joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403ab0
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6c
push esi
push 0x40
xor esi, esi
lea eax, [esp + 0x34]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x30]
mov dword [esp + 0x60], eax
call fcn.004039c4
test eax, eax
jne 0x403b59
mov dword [esp + 8], esi
cmp word [0x4093a4], si
je 0x403b0d
mov ecx, 0x4093a4
call fcn.00402ae0
mov dword [esp + 8], eax
test eax, eax
jne 0x403b22
lea ecx, [esp + 8]
call fcn.00403e2f
test eax, eax
js 0x403b40
mov eax, dword [esp + 8]
test eax, eax
je 0x403b40
lea ecx, [esp + 0x30]
mov dword [esp + 0x5c], eax
call fcn.004034b5
test eax, eax
js 0x403b40
lea ecx, [esp + 0x30]
call fcn.0040367a
test eax, eax
jns 0x403b59
mov eax, dword [esp + 0x64]
jmp 0x403b55
cmp dword [eax + 0x10], esi
jne 0x403b52
mov dword [eax + 0x10], 0xf
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x403b46
call fcn.00404fd7
test eax, eax
js 0x403b6f
lea edx, [esp + 0x30]
lea ecx, [esp + 0xc]
call fcn.00405d88
mov eax, dword [0x409380]
test eax, eax
je 0x403b8d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [0x409380], esi
mov eax, dword [0x409384]
test eax, eax
je 0x403bab
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [0x409384], esi
mov eax, dword [0x409388]
test eax, eax
je 0x403bc9
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [0x409388], esi
mov eax, dword [esp + 0x64]
jmp 0x403bda
mov ecx, eax
call fcn.00402cb7
mov dword [esp + 0x64], eax
test eax, eax
jne 0x403bcf
mov eax, dword [0x40938c]
test eax, eax
je 0x403bee
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x403c3f
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x409004]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x238], 0
or eax, 0xffffffff
and dword [ebp - 0x234], 0
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x22c], eax
push 7
pop ecx
mov esi, 0x401584
mov dword [ebp - 0x23c], eax
cmp dword [ebx + 0x20], 2
lea edi, [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
mov eax, 0x401a00
je 0x403c93
mov eax, 0x401a20
push eax
push dword [ebx + 0x2c]
lea eax, [ebp - 0x228]
push 0x4015a0
push 0x104
push eax
call fcn.0040298d
mov esi, eax
add esp, 0x14
test esi, esi
js 0x403d64
push 0
push 0x80
push 3
push 0
push 3
push 0x80100000
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x403cf7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x403d60
movzx esi, si
or esi, 0x80070000
jmp 0x403d5e
lea eax, [ebp - 0x238]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x403ce0
mov ecx, dword [ebp - 0x238]
mov eax, ecx
mov edx, dword [ebp - 0x234]
or eax, edx
jne 0x403d22
mov esi, 0x800703ee
jmp 0x403d6a
lea eax, [ebp - 0x20]
mov dword [ebx + 0x18], ecx
push eax
xor eax, eax
mov dword [ebx + 0x1c], edx
push eax
push eax
push 2
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x22c], eax
test eax, eax
je 0x403ce0
cmp dword [ebx + 0x1c], 0
mov dword [ebx + 0x24], edi
mov dword [ebx + 0x28], eax
jne 0x403d58
mov eax, dword [ebx + 0x18]
cmp eax, dword [ebx + 0x30]
jb 0x403d5b
mov eax, dword [ebx + 0x30]
mov dword [ebx + 4], eax
test esi, esi
jns 0x403d77
jmp 0x403d6a
mov edi, dword [ebp - 0x23c]
mov ecx, dword [ebp - 0x22c]
mov edx, edi
call fcn.00403d88
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407be0
leave
ret
Function at 0x404ea5
Capabilities:
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x409004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 6
mov dword [ebp - 0x234], ecx
lea edi, [ebp - 0x20]
pop ecx
mov esi, 0x401788
lea eax, [ebp - 0x228]
rep movsd dword es:[edi], dword [esi]
xor ebx, ebx
movsw word es:[edi], word [esi]
mov esi, 0x208
push esi
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x230], ebx
lea eax, [ebp - 0x228]
mov word [ebp - 0x22e], si
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push ebx
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x250]
push eax
push ebx
call dword [sym.imp.ntdll.dll_RtlExpandEnvironmentStrings_U]
test eax, eax
jns 0x404f3b
mov ebx, eax
or ebx, 0x10000000
jmp 0x404fc6
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x240]
push eax
push ebx
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x404f72
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x404fc6
movzx ebx, bx
or ebx, 0x80070000
jmp 0x404fc6
mov ecx, dword [ebp - 0x240]
mov eax, dword [ebp - 0x23c]
mov edi, dword [ebp - 0x234]
mov esi, dword [0x4097dc]
shrd ecx, eax, 0x14
push ecx
push 0xc6d
push edi
mov ecx, esi
call dword [0x40a218]
call esi
mov ecx, dword [ebp - 0x248]
mov eax, dword [ebp - 0x244]
mov esi, dword [0x4097dc]
shrd ecx, eax, 0x14
push ecx
push 0xc6e
push edi
mov ecx, esi
call dword [0x40a218]
call esi
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407be0
leave
ret
Function at 0x4050ae
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x409004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x210]
mov dword [ebp - 0x218], ecx
xor ecx, ecx
push eax
push 0x20019
push ecx
push 0x4017f0
mov esi, ecx
mov dword [ebp - 0x214], ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov ebx, ecx
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x22c], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
je 0x40512d
jle 0x405296
movzx edi, di
or edi, 0x80070000
jmp 0x405296
xor ecx, ecx
lea eax, [ebp - 0x228]
push ecx
push ecx
push eax
push ecx
lea eax, [ebp - 0x220]
mov dword [ebp - 0x224], ecx
push eax
lea eax, [ebp - 0x20c]
push eax
push ecx
jmp 0x4051ca
test edi, edi
jne 0x405203
lea eax, [ebp - 0x21c]
push eax
lea edx, [ebp - 0x214]
lea ecx, [ebp - 0x20c]
call fcn.00402b51
test eax, eax
js 0x4051a2
cmp ebx, dword [ebp - 0x214]
jb 0x405186
jne 0x4051a2
cmp esi, dword [ebp - 0x21c]
jae 0x4051a2
mov esi, dword [ebp - 0x21c]
mov ebx, dword [ebp - 0x214]
mov dword [ebp - 0x22c], 1
mov dword [ebp - 0x230], esi
mov eax, dword [ebp - 0x224]
lea ecx, [ebp - 0x228]
inc eax
xor edx, edx
push edx
push edx
push ecx
push edx
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x224], eax
push ecx
lea ecx, [ebp - 0x20c]
push ecx
push eax
push dword [ebp - 0x210]
mov dword [ebp - 0x220], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
cmp edi, 0x103
jne 0x405150
xor edi, edi
cmp dword [ebp - 0x22c], 0
jne 0x405210
mov edi, 0x80070490
jmp 0x405296
jle 0x4051f0
movzx edi, di
or edi, 0x80070000
jmp 0x4051f0
mov esi, dword [0x4097dc]
mov eax, ebx
shr eax, 0x10
mov ecx, esi
push eax
push 0xc51
push dword [ebp - 0x218]
call dword [0x40a218]
call esi
mov esi, dword [0x4097dc]
mov ecx, esi
movzx eax, bx
push eax
push 0xc52
push dword [ebp - 0x218]
call dword [0x40a218]
call esi
mov ebx, dword [ebp - 0x230]
mov eax, ebx
mov esi, dword [0x4097dc]
mov ecx, esi
shr eax, 0x10
push eax
push 0xc53
push dword [ebp - 0x218]
call dword [0x40a218]
call esi
mov esi, dword [0x4097dc]
mov ecx, esi
movzx eax, bx
push eax
push 0xc54
push dword [ebp - 0x218]
call dword [0x40a218]
call esi
cmp dword [ebp - 0x210], 0
je 0x4052ab
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407be0
leave
ret
Function at 0x405e56
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov edi, edx
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x405e92
jg 0x405e87
mov esi, eax
jmp 0x405ee0
movzx esi, ax
or esi, 0x80070000
jmp 0x405ee0
push ebx
push 4
pop ebx
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
push esi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x405ed0
cmp dword [ebp - 0xc], ebx
jne 0x405ed2
cmp dword [ebp - 8], ebx
ja 0x405ed2
cmp dword [ebp - 8], 2
jae 0x405edf
test edi, edi
jg 0x405ed6
mov esi, edi
jmp 0x405edf
movzx esi, di
or esi, 0x80070000
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret 0xc

Function at 0x40675a
Capabilities:
Create directory
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x278
mov eax, dword [0x409004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x25c]
push ebx
push eax
mov edi, ecx
call sub.msvcrt.dll_memset
push 0x50
lea eax, [ebp - 0x54]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
lea eax, [ebp - 0x25c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x40681c
lea eax, [ebp - 0x278]
push eax
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateGuid]
mov esi, eax
test esi, esi
js 0x406831
push 0x28
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x278]
push eax
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_StringFromGUID2]
lea eax, [ebp - 0x25c]
mov dword [ebp - 0x268], 0x401b0c
add edi, 0xc
mov dword [ebp - 0x264], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0x260], eax
cmp dword [edi], ebx
je 0x4067fa
int3
push edi
push 3
lea edx, [ebp - 0x268]
pop ecx
call fcn.004065c2
mov esi, eax
test esi, esi
js 0x406831
push ebx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x406831
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x406831
movzx esi, si
or esi, 0x80070000
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407be0
leave
ret
Function at 0x406842
Capabilities:
Check if file exists
Copy file
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x409004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
mov esi, ecx
and dword [ebp - 0x10], edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4068c0
test al, 0x10
jne 0x4068c0
mov eax, dword [esi + 0xc]
lea edx, [ebp - 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 2
pop ecx
mov dword [ebp - 8], 0x401b18
call fcn.004065c2
mov esi, dword [ebp - 0x10]
test eax, eax
js 0x4068ac
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x4068ac
push edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test esi, esi
je 0x4068c0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407be0
leave
ret 4
Function at 0x407040
Capabilities:
Delete directory
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x409004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
cmp dword [esi + 0x10], ebx
je 0x407079
push edi
mov edi, dword [esi + 0x18]
test edi, edi
je 0x407078
push dword [esi + 0x10]
mov ecx, edi
call dword [0x40a218]
call edi
mov dword [esi + 0x10], ebx
pop edi
cmp dword [esi + 8], ebx
je 0x407089
push dword [esi + 8]
call fcn.00407122
mov dword [esi + 8], ebx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4070c7
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 0x401b18
push eax
push 2
pop ecx
call fcn.004065c2
test eax, eax
jne 0x4070bf
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [esi + 0xc]
call fcn.004070d5
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00407be0
leave
ret

Function at 0x407813
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x409004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x409888], 0
mov eax, dword [ebp + 8]
jne 0x4078cf
mov dword [0x409888], 1
test eax, eax
je 0x407868
push eax
push edx
push 0x401c04
push 0x401c3c
lea eax, [ebp - 0x404]
push 0x400
push eax
call fcn.004077b3
add esp, 0x18
jmp 0x407887
push edx
push 0x401c04
push 0x401c5c
lea eax, [ebp - 0x404]
push 0x400
push eax
call fcn.004077b3
add esp, 0x14
test eax, eax
js 0x4078b7
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebp - 0x404]
push eax
push 0x401c78
push 0
push 0
push 0x4000000
call fcn.00405f00
add esp, 0x14
jmp 0x4078c2
push 0x401c84
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
and dword [0x409888], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407be0
leave
ret 4
Function at 0x407bd0
Capabilities:
Terminate process

Disassembly:
push 0xc
push 0x408420
call fcn.00407f58
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x409898
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x4079f8
cmp eax, esi
jne 0x4079eb
xor esi, esi
inc esi
mov edi, esi
jmp 0x4079fb
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4079cf
xor esi, esi
inc esi
cmp dword [0x40989c], esi
jne 0x407a0d
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x407a47
cmp dword [0x40989c], ebx
jne 0x407a41
mov dword [0x40989c], esi
push 0x401110
push 0x401104
call fcn.00407b2c
pop ecx
pop ecx
test eax, eax
je 0x407a47
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x407b1c
mov dword [0x409014], esi
cmp dword [0x40989c], esi
jne 0x407a6a
push 0x401100
push 0x4010f4
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x40989c], 2
test edi, edi
jne 0x407a77
xor eax, eax
mov ecx, 0x409898
xchg dword [ecx], eax
cmp dword [0x4098a0], 0
je 0x407aa3
push 0x4098a0
call fcn.00407db0
pop ecx
test eax, eax
je 0x407aa3
push ebx
push 2
push ebx
mov esi, dword [0x4098a0]
mov ecx, esi
call dword [0x40a218]
call esi
push dword [0x409020]
push dword [0x40901c]
push dword [0x409018]
call fcn.004020bc
add esp, 0xc
mov dword [0x409010], eax
cmp dword [0x409028], 0
jne 0x407b01
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
push ecx
push eax
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x409014], 0
jne 0x407b15
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x409010]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
call fcn.00407ea5
jmp 0x4079b3

Function at 0x407c94
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x408440
call fcn.00407f58
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x407cf4
cmp eax, 0xffffffff
je 0x407cf4
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x407ced
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x407ced
cmp edx, 0x10000000
jae 0x407ced
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x407cea
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x407d60
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x407d9e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407d96
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407da0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407d86
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x407e70
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407ea1
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407ea1
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407ea1
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x407281
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461124], 0
jne 0x4072bf
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x407295
mov dword [ecx*4 + 0x461120], eax
inc ecx
cmp ecx, 0x100
jl 0x407290
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x4072ec
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461120]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072cd
not eax
pop ebp
ret 0xc

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x433072
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x40b50d7b
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x314277c7
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x40b9d1
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0040b66b
Function at 0x405330
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40538c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40538c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40538c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40538c
cmp dword [ecx + 0x74], 0xe
jbe 0x40538c
cmp dword [ecx + 0xe8], 0
je 0x40538c
push dword [ebp + 8]
call fcn.00405130
add esp, 4
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 1]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
push 0x40a570
call fcn.00404f00
add esp, 8
cmp dword [ebp - 8], 0
jne 0x4053c1
push dword [ebp + 8]
call fcn.004050f0
mov esp, ebp
pop ebp
ret

Function at 0x405b00
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0xa4]
shl ecx, 0x10
or ecx, dword [eax + 0xa8]
cmp ecx, 0x60000
jae 0x405b2a
mov eax, 2
pop ebp
ret
push esi
call fcn.00404bf0
mov esi, eax
mov eax, dword [ebp + 8]
mov edx, dword [esi + 0x70]
mov ecx, edx
and cl, 2
movzx ecx, cl
neg ecx
sbb ecx, ecx
inc eax
cmp eax, 3
ja case.default.0x405b4a
jmp dword [eax*4 + 0x405b80]
or edx, 2
lea eax, [ecx + 2]
mov dword [esi + 0x70], edx
pop esi
pop ebp
ret
and edx, 0xfffffffd
mov dword [esi + 0x70], edx
lea eax, [ecx + 2]
pop esi
pop ebp
ret
call sub.msvcrt.dll__errno
mov dword [eax], 0x16
call fcn.00404d30
or eax, 0xffffffff
pop esi
pop ebp
ret

Function at 0xff8c30
Capabilities:
Encode data using xor

Disassembly:
jmp 0xff8c3a
pushal
call 0xff8c40
pop ebp
sub ebp, 0x10
sub ebp, 0xbf8c30
jmp 0xff8c56
mov eax, 0xbf8c30
add eax, ebp
add eax, 0x4c
mov ecx, 0x593
mov edx, 0xfd4e83a2
xor byte [eax], dl
inc eax
dec ecx
jne 0xff8c6d
jmp 0xff8c80
sub dword [edi + 0x29], ebp
sub ebx, dword [esi + 0x23a2a2a2]
arpl word [edx - 0x5e], bx
mov byte [0x1a6fa1a2], al
cmpsb byte [esi], byte es:[edi]
mov byte [0x8a18a2a2], al
mov byte [0x4055a2a2], al
mov eax, dword [0xae23296a]
mov byte [0x67a1a2a2], al
das
mov byte [esi - 0x7959d4a2], 0x2f
mov byte [esi - 0x7959d4a2], 0xca
salc
wait
and byte [edx + 0x3ff01bca], 0xa2
mov dword [0xfdca868e], eax
inc esp
sar dword [0xa2a2a74a], 0xa2
dec ebx
mov ah, byte [edx - 0x9085d5e]
jmp [ecx]