joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4553c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x49000]
push edi
or ebp, 0xffffffff
jmp 0x4553e2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4553e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4553d8
mov eax, 1
add ebx, ebx
jne 0x4553fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x45540c
jne 0x45542b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45542b
dec eax
add ebx, ebx
jne 0x455418
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4553f0
add ebx, ebx
jne 0x455427
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x45547d
xor ecx, ecx
sub eax, 3
jb 0x455443
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4554b2
sar eax, 1
mov ebp, eax
jmp 0x45544e
add ebx, ebx
jne 0x45544e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45541c
inc ecx
add ebx, ebx
jne 0x45545c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45541c
add ebx, ebx
jne 0x455469
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x45545e
jne 0x45547a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45545e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x45549c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x45548e
jmp 0x4553de
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x45549c
add edi, ecx
jmp 0x4553de
pop esi
mov edi, esi
mov ecx, 0x92b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4554ba
cmp byte [edi], 7
jne 0x4554ba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4554bf
lea edi, [esi + 0x53000]
mov eax, dword [edi]
or eax, eax
je 0x455537
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x89084]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x890fc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4554ec
mov ecx, edi
jns 0x45551b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x89100]
or eax, eax
je 0x455531
mov dword [ebx], eax
add ebx, 4
jmp 0x455509
call dword [esi + 0x89108]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x455568
cmp al, 0xef
ja 0x45555b
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x45553d
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x45554a
mov ebp, dword [esi + 0x89104]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x45559c
sub esp, 0xffffff80
jmp 0x415410
Function at 0x401784
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
not eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
jmp 0x40183a
mov eax, dword [ebp - 4]
shr eax, 8
mov edx, eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
movzx eax, al
xor eax, dword [ebp - 4]
movzx eax, al
mov eax, dword [eax*4 + 0x12074c0]
xor eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shr eax, 8
mov edx, eax
mov eax, dword [ebp - 8]
add eax, 1
movzx eax, byte [eax]
movzx eax, al
xor eax, dword [ebp - 4]
movzx eax, al
mov eax, dword [eax*4 + 0x12074c0]
xor eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shr eax, 8
mov edx, eax
mov eax, dword [ebp - 8]
add eax, 2
movzx eax, byte [eax]
movzx eax, al
xor eax, dword [ebp - 4]
movzx eax, al
mov eax, dword [eax*4 + 0x12074c0]
xor eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shr eax, 8
mov edx, eax
mov eax, dword [ebp - 8]
add eax, 3
movzx eax, byte [eax]
movzx eax, al
xor eax, dword [ebp - 4]
movzx eax, al
mov eax, dword [eax*4 + 0x12074c0]
xor eax, edx
mov dword [ebp - 4], eax
add dword [ebp - 8], 4
sub dword [ebp + 0x10], 4
cmp dword [ebp + 0x10], 3
ja 0x40179d
jmp 0x401871
mov eax, dword [ebp - 4]
shr eax, 8
mov edx, eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
movzx eax, al
xor eax, dword [ebp - 4]
movzx eax, al
mov eax, dword [eax*4 + 0x12074c0]
xor eax, edx
mov dword [ebp - 4], eax
add dword [ebp - 8], 1
sub dword [ebp + 0x10], 1
cmp dword [ebp + 0x10], 0
jne 0x401846
mov eax, dword [ebp - 4]
not eax
leave
ret
Function at 0x420110
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.004269a0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.004269a0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x420170
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x126907c]
test esi, esi
jle 0x420290
mov eax, dword [0x1269080]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x4201a4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x420227
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x420190
mov dword [esp], ebx
call fcn.00420af0
mov edi, eax
test eax, eax
je 0x4202b7
mov eax, dword [0x1269080]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00420c30
mov edx, dword [0x1269080]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x420297
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x420220
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x420230
add dword [0x126907c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x1269080]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x420220
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00420110
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x4201ae
mov eax, dword [0x1269080]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00420110
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00420110
lea esi, [esi]
nop
Function at 0x420770
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x1269098
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x1269090]
sub esp, 4
test ebx, ebx
je 0x4207c5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4207be
test esi, esi
je 0x4207be
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4207a0
mov dword [esp], 0x1269098
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x420af0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x420b15
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x420b20
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x420b15
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test esi, esi
je 0x420b68
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x420b5e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x420b6a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x420b50
xor eax, eax
pop ebx
pop esi
ret
Function at 0x4585a3
Capabilities:
Terminate process

Disassembly:
jmp 0x48dbf0
jmp fcn.004a02a0
cmp ecx, dword [0x79daf4]
jne 0x48dbfa
repz ret
jmp 0x458b7a
Function at 0x4e8580
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, esp
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp esi, esp
call fcn.0045761c
test eax, eax
jne 0x4e85ba
push str.GetFileSizeEx__
push 0
push 0x11e
push 0x7a0024
call fcn.0045894a
add esp, 0x10
jmp 0x4e85c1
mov eax, 1
jmp 0x4e85c3
xor eax, eax
pop esi
cmp ebp, esp
call fcn.0045761c
pop ebp
ret

Function at 0x4e8950
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
mov esi, esp
push 0
push 0
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
cmp esi, esp
call fcn.0045761c
test eax, eax
jne 0x4e89bb
push 0x79fe90
push 0
push 0xf9
push 0x79febc
call fcn.0045894a
add esp, 0x10
jmp 0x4e8a25
mov esi, esp
push 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp esi, esp
call fcn.0045761c
test eax, eax
jne 0x4e89fb
push str.ReadFile__
push 0
push 0xfc
push 0x79fef8
call fcn.0045894a
add esp, 0x10
jmp 0x4e8a25
mov eax, dword [ebp + 0x18]
cmp eax, dword [ebp - 8]
je 0x4e8a1e
push 0x79ff18
push 1
push 0xfe
push 0x79ff28
call fcn.00457f9a
add esp, 0x10
jmp 0x4e8a25
mov eax, 1
jmp 0x4e8a27
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x4e8a48]
call fcn.00456776
pop eax
pop edx
pop esi
add esp, 0x1c
cmp ebp, esp
call fcn.0045761c
mov esp, ebp
pop ebp
ret
Function at 0x4e93b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
mov esi, esp
push 0
push 0
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
cmp esi, esp
call fcn.0045761c
test eax, eax
jne 0x4e941b
push 0x79ff48
push 0
push 0x10e
push 0x79ff74
call fcn.0045894a
add esp, 0x10
jmp 0x4e9485
mov esi, esp
push 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp esi, esp
call fcn.0045761c
test eax, eax
jne 0x4e945b
push str.WriteFile__
push 0
push 0x111
push 0x79ffb0
call fcn.0045894a
add esp, 0x10
jmp 0x4e9485
mov eax, dword [ebp + 0x18]
cmp eax, dword [ebp - 8]
je 0x4e947e
push 0x79ffd0
push 1
push 0x113
push 0x79ffe0
call fcn.00457f9a
add esp, 0x10
jmp 0x4e9485
mov eax, 1
jmp 0x4e9487
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x4e94a8]
call fcn.00456776
pop eax
pop edx
pop esi
add esp, 0x1c
cmp ebp, esp
call fcn.0045761c
mov esp, ebp
pop ebp
ret

Function at 0x4eb550
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp esi, esp
call fcn.0045761c
test eax, eax
jne 0x4eb586
push str.SetEndOfFile__
push 0
push 0x132
push 0x7a00b4
call fcn.0045894a
add esp, 0x10
jmp 0x4eb58d
mov eax, 1
jmp 0x4eb58f
xor eax, eax
pop esi
cmp ebp, esp
call fcn.0045761c
pop ebp
ret
Function at 0x401160
Capabilities:
Check http status code
Connect to http server
Create http request
Get http content length
Read data from internet
Receive data
Send data
Send http request

Disassembly:
sub esp, 0x24
mov eax, dword [0x40bf90]
push ebx
push ebp
push edi
xor ebp, ebp
push ebp
push ebp
push ebp
push ebp
xor ebx, ebx
push ebp
mov dword [esp + 0x28], ebx
mov dword [esp + 0x3c], 0x4092b0
mov dword [esp + 0x40], ebp
mov dword [esp + 0x30], eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, eax
mov dword [esp + 0x20], edi
cmp edi, ebp
je 0x4012ef
mov ecx, dword [0x40bf94]
push esi
push ebp
push ebp
push 3
push ebp
push ebp
push 0x50
push ecx
push edi
call dword [sym.imp.WININET.dll_InternetConnectW]
mov esi, eax
mov dword [esp + 0x28], esi
cmp esi, ebp
je 0x4012e7
mov eax, dword [0x40bf98]
push ebp
push 0x4000000
lea edx, [esp + 0x34]
push edx
push ebp
push ebp
push eax
push ebp
push esi
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov ebx, eax
cmp ebx, ebp
je 0x4012dc
push ebp
push ebp
push ebp
push ebp
push ebx
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0x4012cd
mov esi, dword [sym.imp.WININET.dll_HttpQueryInfoW]
push ebp
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x24]
push edx
push 0x20000013
mov edi, 4
push ebx
mov dword [esp + 0x24], edi
call esi
test eax, eax
je 0x4012cd
cmp dword [esp + 0x1c], 0xc8
jne 0x4012cd
push ebp
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0x20000005
push ebx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x24], edi
call esi
test eax, eax
je 0x4012cd
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x4012cd
inc eax
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
add byte [eax - 1], dl
adc eax, sym.imp.KERNEL32.dll_HeapAlloc
mov edi, eax
cmp edi, ebp
je 0x4012cd
mov ebp, dword [sym.imp.WININET.dll_InternetReadFile]

Function at 0x401300
Capabilities:
Get file size
Read file via mapping

Disassembly:
sub esp, 0x218
mov eax, dword [0x40a004]
xor eax, esp

Function at 0x401430
Capabilities:
Set current directory

Disassembly:
sub esp, 0x10c
mov eax, dword [0x40a004]
xor eax, esp
mov dword [esp + 0x108], eax
push 0x105
lea eax, [esp + 4]
push 0
push eax
call fcn.004057a0
add esp, 0xc
push 0x105
lea ecx, [esp + 4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401470
sub eax, edx
add eax, 0xffffffff
js 0x401490
mov cl, 0x5c
cmp byte [esp + eax], cl
je 0x40148c
sub eax, 1
jns 0x401480
jmp 0x401490
mov byte [esp + eax], 0
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.0040154d
add esp, 0x10c
ret

Function at 0x40154d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40a004]
jne 0x401557
repz ret
jmp fcn.0040170c
Function at 0x413c54
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
pushal
call 0x413c60
pop ebx
sub ebx, 0x402c60
mov eax, 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0x424642
push 0
push 0x20
push 3
push 0
push 3
push 0xc0000000
push dword [ebp + 8]
call dword [ebx + fcn.00401291]
cmp eax, 0xffffffff
je 0x413de6
mov dword [ebp - 4], eax
push 2
push 0
push 0xfffffffffffffffc
push dword [ebp - 4]
call dword [ebx + fcn.004012a5]
lea eax, [ebp - 8]
lea ecx, [ebp - 0xc]
push 0
push ecx
push 4
push eax
push dword [ebp - 4]
call dword [ebx + fcn.00401311]
mov eax, dword [ebp - 8]
cmp eax, 0x424642
jne 0x413cd1
jmp 0x413ddd
push 0
push dword [ebp - 4]
call dword [ebx + 0x4012b9]
mov dword [ebp - 8], eax
cmp eax, 0x1000
jae 0x413ceb
jmp 0x413ddd
cmp eax, 0xe00000
jbe 0x413cf7
jmp 0x413ddd
or eax, eax
je 0x413de6
mov ecx, dword [ebp - 8]
add ecx, 0x6000
mov dword [ebp - 0x14], ecx
push 0
push ecx
push 0
push 4
push 0
push dword [ebp - 4]
call dword [ebx + 0x401295]
or eax, eax
je 0x413d95
mov dword [ebp - 0xc], eax
push dword [ebp - 0x14]
push 0
push 0
push 2
push dword [ebp - 0xc]
call dword [ebx + 0x401299]
or eax, eax
je 0x413d8c
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0
mov esi, dword [ebp - 0x10]
cmp word [esi], 0x5a4d
je 0x413d50
jmp 0x413d83
mov eax, dword [esi + 0x3c]
cmp eax, 0x200
jbe 0x413d5c
jmp 0x413d83
add esi, dword [esi + 0x3c]
cmp dword [esi], 0x4550
je 0x413d69
jmp 0x413d83
push dword [ebp - 8]
push esi
push dword [ebp - 0x10]
call fcn.00413b2c
mov dword [ebp - 0x14], eax
push 0
push dword [ebp - 0x10]
call dword [ebx + 0x4012c5]
push dword [ebp - 0x10]
call dword [ebx + 0x40129d]
push dword [ebp - 0xc]
call dword [ebx + fcn.004012ad]
cmp dword [ebp - 0x14], 0
je 0x413ddd
mov eax, dword [ebp - 0x14]
sub eax, 4
push 0
push 0
push eax
push dword [ebp - 4]
call dword [ebx + fcn.004012a5]
lea eax, [ebp - 0x18]
lea ecx, [ebp - 8]
push 0
push ecx
push 4
push eax
push dword [ebp - 4]
call dword [ebx + fcn.004012a1]
push 0
push 0
push dword [ebp - 0x14]
push dword [ebp - 4]
call dword [ebx + fcn.004012a5]
push dword [ebp - 4]
call dword [ebx + 0x4012a9]
push dword [ebp - 4]
call dword [ebx + fcn.004012ad]
popal
leave
ret 4

Function at 0x414327
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
pushal
mov dword [ebp - 4], 0
call fcn.0041433a

Function at 0x4143a1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
pushal
mov dword [ebp - 4], 0
call fcn.004143b4
Function at 0x401426
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
xor eax, eax
mov edi, eax
mov dword [ebp - 0x4c], 0x30
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], 3
mov dword [0x4041b0], eax
mov eax, edi
mov dword [ebp - 0x44], 0x40132e
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], str.Hall
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
test eax, eax
je 0x4014f0
mov eax, 0x80000000
push edi
push dword [ebp - 0x38]
push edi
push edi
push eax
push eax
push eax
push eax
push 0
push str.moossi
push str.Hall
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0
push eax
mov dword [0x4041b8], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x4041b8]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push edi
push edi
push edi
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
je 0x4014f0
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [ebp - 0x1c]
push eax
call edi
lea ecx, [ebp - 0x1c]
push ecx
call ebx
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
jne 0x4014d5
mov esp, ebp
pop ebp
ret 0x10

Function at 0x42e001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x27176455
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data_1
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x3775467e
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x48df2d
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x4932e8
call fcn.0048e6a1
push 1
call fcn.0048e1e9
pop ecx
test al, al
jne 0x48dde4
push 7
call fcn.0048e463
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0048e1b4
mov byte [ebp - 0x24], al
mov eax, dword [0x49993c]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x48dddd
test eax, eax
jne 0x48de4e
mov dword [0x49993c], ecx
push 0x48f4b8
push 0x48f4a4
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x48de31
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x48df27
push 0x48f4a0
push 0x48f498
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x49993c], 2
jmp 0x48de53
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0048e356
pop ecx
call fcn.0048e457
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x48de83
push esi
call fcn.0048e2cc
pop ecx
test al, al
je 0x48de83
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.0048e69b
call esi
call fcn.0048e45d
mov esi, eax
cmp dword [esi], edi
je 0x48dea1
push esi
call fcn.0048e2cc
pop ecx
test al, al
je 0x48dea1
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
call fcn.0048e579
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_narrow_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.0048e5ac
test al, al
jne 0x48decc
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x48ded5
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.0048e373
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x48df27
call fcn.0048e6e6
ret
call fcn.0048dc76
jmp 0x48ddc5

Function at 0x401a80
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x409008], 0x8088405
inc edx
mov dword [ebx + 0x409008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x406480
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [0x409214]
mov dword [eax], ecx
mov ebx, edx
test ebx, ebx
jle 0x4064a1
mov eax, 0xff
call fcn.00401a80
xor byte [esi], al
inc esi
dec ebx
jne 0x406491
pop esi
pop ebx
ret

Function at 0x438c96
Capabilities:
Encode data using xor

Disassembly:
push 0x438a14
pop edi
and ebx, ebx
sub ebx, edx
call fcn.00438ccd
or ebx, edx
xor dword [ecx], edi
and edx, edx
inc ecx
sub ebx, 1
sub esp, 4
mov dword [esp], 0x3f15ac9
pop edx
cmp ecx, esi
jne fcn.00438c96
sub edx, ebx
ret