joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001f3c1
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1005d040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x100d3a0c]
lea eax, [ebp - 0x14]
push esi
push edi
push eax
push dword [0x1010a620]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
movd xmm1, eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [ebp - 0x20]
cvtdq2ps xmm0, xmm0
push eax
movss dword [ebx + 0x10], xmm1
movss dword [ebx + 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [ebp - 0x20]
mov ecx, edi
sub ecx, dword [0x1010a628]
mov esi, dword [ebp - 0x1c]
mov edx, esi
sbb edx, dword [0x1010a62c]
call fcn.10050420
mov edx, dword [0x1010a634]
mov ecx, dword [0x1010a630]
cvtsd2ss xmm0, xmm0
movss dword [ebp - 0x18], xmm0
call fcn.10050420
movss xmm1, dword [ebp - 0x18]
cvtsd2ss xmm0, xmm0
push 0x11
divss xmm1, xmm0
movss dword [ebx + 0x18], xmm1
mov dword [0x1010a62c], esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [0x1010a628], edi
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [ebx + 0xf1], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [ebx + 0xf2], al
call esi
shr eax, 0xf
and al, 1
mov byte [ebx + 0xf4], 0
mov byte [ebx + 0xf3], al
call fcn.1001f31a
cmp byte [ebx + 0xf0], 0
pop edi
pop esi
pop ebx
je 0x1001f4bb
or eax, 0xffffffff
jmp 0x1001f4c6
mov eax, dword [0x100d3a0c]
mov eax, dword [eax + 0x1cfc]
cmp dword [0x1005dc6c], eax
je 0x1001f4d8
mov dword [0x1005dc6c], eax
call fcn.1001f27e
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004c315
leave
ret

Function at 0x100209e4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x1010a67c], 0
push ebx
push esi
push edi
mov ebx, edx
mov edi, ecx
jne 0x10020a23
xor esi, esi
push 8
mov ecx, esi
pop edx
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor ecx, eax
sub edx, 1
jne 0x100209fe
mov dword [esi*4 + 0x1010a678], ecx
inc esi
cmp esi, 0x100
jb 0x100209f9
mov esi, dword [ebp + 8]
not esi
mov edx, esi
test ebx, ebx
jle 0x10020a68
movzx eax, byte [edi]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x1010a678]
inc edi
sub ebx, 1
jne 0x10020a2e
jmp 0x10020a6f
cmp al, 0x23
jne 0x10020a56
cmp byte [edi], al
jne 0x10020a56
cmp byte [edi + 1], al
cmove edx, esi
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x1010a678]
mov al, byte [edi]
inc edi
test al, al
jne 0x10020a48
pop edi
not edx
pop esi
mov eax, edx
pop ebx
pop ebp
ret
Function at 0x10021269
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10021278
and dword [edi], 0
mov edx, 0x10057ff8
call fcn.100211d7
mov esi, eax
test esi, esi
je 0x10021316
push ebx
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x1002130b
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebx, eax
pop ecx
cmp ebx, 0xffffffff
je 0x1002130b
push 0
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x1002130b
mov ecx, ebx
call fcn.10022994
mov dword [ebp + 8], eax
test eax, eax
je 0x1002130b
push esi
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, ebx
je 0x100212f9
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
push dword [ebp + 8]
dec dword [0x1010a624]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x10021312
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
pop ecx
test edi, edi
je 0x10021306
mov dword [edi], ebx
mov eax, dword [ebp + 8]
jmp 0x10021315
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
pop ecx
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x10025a08
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x100d3a0c]
push esi
mov esi, ecx
and dword [eax + 0x2c8c], 0
test esi, esi
je 0x10025a58
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
push edi
call fcn.10025a5b
mov edx, 0x10057ffc
mov ecx, esi
mov edi, eax
call fcn.100211d7
mov esi, eax
test esi, esi
je 0x10025a57
push esi
push dword [ebp - 4]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop edi
pop esi
leave
ret
Function at 0x1002c87d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
mov edi, dword [0x100d3a0c]
mov eax, dword [edi + 0x1a20]
mov byte [eax + 0x78], 1
mov eax, dword [edi + 0x1a20]
cmp byte [eax + 0x7b], 0
jne 0x1002c8c3
push edx
lea esi, [edi + 0x2ec4]
mov edx, 0xc01
push ecx
mov ecx, esi
call fcn.100209b6
pop ecx
pop ecx
lea edx, [edi + 0x2ec4]
mov ecx, esi
lea edx, [edx + eax]
pop edi
pop esi
jmp fcn.1002c903
pop edi
pop esi
ret
Function at 0x1003db39
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30
mov eax, dword [0x1005d040]
xor eax, esp
mov dword [esp + 0x2c], eax
movaps xmm0, xmmword [0x10059230]
xor edx, edx
movups xmmword [esp], xmm0
mov dword [esp + 0x20], 0x848cafac
movaps xmm0, xmmword [0x10059390]
movups xmmword [esp + 0x10], xmm0
mov dword [esp + 0x24], 0x9785a7c2
mov dword [esp + 0x28], 0x100e78d
mov al, dl
sub al, 0x42
xor byte [esp + edx], al
inc edx
cmp edx, 0x2a
jb 0x1003db7e
push ecx
lea eax, [esp + 4]
mov byte [esp + 0x2f], 0
push eax
mov edx, 0x1010aa84
call fcn.10033cad
pop ecx
pop ecx
test al, al
je 0x1003dbeb
mov eax, dword [0x1010aa84]
sub eax, 0
je 0x1003dbe0
sub eax, 1
je 0x1003dbd9
sub eax, 1
je 0x1003dbd2
sub eax, 1
je 0x1003dbcb
sub eax, 1
jne 0x1003dbe7
call fcn.10046b87
jmp 0x1003dbe7
call fcn.100471f1
jmp 0x1003dbe7
call fcn.10045fff
jmp 0x1003dbe7
call fcn.1004667b
jmp 0x1003dbe7
xor ecx, ecx
call fcn.10045686
mov al, 1
jmp 0x1003dbed
xor al, al
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.1004c315
mov esp, ebp
pop ebp
ret
Function at 0x100405aa
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x34], 0
je 0x100405c7
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x42]
xor byte [ecx], al
inc edx
cmp edx, 0x33
jb 0x100405b5
mov byte [esi + 0x34], 0
pop esi
ret

Function at 0x100405c9
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x24], 0
je 0x100405e6
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x42]
xor byte [ecx], al
inc edx
cmp edx, 0x23
jb 0x100405d4
mov byte [esi + 0x24], 0
pop esi
ret

Function at 0x100405e8
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1a5], 0
je 0x1004060e
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x42]
xor byte [ecx], al
inc edx
cmp edx, 0x1a4
jb 0x100405f6
mov byte [esi + 0x1a5], 0
pop esi
ret

Function at 0x10040610
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2c], 0
je 0x1004062d
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x42]
xor byte [ecx], al
inc edx
cmp edx, 0x2b
jb 0x1004061b
mov byte [esi + 0x2c], 0
pop esi
ret

Function at 0x1004062f
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x22], 0
je 0x1004064c
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x42]
xor byte [ecx], al
inc edx
cmp edx, 0x21
jb 0x1004063a
mov byte [esi + 0x22], 0
pop esi
ret

Function at 0x1004064e
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x5f], 0
je 0x1004066b
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x42]
xor byte [ecx], al
inc edx
cmp edx, 0x5e
jb 0x10040659
mov byte [esi + 0x5f], 0
pop esi
ret

Function at 0x1004066d
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x3c], 0
je 0x1004068a
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x42]
xor byte [ecx], al
inc edx
cmp edx, 0x3b
jb 0x10040678
mov byte [esi + 0x3c], 0
pop esi
ret

Function at 0x1004068c
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x68], 0
je 0x100406a9
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x42]
xor byte [ecx], al
inc edx
cmp edx, 0x67
jb 0x10040697
mov byte [esi + 0x68], 0
pop esi
ret

Function at 0x100406ab
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x41], 0
je 0x100406c8
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x42]
xor byte [ecx], al
inc edx
cmp edx, 0x40
jb 0x100406b6
mov byte [esi + 0x41], 0
pop esi
ret

Function at 0x100406ca
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x8b], 0
je 0x100406f0
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x42]
xor byte [ecx], al
inc edx
cmp edx, 0x8a
jb 0x100406d8
mov byte [esi + 0x8b], 0
pop esi
ret

Function at 0x100406f2
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2b], 0
je 0x1004070f
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x42]
xor byte [ecx], al
inc edx
cmp edx, 0x2a
jb 0x100406fd
mov byte [esi + 0x2b], 0
pop esi
ret
Function at 0x10040711
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1e], 0
je 0x1004072e
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x42]
xor byte [ecx], al
inc edx
cmp edx, 0x1d
jb 0x1004071c
mov byte [esi + 0x1e], 0
pop esi
ret
Function at 0x1004d3d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.1004d580
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1004d49d
mov edx, dword [ebp - 4]
cmp edx, dword [0x1005d090]
jb 0x1004d41a
mov eax, dword [ebp - 4]
cmp eax, dword [0x1005d094]
ja 0x1004d41a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1004d3ea
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1004d440
jmp 0x1004d49d
cmp dword [ebp - 0x14], 0x10000
jne 0x1004d483
cmp dword [ebp - 0x18], 0x10000
jb 0x1004d483
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1004d476
mov eax, dword [ebp - 8]
jmp 0x1004d49f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1004d498
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.1004d580
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1004d3ea
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1004d4b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.1004d5b0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1004d575
mov edx, dword [ebp - 4]
cmp edx, dword [0x1005d090]
jb 0x1004d4f5
mov eax, dword [ebp - 4]
cmp eax, dword [0x1005d094]
ja 0x1004d4f5
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1004d4c5
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1004d51b
jmp 0x1004d575
cmp dword [ebp - 0x14], 0x10000
jne 0x1004d55e
cmp dword [ebp - 0x18], 0x10000
jb 0x1004d55e
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1004d551
mov eax, dword [ebp - 8]
jmp 0x1004d577
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1004d570
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.1004d5b0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1004d4c5
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x421e0c
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
lea ebp, [esp - 0x1e0]
sub esp, 0x260
mov eax, dword [0x44f9f8]
xor eax, ebp
mov dword [ebp + 0x1dc], eax
push ebx
push esi
mov esi, dword [ebp + 0x1ec]
xor ebx, ebx
push 0x250
lea eax, [ebp - 0x74]
push ebx
push eax
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
call fcn.00408720
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
push 0x4030b4
push dword [ebp + 0x1e8]
call main
test eax, eax
js 0x421e70
push 7
push dword [ebp - 0x78]
call fcn.0043582a
cmp dword [ebp + 0x1e8], ebx
jne 0x421f2e
push edi
lea edi, [ebp - 0x78]
mov ecx, esi
call main
pop edi
test eax, eax
js 0x421f2e
lea eax, [ebp - 0x80]
push eax
push 0x446a88
push dword [ebp - 0x78]
call main
test eax, eax
js 0x421f2e
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.kernel32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x421f2e
test byte [ebp - 0x74], 0x10
jne 0x421f18
xor eax, eax
mov word [ebp + 0x1be], ax
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.kernel32.dll_lstrlenW]
cmp eax, 2
jbe 0x421efc
push 0x2e
add eax, eax
pop ecx
cmp cx, word [ebp + eax - 0x4c]
jne 0x421efc
movzx eax, word [ebp + eax - 0x4a]
push 0x52
pop ecx
cmp cx, ax
je 0x421f18
push 0x72
pop ecx
cmp cx, ax
je 0x421f18
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x78]
call main
test eax, eax
js 0x421f18
push dword [ebp - 0x7c]
call main
lea eax, [ebp - 0x74]
push eax
push esi
call dword [sym.imp.kernel32.dll_FindNextFileW]
test eax, eax
jne 0x421ebd
push esi
call dword [sym.imp.kernel32.dll_FindClose]
cmp dword [ebp - 0x7c], ebx
je 0x421f3b
push dword [ebp - 0x7c]
call fcn.0042ead8
cmp dword [ebp - 0x80], ebx
je 0x421f48
push dword [ebp - 0x80]
call fcn.0042ead8
cmp dword [ebp - 0x78], ebx
pop esi
pop ebx
je 0x421f57
push dword [ebp - 0x78]
call fcn.0042ead8
mov ecx, dword [ebp + 0x1dc]
xor ecx, ebp
call fcn.00408498
add ebp, 0x1e0
leave
ret 8

Function at 0x424980
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x42498f
pop dword [ebp - 0xc]
mov eax, 0x42498f
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x40454
push 0
mov eax, 0xb3c59435
add eax, 0x4c7a7e03
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0x4a50
xor edi, edi
add edi, eax
mov edx, 0x83f878d
sub edx, 0x7f9c58d
add edx, dword [ebp - 0xc]
mov esi, 0x41d71ad4
xor dword [ebp - 8], ecx
mov ebx, dword [edx]
xor dword [ebp - 8], eax
add ebx, esi
sub dword [ebp - 8], eax
mov dword [edi], ebx
add dword [ebp - 8], 0x9fe50fe4
add edi, 0xb48e9ceb
sub edi, 0xb48e9ce7
add edx, 4
loop 0x4249df
add eax, 0x11c13
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x43356d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x456818
cmp edx, dword [eax]
je 0x43358f
add eax, 8
inc ecx
cmp eax, str.__t__r_
jl 0x433580
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x456818]
jne 0x4336bd
mov eax, dword [0x45a98c]
cmp eax, 1
je 0x433697
test eax, eax
jne 0x4335c0
cmp dword [0x456664], 1
je 0x433697
cmp edx, 0xfc
je 0x4336bd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4335f7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00436ca0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00432b70
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x43363a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00432b70
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4478ac
push edi
call fcn.0042ff00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00436ca0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00436cb0
lea eax, [ebp - 0xa0]
push 0x440af4
push eax
call fcn.00436cb0
push dword [esi + 0x45681c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00436cb0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00437b56
add esp, 0x2c
pop edi
jmp 0x4336bd
lea eax, [ebp + 8]
lea esi, [esi + 0x45681c]
push 0
push eax
push dword [esi]
call fcn.00432b70
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x436c59
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x436c79
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0043641b
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x436c9a
test byte [esp + 8], 2
je 0x436c9a
mov dword [0x45a938], 0xd
mov dword [0x45a93c], 5
jmp 0x436c75
xor eax, eax
ret

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
mov ecx, 0x7e8d679e
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..text_1
nop
mov ebx, 0x42f314
nop
mov ecx, 0x213034d
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x4048c8
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00406d50
test esi, esi
jne 0x4048fe
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00406ed8
jmp 0x40491c
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.0040480c
mov edi, eax
test esi, esi
je 0x40491c
cmp dword [ebx], 0
je 0x40491c
dec esi
jmp 0x404905
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x40596c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00405d64
mov byte [esp], al
cmp byte [esp], 0
jne 0x405af8
test edi, edi
je 0x405af8
mov byte [esp + 1], 0
test ebp, ebp
jle 0x405a2f
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
test ebp, ebp
jle 0x405a0a
cmp edi, 0xffffffff
je 0x4059cb
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4059cb
mov byte [esp], 0
jmp 0x405af8
mov ebx, dword [esi]
cmp ebx, 1
jg 0x405a0a
test ebx, ebx
jne 0x405a00
mov eax, esi
xor ecx, ecx
mov edx, 1
call fcn.004027cc
test eax, eax
jne 0x405a00
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x405af8
call 0x405e88
dec ebp
test ebp, ebp
jg 0x4059b0
cmp edi, 0xffffffff
je 0x405a2f
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x405a2d
mov byte [esp], 0
jmp 0x405af8
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x40597a
lea edx, [ebx + 2]
mov eax, esi
mov ecx, ebx
call fcn.004027cc
cmp ebx, eax
jne 0x405a2f
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00405b68
mov edx, eax
mov ebx, dword [0x5228f8]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x405a96
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x405a94
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x405a96
xor edi, edi
cmp byte [esp], 0
je 0x405abf
mov ebx, dword [esi]
test bl, 1
jne 0x405ad8
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, esi
mov ecx, ebx
call fcn.004027cc
cmp ebx, eax
jne 0x405a9c
mov byte [esp + 1], 1
jmp 0x405ad8
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, esi
mov ecx, ebx
call fcn.004027cc
cmp ebx, eax
jne 0x405abf
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x405a49
cmp byte [esp], 0
je 0x405af8
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x406750
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push esi
push edi
mov ebx, 0x524b18
cmp dword [ebp + 0xc], 2
jl 0x406764
mov ebx, 0x524b48
mov esi, ebx
lea edi, [ebp - 0x40]
mov ecx, 0xc
rep movsd dword es:[edi], dword [esi]
pop dword [ebx + 0x20]
pop dword [ebx + 0x1c]
pop dword [ebx + 0x18]
mov dword [ebx + 0x14], ebp
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], edx
lea ecx, [ebp - 0x40]
mov dword [ebx], ecx
call sub.kernel32.dll_GetCurrentThreadId
mov dword [ebx + 0x2c], eax
mov eax, dword [ebx + 8]
xor ecx, ecx
cmp dword [ebp + 0xc], 0
jne 0x40679c
mov ecx, dword [eax]
mov dword [ebx + 0xc], ecx
mov eax, 0x402870
mov dword [0x522018], eax
mov eax, 0x402878
mov dword [0x52201c], eax
mov eax, ebx
call fcn.00406634
mov eax, dword [ebp + 0xc]
inc eax
mov byte [ebx + 0x28], al
dec eax
pop ecx
mov edx, dword [ecx]
mov dword [ebx + 0x24], edx
je 0x4067d1
cmp al, 3
jge 0x4067d1
call dword [ecx + eax*4]
push ecx
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x4067e2
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
call ecx
pop ecx
mov eax, dword [ebp + 0xc]
cmp al, 3
jl 0x4067ed
call dword [ecx + eax*4]
cmp dword [0x52203c], 0
jne 0x406803
mov byte [0x522044], 1
fnstcw word [0x51d028]
mov eax, dword [ebp + 0xc]
dec eax
jne fcn.00406a80
call fcn.004066e4
ret 4

Function at 0x4069e8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x522058], 0
je 0x406a4f
cmp word [0x522344], 0xd7b2
jne 0x406a11
cmp dword [0x52234c], 0
jbe 0x406a11
mov eax, 0x522340
call dword [0x52235c]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x406a7c
call fcn.004075b8
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x51d032], 0
jne 0x406a6b
push 0
push 0x51d9c2
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x406c0c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x51d034], 0
je 0x406c37
mov edx, edi
mov eax, esi
call dword [0x51d034]
mov ebx, eax
jmp 0x406c48
mov eax, 8
call fcn.00404548
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x522059], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x406bd4
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x406c7d
mov edx, 8
mov eax, ebx
call fcn.00404564
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc