*4]
push eax
push esi
push ebx
call fcn.00404b70
add esp, 0x14
mov eax, dword [ebp - 4]
dec eax
mov dword [0x407288], eax
mov dword [0x40728c], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404da0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test eax, eax
jne 0x404dbb
mov ebx, dword [0x407358]
mov esi, ebx
xor ecx, ecx
jmp 0x404dde
mov edx, esi
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x404dc6
inc eax
mov dword [ebp - 4], eax
cmp byte [esi], 0x3d
je 0x404dd9
add ecx, dword [ebp - 4]
mov eax, dword [ebp - 4]
add esi, eax
cmp byte [esi], 0
jne 0x404dc1
lea eax, [ecx + 1]
push eax
call fcn.004054e0
pop ecx
mov edi, eax
mov dword [0x407294], eax
cmp dword [0x407294], 0
jne 0x404e05
push 1
call fcn.00404530
pop ecx
mov esi, ebx
jmp 0x404e3a
mov edx, esi
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x404e0e
inc eax
mov dword [ebp - 4], eax
cmp byte [esi], 0x3d
je 0x404e35
mov ecx, edi
mov edx, esi
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x404e25
pop eax
mov eax, dword [ebp - 4]
add edi, eax
mov eax, dword [ebp - 4]
add esi, eax
cmp byte [esi], 0
jne 0x404e09
mov byte [edi], 0
cmp ebx, dword [0x407358]
je 0x404e51
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219
Function at 0x40f2c6
Capabilities:
Terminate process

Disassembly:
push 0x40100a
call fcn.00401000
call fcn.0040a00d
jmp 0x4f76c7
push 0x55c160
call 0x51e043
pop ecx
pop ecx
mov dword [0x8336d8], 2
cmp dword [ebp - 0x1c], ebx
jne 0x48e377
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x8336e0], ebx
je 0x48e3a0
push 0x8336e0
call fcn.00430a07
pop ecx
test eax, eax
je 0x48e3a0
push ebx
push 2
push ebx
call dword [0x8336e0]
push dword [0x620054]
jmp 0x545b9e
ret
cmp eax, ebx
je 0x4db2a7
cmp eax, esi
jne 0x4db297
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x4db2aa
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4f76e9
xor esi, esi
inc esi
mov eax, dword [0x8336d8]
cmp eax, esi
jne 0x4db2c4
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x5370e4
mov eax, dword [0x8336d8]
jmp 0x5370a6
push 0x10
push 0x55cc88
call fcn.00447250
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x8336dc
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
jmp 0x4db27c
test eax, eax
jne 0x5370de
mov dword [0x8336d8], esi
push 0x55c178
push 0x55c16c
call 0x50820b
pop ecx
pop ecx
test eax, eax
je 0x5370e4
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x53dff8
mov dword [0x62006c], esi
mov eax, dword [0x8336d8]
cmp eax, esi
jne 0x48e366
push 0x55c168
jmp 0x48e350
cmp dword [0x62006c], ebx
jne 0x53dfec
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x620068]
call fcn.00447295
jmp 0x4979ca
push dword [0x620058]
push dword [0x620050]
call fcn.004478e4
add esp, 0xc
mov dword [0x620068], eax
cmp dword [0x62005c], ebx
jne 0x53dfda
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
jmp dword [0x545bde]

Function at 0x41120e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
test edi, edi
jle 0x42d64c
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov edx, eax
sub esi, eax
lea ebx, [ecx + 1]
imul ebx, dword [ebp + 8]
xor bx, word [esi + edx]
inc ecx
mov word [edx], bx
add edx, 2
cmp ecx, edi
jl 0x411224
jmp dword [0x411247]
pop ebp
ret 8

Function at 0x42d650
Capabilities:
Encode data using xor

Disassembly:
lea ebx, [ebx]
mov edx, dword [esi]
lea ecx, [eax + 1]
imul ecx, dword [ebp + 8]
xor cx, word [ebx + eax*2]
inc eax
mov word [edx + eax*2 - 2], cx
cmp eax, edi
jl 0x4102ca
mov eax, esi
pop ebp
ret 8
push ebp
mov ebp, esp
cmp byte [0x665650], 0
jne 0x42d67a
push 0x1000
call dword [sym.imp.msvcrt.dll_malloc]
add esp, 4
mov dword [0x66540c], eax
mov byte [0x665650], 1
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x66540c]
lea edx, [ecx + eax*2]
xor eax, eax
mov dword [esi], edx
test edi, edi
jle 0x4102e5
jmp 0x4102c4
Function at 0x42e824
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42e844
push 0x4000
jmp 0x4816ec
sub eax, edx
push 0
push 0x665a88
mov dword [ebp - 0x214], eax
call sub.msvcrt.dll_memset
add esp, 0xc
xor ebx, ebx
mov byte [0x665a88], 0
mov byte [ebp - 0x20d], bl
mov cl, byte [ebx + 0x61ff20]
test cl, cl
jne 0x481727
mov byte [ebp - 0x20d], 1
mov eax, ebx
cdq
idiv dword [ebp - 0x214]
mov eax, dword [ebp + 8]
jmp 0x4e340a
pop esi
xor ecx, ebp
pop ebx
call fcn.005081f7
mov esp, ebp
pop ebp
ret
mov dl, byte [edx + eax]
xor dl, cl
mov byte [ebx + 0x61ff20], dl
xor eax, eax
lea esp, [esp]
lea ecx, [eax + 1]
imul ecx, ecx, 0x3a3a
xor cx, word [eax*2 + 0x55c790]
inc eax
mov word [ebp + eax*2 - 0x20e], cx
cmp eax, 4
jl 0x4e341b
movzx edx, dl
push edx
lea eax, [ebp - 0x20c]
jmp 0x4e4c2e
push eax
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.msvcrt.dll_sprintf]
lea eax, [ebp - 0x10c]
add esp, 0xc
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4e4c47
mov edi, 0x665a88
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4e4c5c
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc ebx
cmp byte [ebp - 0x20d], 0
rep movsb byte es:[edi], byte [esi]
je 0x481712
mov ecx, dword [ebp - 8]
pop edi
jmp 0x4da4ce