joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c08d0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
mov edi, dword [esp + 0x38]
movzx ebp, ax
shr eax, 0x10
mov dword [esp + 0xc], eax
test ebx, ebx
je 0x100c0ace
test edi, edi
je 0x100c0a88
mov eax, 0x5e6ea9af
mul edi
mov ecx, edx
shr ecx, 0xb
imul eax, ecx, 0x15b0
mov ecx, edi
sub ecx, eax
cmp ecx, 7
jbe 0x100c0a99
lea esi, [esi]
mov eax, ecx
lea edx, [ecx - 8]
mov dword [esp + 0x14], ecx
mov esi, ebx
and eax, 0xfffffff8
mov dword [esp + 0x18], edx
add eax, ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x38], edi
movzx eax, byte [esi]
movzx edx, byte [esi + 2]
add esi, 8
movzx ecx, byte [esi - 3]
add eax, ebp
movzx ebp, byte [esi - 1]
mov edi, eax
movzx eax, byte [esi - 7]
mov dword [esp], edi
add eax, edi
movzx edi, byte [esi - 5]
lea ebx, [edx + eax]
movzx edx, byte [esi - 2]
add edi, ebx
mov dword [esp + 4], ebx
movzx ebx, byte [esi - 4]
mov dword [esp + 8], edi
add ebx, edi
mov edi, dword [esp]
add ecx, ebx
add eax, edi
mov edi, dword [esp + 4]
add edx, ecx
add ebp, edx
add eax, edi
mov edi, dword [esp + 8]
add eax, edi
add eax, ebx
add eax, ecx
add eax, edx
add eax, ebp
add dword [esp + 0xc], eax
mov eax, dword [esp + 0x10]
cmp esi, eax
jne 0x100c0940
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x34]
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x38]
and edx, 0xfffffff8
lea eax, [edx + 8]
lea ebx, [ebx + edx + 8]
cmp eax, ecx
jae 0x100c0a4d
movzx edx, byte [ebx]
add ebp, edx
lea edx, [eax + 1]
add dword [esp + 0xc], ebp
mov esi, dword [esp + 0xc]
cmp edx, ecx
jae 0x100c0a46
movzx edx, byte [ebx + 1]
add ebp, edx
lea edx, [eax + 2]
add esi, ebp
mov dword [esp + 0xc], esi
cmp edx, ecx
jae 0x100c0a46
movzx edx, byte [ebx + 2]
add ebp, edx
lea edx, [eax + 3]
add esi, ebp
mov dword [esp + 0xc], esi
cmp edx, ecx
jae 0x100c0a46
movzx edx, byte [ebx + 3]
add ebp, edx
lea edx, [eax + 4]
add esi, ebp
mov dword [esp + 0xc], esi
cmp edx, ecx
jae 0x100c0a46
movzx edx, byte [ebx + 4]
add ebp, edx
lea edx, [eax + 5]
add esi, ebp
mov dword [esp + 0xc], esi
cmp edx, ecx
jae 0x100c0a46
movzx edx, byte [ebx + 5]
add ebp, edx
lea edx, [eax + 6]
add esi, ebp
mov dword [esp + 0xc], esi
cmp edx, ecx
jae 0x100c0a46
movzx edx, byte [ebx + 6]
add ebp, edx
add esi, ebp
mov dword [esp + 0xc], esi
mov edx, ebx
sub edx, eax
lea ebx, [edx + ecx]
mov esi, 0x80078071
mov eax, ebp
mul esi
mov eax, dword [esp + 0xc]
shr edx, 0xf
imul edx, edx, 0xfff1
sub ebp, edx
mul esi
mov esi, edx
shr esi, 0xf
imul esi, esi, 0xfff1
sub dword [esp + 0xc], esi
sub edi, ecx
je 0x100c0a88
mov ecx, 0x15b0
jmp 0x100c0920
mov eax, dword [esp + 0xc]
add esp, 0x1c
pop ebx
pop esi
shl eax, 0x10
pop edi
add eax, ebp
pop ebp
ret
xor eax, eax
test ecx, ecx
jne 0x100c09c7
mov eax, ebp
mov ecx, 0x80078071
mul ecx
mov eax, edx
shr eax, 0xf
imul eax, eax, 0xfff1
sub ebp, eax
mov eax, dword [esp + 0xc]
mul ecx
shr edx, 0xf
imul eax, edx, 0xfff1
sub dword [esp + 0xc], eax
jmp 0x100c0a7a
add esp, 0x1c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x100c0ae0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
push edi
push esi
push ebx
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x1c], 3
mov esi, dword [esp + 0x18]
not eax
jbe 0x100c0b74
mov edi, dword [esp + 0x1c]
sub edi, 4
mov edx, edi
shr edx, 2
lea ecx, [esi + edx*4 + 4]
mov edx, esi
lea esi, cs:[esi]
nop
mov ebp, eax
xor al, byte [edx]
movzx ebx, byte [edx + 1]
add edx, 4
movzx eax, al
shr ebp, 8
xor ebp, dword [eax*4 + 0x10146140]
mov eax, ebp
xor ebp, ebx
mov ebx, ebp
shr eax, 8
movzx ebp, bl
movzx ebx, byte [edx - 1]
xor eax, dword [ebp*4 + 0x10146140]
mov ebp, eax
xor al, byte [edx - 2]
movzx eax, al
shr ebp, 8
xor ebp, dword [eax*4 + 0x10146140]
mov eax, ebp
xor ebp, ebx
mov ebx, ebp
shr eax, 8
movzx ebp, bl
xor eax, dword [ebp*4 + 0x10146140]
cmp edx, ecx
jne 0x100c0b10
and dword [esp + 0x1c], 3
and edi, 0xfffffffc
lea esi, [esi + edi + 4]
mov edx, dword [esp + 0x1c]
test edx, edx
je 0x100c0bc1
mov edx, eax
xor al, byte [esi]
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0x10146140]
cmp dword [esp + 0x1c], 1
mov eax, edx
je 0x100c0bc1
xor al, byte [esi + 1]
shr edx, 8
movzx eax, al
xor edx, dword [eax*4 + 0x10146140]
cmp dword [esp + 0x1c], 2
mov eax, edx
je 0x100c0bc1
xor al, byte [esi + 2]
shr edx, 8
movzx eax, al
xor edx, dword [eax*4 + 0x10146140]
mov eax, edx
pop ebx
not eax
pop esi
pop edi
pop ebp
ret
Function at 0x403076
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
xor ebp, ebp
push edi
mov dword [esp + 0x10], ebp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [0x41710c]
mov edi, eax
sub esi, dword [0x40b03c]
add edi, 0x1f4
add esi, dword [esp + 0x1c]
cmp esi, ebp
jle 0x40324c
push dword [0x41f11c]
call fcn.00403289
push ebp
push ebp
push dword [0x40b03c]
push dword [0x409024]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x41f118], esi
mov dword [0x417108], ebp
mov eax, dword [0x417110]
mov ebx, 0x4000
sub eax, dword [0x41f11c]
cmp eax, ebx
jg 0x4030e9
mov ebx, eax
mov esi, 0x4130c8
push ebx
push esi
call fcn.00403257
test eax, eax
je 0x403217
add dword [0x41f11c], ebx
mov dword [0x40b058], esi
mov dword [0x40b05c], ebx
cmp dword [0x424768], ebp
je 0x40317a
cmp dword [0x424800], ebp
jne 0x40317a
cmp dword [esp + 0x10], ebp
je 0x403147
mov eax, dword [0x41f118]
push ebp
sub eax, dword [0x41710c]
sub eax, dword [esp + 0x20]
add eax, dword [0x40b03c]
mov dword [0x417108], eax
call fcn.00405ea3
jmp 0x40317a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, edi
jbe 0x40317a
mov eax, dword [0x424764]
neg eax
sbb eax, eax
not eax
and eax, 0x4091ec
push eax
push 0x402ba6
push ebp
push 0x6f
push dword [0x424760]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [esp + 0x10], eax
mov ecx, 0x40b040
mov dword [0x40b060], 0x40b0c8
mov dword [0x40b064], 0x8000
call fcn.00405f64
test eax, eax
jl 0x403220
mov esi, dword [0x40b060]
mov eax, 0x40b0c8
sub esi, eax
je 0x4031e1
lea ecx, [esp + 0x14]
push ebp
push ecx
push esi
push eax
push dword [0x409024]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40321c
cmp esi, dword [esp + 0x14]
jne 0x40321c
add dword [0x40b03c], esi
cmp dword [0x40b05c], ebp
jne 0x40310f
jmp 0x4031ed
cmp dword [0x40b05c], ebp
jne 0x403220
cmp ebx, ebp
je 0x403220
mov eax, dword [0x41710c]
mov ecx, eax
sub ecx, dword [0x40b03c]
add ecx, dword [esp + 0x1c]
test ecx, ecx
jg 0x4030d3
push ebp
push ebp
push eax
push dword [0x409024]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x403225
or eax, 0xffffffff
jmp 0x40324e
push 0xfffffffffffffffe
jmp 0x403222
push 0xfffffffffffffffd
pop eax
jmp 0x40324e
mov esi, dword [esp + 0x10]
cmp esi, ebp
je 0x40324c
mov eax, dword [0x41f118]
push ebp
push ebp
push 0x113
push esi
mov dword [0x417108], eax
call dword [sym.imp.USER32.dll_SendMessageA]
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 4
Function at 0x543e30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd5000]
push edi
jmp 0x543e4a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x543e51
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x543e40
mov eax, 1
add ebx, ebx
jne 0x543e63
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x543e74
jne 0x543e93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x543e93
dec eax
add ebx, ebx
jne 0x543e80
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x543e58
add ebx, ebx
jne 0x543e8f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x543ee5
xor ecx, ecx
sub eax, 3
jb 0x543eab
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x543f1a
sar eax, 1
mov ebp, eax
jmp 0x543eb6
add ebx, ebx
jne 0x543eb6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x543e84
inc ecx
add ebx, ebx
jne 0x543ec4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x543e84
add ebx, ebx
jne 0x543ed1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x543ec6
jne 0x543ee2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x543ec6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x543f04
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x543ef6
jmp 0x543e46
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x543f04
add edi, ecx
jmp 0x543e46
pop esi
mov edi, esi
mov ecx, 0x997f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x543f22
cmp byte [edi], 0x2f
jne 0x543f22
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x543f27
lea edi, [esi + 0x13f000]
mov eax, dword [edi]
or eax, eax
je 0x543f9f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x156524]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x15668c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x543f54
mov ecx, edi
jns 0x543f83
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x156690]
or eax, eax
je 0x543f99
mov dword [ebx], eax
add ebx, 4
jmp 0x543f71
call dword [esi + 0x1566a0]
mov ebp, dword [esi + 0x156694]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x543fd3
sub esp, 0xffffff80
jmp 0x4b20a6
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x1451008], 0x8088405
inc edx
mov dword [ebx + 0x1451008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cc40
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cc71
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cc59
add dl, dl
jne 0x41cc7c
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cccd
xor eax, eax
add dl, dl
jne 0x41cc89
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cd6a
add dl, dl
jne 0x41cc98
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cca3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41ccae
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41ccb9
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41ccc3
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cc68
mov eax, 1
add dl, dl
jne 0x41ccdb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cce6
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41ccd2
sub eax, ebx
mov ebx, 1
jne 0x41cd19
mov ecx, 1
add dl, dl
jne 0x41ccff
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cd0a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41ccf6
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cc68
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cd30
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cd3b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cd27
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cc68
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41cd8b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cc68
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41e214
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x143a6d3
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41e2c5
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x41e2ae
test esi, esi
jbe 0x41e2c5
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088dc
test eax, eax
jne 0x41e2a0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41e2c5
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41e27d
jmp 0x41e2c5
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x41e2c5
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x143a6da
ret
Function at 0x41eb1c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x143b0cb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x41eb57
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x41eb70
lea eax, [ebp - 0x10]
mov edx, dword [0x1453258]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x41eb83
lea eax, [ebp - 0x10]
mov edx, dword [0x1453258]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x41eb8f
adc edx, 0
mov edx, dword [edx*4 + 0x14520e8]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x41ec9d
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406d6c
test eax, eax
je 0x41ec90
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x41ec90
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406dcc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406d6c
test eax, eax
je 0x41ec90
mov eax, edi
cmp dword [eax], 0x4550
jne 0x41ec90
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x41ec90
cmp dx, 0x150
ja 0x41ec90
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406d6c
test eax, eax
je 0x41ec90
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x41ec90
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x41ecb5
inc ebx
cmp ebx, 0x19
jne 0x41eb49
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x143b0d2
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x401e58
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x402360
call fcn.004021b4
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov edi, dword [eax + 4]
mov esi, ebx
push ebx
push edi
push 0x40341c
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x401ccd
cmp eax, edi
jne 0x401cc0
xor edi, edi
inc edi
mov esi, edi
jmp 0x401cd0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401ca4
xor edi, edi
inc edi
cmp dword [0x403420], edi
jne 0x401ce2
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x401d10
cmp dword [0x403420], ebx
jne 0x401d0a
mov dword [0x403420], edi
push 0x401018
push 0x40100c
call fcn.00401c44
pop ecx
pop ecx
test eax, eax
je 0x401d10
jmp 0x401e41
mov dword [0x40301c], edi
cmp dword [0x403420], edi
jne 0x401d33
push 0x401008
push section..text
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x403420], 2
test esi, esi
jne 0x401d43
push ebx
push 0x40341c
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x403424], 0
je 0x401d65
push 0x403424
call fcn.00402020
pop ecx
test eax, eax
je 0x401d65
push ebx
push 2
push ebx
call dword [0x403424]
mov ecx, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [ecx], ebx
je 0x401e41
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push 0x20
pop esi
mov edx, dword [ebp - 0x1c]
movzx eax, word [ecx]
cmp ax, si
ja 0x401dd5
test ax, ax
je 0x401d8f
test edx, edx
jne 0x401dd5
movzx eax, word [ecx]
test ax, ax
je 0x401da4
cmp ax, si
ja 0x401da4
add ecx, 2
mov dword [ebp - 0x20], ecx
jmp 0x401d8f
test byte [ebp - 0x3c], 1
je 0x401db0
movzx eax, word [ebp - 0x38]
jmp 0x401db3
push 0xa
pop eax
push eax
push ecx
push ebx
push 0x400000
call main
mov dword [0x403018], eax
cmp dword [0x403030], 0
jne 0x401e1d
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp eax, 0x22
jne 0x401de6
xor eax, eax
test edx, edx
sete al
mov edx, eax
mov dword [ebp - 0x1c], edx
add ecx, 2
mov dword [ebp - 0x20], ecx
jmp 0x401d7e
cmp dword [0x40301c], 0
jne 0x401e31
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x403018]
mov dword [ebp - 4], 0xfffffffe
jmp 0x401e4d
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.004021f9
ret
call fcn.004020e1
jmp 0x401c6d

Function at 0x401f90
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x401fa6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x401fc1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
Function at 0x401fd0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
movzx ebx, word [ecx + 6]
add eax, 0x18
push esi
xor edx, edx
add eax, ecx
push edi
test ebx, ebx
je 0x40200e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x402006
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x402010
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x401ff6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x401000
Capabilities:
Encode data using xor
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
push edi
push 0x103
lea eax, [ebp - 0x113]
push 0
push eax
mov byte [ebp - 0x114], 0
call sub.ntdll.dll_memset
xor eax, eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
add esp, 0xc
mov eax, 0x1c
mov byte [ebp - 0x10], 0
call sub.ntdll.dll__alloca_probe
mov edx, esp
test edx, edx
je 0x4010c1
mov esi, 0x409d9c
mov eax, edx
sub esi, edx
mov edi, 0x1b
lea esp, [esp]
mov cl, byte [esi + eax]
xor cl, 0x88
mov byte [eax], cl
inc eax
dec edi
jne 0x401060
mov byte [edx + 0x1b], 0
xor eax, eax
cmp byte [eax + edx], 0x5c
jne 0x4010bb
mov cl, byte [eax + edx + 1]
lea edi, [eax + edx + 1]
cmp cl, 0x5c
je 0x4010ae
cmp cl, 0x72
jne 0x401090
mov byte [eax + edx], 0xd
jmp 0x4010ae
cmp cl, 0x6e
jne 0x40109b
mov byte [eax + edx], 0xa
jmp 0x4010ae
cmp cl, 0x74
jne 0x4010a6
mov byte [eax + edx], 9
jmp 0x4010ae
cmp cl, 0x22
jne 0x4010bb
mov byte [eax + edx], cl
mov ecx, 0x1b
sub ecx, eax
lea esi, [eax + edx + 2]
rep movsb byte es:[edi], byte [esi]
inc eax
cmp eax, 0x1b
jb 0x401072
push 0x104
lea eax, [ebp - 0x114]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x40114d
lea eax, [ebp - 0x114]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4010e1
push 0x8003
lea ecx, [ebp - 0x10]
sub eax, edx
push ecx
push eax
lea edx, [ebp - 0x114]
push edx
call fcn.00402504
test eax, eax
je 0x40114d
push 8
lea eax, [ebp - 0x114]
lea edi, [ebp - 0x10]
call fcn.004025d9
lea eax, [ebp - 0x114]
push eax
mov esi, 1
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
test ax, ax
jne 0x40113f
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
test ax, ax
je 0x40113f
xor esi, esi
mov eax, esi
lea esp, [ebp - 0x11c]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 1
lea esp, [ebp - 0x11c]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401550
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
xor ebx, ebx
call fcn.004038dd
test eax, eax
je 0x40166a
push str.AP32
call fcn.00403d70
add esp, 4
mov dword [0x420698], eax
cmp eax, 0xffffffff
je 0x40166a
push esi
mov esi, eax
cmp dword [0x420b78], ebx
jne 0x40159b
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x420660], eax
mov dword [0x420b78], 1
push edi
xor edi, edi
test esi, esi
je 0x4015ca
mov ecx, dword [0x420660]
lea eax, [esi + 0xc]
push eax
push 8
push ecx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4015ca
mov ecx, 0xabbabaab
mov dword [eax], esi
mov dword [eax + 4], ecx
mov dword [eax + esi + 8], ecx
lea edi, [eax + 8]
mov dword [0x420694], edi
test edi, edi
je 0x40166e
mov edx, dword [0x420698]
push edx
push edi
push 0x16469
push str.AP32
call fcn.00403cf0
mov ecx, dword [0x420698]
add esp, 0x10
cmp eax, ecx
jne 0x40166e
mov eax, dword [0x420694]
test eax, eax
je 0x401661
test ecx, ecx
je 0x401661
mov esi, dword [eax + 0x3c]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esi, eax
mov edi, eax
rdtsc
xor dword [section..data], eax
mov dword [esi + 0x58], ecx
call ebx
mov ecx, dword [section..data]
xor ecx, eax
mov eax, 0x80008001
mul ecx
shr edx, 0xf
add edx, ecx
mov word [edi], dx
rdtsc
xor ecx, eax
mov dword [section..data], ecx
call ebx
mov ecx, dword [section..data]
xor ecx, eax
xor edx, edx
or edi, 0xffffffff
mov eax, ecx
div edi
mov dword [section..data], ecx
add eax, ecx
mov dword [esi], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret
mov eax, ebx
pop ebx
ret
pop edi
pop esi
mov eax, ebx
pop ebx
ret