joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f910
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x5203c0]
test esi, esi
jle 0x41fa20
mov edi, dword [0x5203c4]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x41f944
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x41f9c5
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x41f930
mov dword [esp], eax
mov ebx, eax
call fcn.00420200
test eax, eax
mov edi, eax
je 0x41fa47
mov eax, dword [0x5203c4]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00420300
add eax, dword [edi + 0xc]
mov edx, dword [0x5203c4]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x41fa27
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x41f9be
sub eax, 4
and eax, 0xfffffffb
jne 0x41f9d0
add dword [0x5203c0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
add ebx, dword [0x5203c4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x41f9be
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.004ae5b0
lea esi, [esi]
xor esi, esi
jmp 0x41f94e
mov eax, dword [0x5203c4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.004ae5b0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.004ae5b0
mov esi, esi
lea edi, [edi]

Function at 0x41fe80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x5203d8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x5203d0]
sub esp, 4
test ebx, ebx
je 0x41fed5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x41fece
test esi, esi
je 0x41fece
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x41feb0
mov dword [esp], 0x5203d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x424930
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0x1c
mov dword [0x520424], 0xffffffff
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xffff
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
sub esp, 0x10
mov dword [0x520428], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x4249a0
mov dword [esp + 4], 0x424850
mov dword [esp], eax
mov dword [0x520420], eax
call fcn.0042f6a0
test eax, eax
jne 0x4ae655
add esp, 0x1c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x42498a
Function at 0x432330
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1a
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x80]
mov esi, 0x4da351
push ebx
sub esp, 0x9c
mov eax, dword [str.not_enough_space_for_format_expansion__Please_submit_full_bug_report_at_https:__gcc.gnu.org_bugs__:_n]
mov dword [ebp - 0x81], eax
mov eax, dword [0x4da3b5]
mov dword [ebp - 0x1c], eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
lea eax, [edx + 0x84]
and eax, 0xfffffff0
call fcn.00420460
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x81]
mov dword [ebp - 0x8c], edx
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
lea eax, [ebx + 0x68]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], ecx
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x8c]
mov byte [ebx + edx + 0x68], 0
mov dword [esp], ebx
call fcn.004a70f0
nop
nop
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x4d3ddc], 0
jne 0x432456
mov byte [0x4d3ddc], 1
call fcn.004abec0
test eax, eax
je 0x432424
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call fcn.0041f370
mov dword [esp], 2
mov esi, dword [fcn.0042f570]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x432414
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x4d94d5
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x4acca8
jmp 0x4acca0
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
jmp 0x4323da
mov dword [esp], 2
call dword [0x4d2380]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sub.msvcrt.dll_fwrite
jmp 0x4acc9b
mov dword [esp], 2
call dword [0x4d2380]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x4ae5b0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.0042f570
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.0042f570
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop

Function at 0x401a09
Capabilities:
Hide graphical window

Disassembly:
mov ecx, 0xfffffffe
jmp fcn.00401641
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x401984
Capabilities:
Hide graphical window

Disassembly:
push ebp
sub esp, 0x40
push esp
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
add esp, 0x40
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
loop 0x40199b
push esp
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x4040b0], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], 0x4016e2
mov dword [ebp - 4], str.risiliency
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4040b0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.ebsement
push str.risiliency
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4040b8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401a36
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401a1d
pop ebp
ret 0x10
Function at 0x4035e1
Capabilities:
Delete file
Read .ini file

Disassembly:
mov eax, 0x1000
call fcn.00406cb0
push ebx
push ebp
push esi
push edi
push dword [0x40ea48]
mov edi, dword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
mov ebp, 0x1000
lea eax, [esp + 0x14]
push ebp
mov ebx, 0x40d454
push eax
push ebx
mov esi, 0x40ce44
push str.title
push esi
call edi
lea eax, [esp + 0x10]
push 0x50
push eax
push 0x40d5a0
call fcn.004031f4
add esp, 0xc
lea eax, [esp + 0x10]
push dword [0x40ea48]
push ebp
push eax
push ebx
push str.info
push esi
call edi
lea eax, [esp + 0x10]
push ebp
push eax
push 0x40d720
call fcn.004031f4
add esp, 0xc
push dword [0x40ea48]
push 0x50
push 0x40e8c0
push ebx
push str.build_info
push esi
call edi
push dword [0x40ea48]
mov ebp, dword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
push 1
push str.target_compile
push esi
call ebp
push dword [0x40ea48]
mov dword [0x40d468], eax
push 1
push str.target_optimize
push esi
call ebp
push dword [0x40ea48]
mov dword [0x40e8b8], eax
push 0xa
push 0x40e910
push ebx
push str.target_version
push esi
call edi
push dword [0x40ea48]
push 0x50
push 0x40e860
push ebx
push str.name
push str.metadata
call edi
push dword [0x40ea48]
push 0x104
push 0x40d600
push ebx
push str.install_script
push esi
call edi
push dword [0x40ea48]
push 0xa
mov ebp, 0x40ea60
push ebp
push ebx
push str.user_access_control
push esi
call edi
push str.force
push ebp
call sub.MSVCR71.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x403720
call fcn.004031f4
test eax, eax
je 0x403786
call fcn.004034d3
test eax, eax
jne 0x403786
jmp 0x40374c
push str.auto
push ebp
call sub.MSVCR71.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x403753
call fcn.004031f4
test eax, eax
je 0x403786
call fcn.004034d3
test eax, eax
jne 0x403786
call fcn.004031f4
test eax, eax
je 0x403786
call fcn.004031f4
jmp 0x4037c9
cmp byte [0x40ea60], 0
je 0x403786
push str.none
push ebp
call sub.MSVCR71.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x403786
push 0
push str.oops
push str.Bad_user_access_control_value
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x40d5a0
call fcn.004031f4
push eax
mov dword [0x40e920], eax
call fcn.004031f4
pop ecx
pop ecx
push dword [0x40d584]
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
mov eax, dword [0x40ea48]
test eax, eax
je 0x4037b9
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov eax, dword [0x40ea6c]
test eax, eax
je 0x4037c9
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1000
ret
Function at 0x403c88
Capabilities:
Delete file
Read file on windows

Disassembly:
mov eax, 0x1014
call fcn.00406cb0
push ebx
push esi
mov esi, dword [sym.imp.MSVCR71.dll_strchr]
push edi
push 0x5b
push dword [esp + 0x1028]
call esi
xor edi, edi
pop ecx
cmp eax, edi
pop ecx
je 0x403cc0
inc eax
push 0x5d
push eax
mov dword [esp + 0x18], eax
call esi
mov ebx, eax
pop ecx
cmp ebx, edi
pop ecx
jne 0x403cc7
xor eax, eax
jmp 0x403e40
and byte [ebx], 0
inc ebx
push ebx
push 0x40d340
mov dword [esp + 0x14], ebx
call sub.MSVCR71.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x403e3d
push ebp
push edi
push edi
mov dword [esp + 0x24], str._remove
mov dword [esp + 0x28], edi
mov dword [esp + 0x20], ebx
call dword [sym.imp.MSVCR71.dll__tempnam]
mov esi, dword [sym.imp.MSVCR71.dll_freopen]
mov ebp, eax
mov eax, dword [sym.imp.MSVCR71.dll__iob]
mov edi, 0x40c9d4
add eax, 0x40
push eax
push edi
push ebp
call esi
add esp, 0x14
test eax, eax
jne 0x403d32
push eax
push eax
push str.freopen_stderr
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [sym.imp.MSVCR71.dll__iob]
add eax, 0x20
push eax
push edi
push ebp
call esi
add esp, 0xc
test eax, eax
jne 0x403d5a
push eax
push eax
push str.freopen_stdout
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [esp + 0x14]
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x403d9f
lea eax, [esp + 0x18]
push eax
push 2
push ebx
push esi
call fcn.004031f4
add esp, 0x10
cmp eax, 0x80000000
jne 0x403d98
mov eax, dword [sym.imp.MSVCR71.dll__iob]
push str._Could_not_load_Python_
add eax, 0x40
push eax
call dword [sym.imp.MSVCR71.dll_fprintf]
pop ecx
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov eax, dword [sym.imp.MSVCR71.dll__iob]
mov edi, dword [sym.imp.MSVCR71.dll_fflush]
add eax, 0x40
push eax
call edi
mov eax, dword [sym.imp.MSVCR71.dll__iob]
mov esi, dword [sym.imp.MSVCR71.dll_fclose]
add eax, 0x40
push eax
call esi
mov eax, dword [sym.imp.MSVCR71.dll__iob]
add eax, 0x20
push eax
call edi
mov eax, dword [sym.imp.MSVCR71.dll__iob]
add eax, 0x20
push eax
call esi
push 0x40c970
push ebp
call dword [sym.imp.MSVCR71.dll_fopen]
mov edi, eax
lea eax, [esp + 0x3c]
push edi
push 0x1000
push 1
push eax
call dword [sym.imp.MSVCR71.dll_fread]
push edi
mov ebx, eax
call esi
push ebp
call dword [sym.imp.MSVCR71.dll_remove]
and byte [esp + ebx + 0x54], 0
add esp, 0x30
cmp byte [esp + 0x24], 0
pop ebp
je 0x403e2d
push 0
lea eax, [esp + 0x24]
push str.uninstall_script
push eax
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [esp + 0xc]
push 0x40d340
call sub.MSVCR71.dll_strcpy
pop ecx
pop ecx
push 1
pop eax
pop edi
pop esi
pop ebx
add esp, 0x1014
ret
Function at 0x40344c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x40345b
pop dword [ebp - 0x40]
mov eax, 0xfc0faeb5
sub eax, 0xfbcf7a5a
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x83cb8801
add dword [ebp - 0x50], 0xca86bd4a
mov dword [ebp - 0x4c], 0xf8c4f101
add dword [ebp - 0x4c], 0x396e5b44
mov dword [ebp - 0x48], 0x7030e449
sub dword [ebp - 0x48], 0x23e4a01b
mov dword [ebp - 0x44], 0x7ee481b0
add dword [ebp - 0x44], 0x811b7e50
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x20079b60
add dword [ebp - 0x50], 0x546acdf6
mov dword [ebp - 0x4c], 0xd142c033
sub dword [ebp - 0x4c], 0x8fd65ebe
mov dword [ebp - 0x48], 0xa8dd1f98
add dword [ebp - 0x48], 0xba924cd4
mov dword [ebp - 0x44], 0x7d54f269
add dword [ebp - 0x44], 0x82ab0d97
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x34e37
push 0
call eax
mov ecx, 0xc19e1383
sub ecx, 0xc19dd36b
mov edx, eax
mov ebx, 0xd4c1dada
add ebx, 0x2b7ea926
add ebx, dword [ebp - 0x40]
mov esi, 0xbabafb2a
xor dword [ebp - 0xc], edi
mov edi, dword [ebx]
add dword [ebp - 0x28], 0xf8908fcd
xor edi, esi
xor dword [ebp - 0x14], 0xcc426a2
mov dword [edx], edi
add dword [ebp - 0x30], edi
add edx, 4
add ebx, 0x11e78cf0
sub ebx, 0x11e78cec
loop 0x40356d
add eax, 0xe8aea9f3
sub eax, 0xe8adb6c0
xor ebx, ebx
add ebx, eax
add eax, 0x7d7e311
add eax, 0xf8281cf4
mov ecx, 0x91ea1fb4
add ecx, 0x6e55e04c
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..data
mov ebx, 0x408f6c
nop
mov ecx, 0x4acb4ad2
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data_1
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x43e534c2
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x403043
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [0x417044]
sub esi, dword [0x40afb0]
push edi
add esi, dword [esp + 0x18]
call dword [sym.imp.kernel32.dll_GetTickCount]
xor ebx, ebx
add eax, 0x1f4
cmp esi, ebx
mov dword [0x423eac], eax
jle 0x4031ad
push dword [0x41f054]
call fcn.004031f1
push ebx
push ebx
push dword [0x40afb0]
push dword [0x409018]
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov dword [0x41f050], esi
mov dword [0x417040], ebx
mov ebp, 0x40b040
mov eax, dword [0x417048]
mov edi, 0x4000
sub eax, dword [0x41f054]
cmp eax, edi
jg 0x4030b8
mov edi, eax
mov esi, 0x413040
push edi
push esi
call fcn.0040548b
test eax, eax
je 0x40319f
add dword [0x41f054], edi
mov dword [0x40afd0], esi
mov dword [0x40afd4], edi
cmp dword [0x423eb0], ebx
je 0x40310f
cmp dword [0x423f40], ebx
jne 0x40310f
mov eax, dword [0x41f050]
push ebx
sub eax, dword [0x417044]
sub eax, dword [esp + 0x1c]
add eax, dword [0x40afb0]
mov dword [0x417040], eax
call fcn.0040548b
pop ecx
mov ecx, 0x40afb8
mov dword [0x40afd8], ebp
mov dword [0x40afdc], 0x8000
call fcn.0040548b
test eax, eax
jl 0x4031a8
mov esi, dword [0x40afd8]
sub esi, ebp
je 0x403169
lea eax, [esp + 0x10]
push ebx
push eax
push esi
push ebp
push dword [0x409018]
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
je 0x4031a4
cmp esi, dword [esp + 0x10]
jne 0x4031a4
add dword [0x40afb0], esi
cmp dword [0x40afd4], ebx
jne 0x4030de
jmp 0x403175
cmp dword [0x40afd4], ebx
jne 0x4031a8
cmp edi, ebx
je 0x4031a8
mov eax, dword [0x417044]
mov ecx, eax
sub ecx, dword [0x40afb0]
add ecx, dword [esp + 0x18]
test ecx, ecx
jg 0x4030a2
push ebx
push ebx
push eax
push dword [0x409018]
call dword [sym.imp.kernel32.dll_SetFilePointer]
jmp 0x4031ad
or eax, 0xffffffff
jmp 0x4031b7
push 0xfffffffffffffffe
jmp 0x4031aa
push 0xfffffffffffffffd
pop eax
jmp 0x4031b7
push 1
call fcn.0040548b
pop ecx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x40548b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x40549a
pop dword [ebp - 8]
mov eax, 0x40549a
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x1731e4c2
add dword [ebp - 0x18], 0x37206089
mov dword [ebp - 0x14], 0x13f78518
add dword [ebp - 0x14], 0x1e3bc72d
mov dword [ebp - 0x10], 0x802cf15a
sub dword [ebp - 0x10], 0x33e0ad2c
mov dword [ebp - 0xc], 0x4603bc97
sub dword [ebp - 0xc], 0x4603bc97
lea eax, [ebp - 0x18]
push eax
mov eax, 0xdd1fff13
add eax, 0x232071f9
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xa3740311
sub dword [ebp - 0x18], 0x2f0199bb
mov dword [ebp - 0x14], 0x2836d6db
sub dword [ebp - 0x14], 0xe6ca7566
mov dword [ebp - 0x10], 0x398efbe9
add dword [ebp - 0x10], 0x29e07083
mov dword [ebp - 0xc], 0xd3297baa
add dword [ebp - 0xc], 0x2cd68456
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xab395cee
add eax, 0x55071426
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x37077
push 0
call eax
mov ecx, 0x338947d5
sub ecx, 0x3388ff4c
mov esi, eax
mov edi, 0x432600
add edi, dword [ebp - 8]
mov ebx, 0xe669d92
add ebx, 0x37ab03b
mov dword [ebp - 4], 0x77dc08b4
mov edx, dword [edi]
xor dword [ebp - 4], ebx
xor edx, ebx
add dword [ebp - 4], ebx
mov dword [esi], edx
add dword [ebp - 4], eax
add esi, 0x1c06cd43
add esi, 0xe3f932c1
add edi, 0x37658723
sub edi, 0x3765871f
loop 0x4055b1
add eax, 0x2cd8ae5b
sub eax, 0x2cd79964
xor ebx, ebx
add ebx, eax
add eax, 0x8ce794b4
add eax, 0x73186b51
mov ecx, 0x8df1dbb0
sub ecx, 0x8db1dbb0
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x40573a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x4218a8
push esi
call fcn.00405b66
push esi
call fcn.004056ed
mov edi, eax
test edi, edi
jne 0x40575b
xor eax, eax
jmp 0x4057ad
push edi
call fcn.00405dc8
test byte [0x423eb8], 0x80
je 0x405774
mov al, byte [edi]
test al, al
je 0x405757
cmp al, 0x5c
je 0x405757
sub edi, esi
jmp 0x40578c
call fcn.00405e61
test eax, eax
je 0x405786
test byte [eax], 0x10
je 0x405757
push esi
call fcn.004056a0
push esi
call sub.kernel32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x405778
call fcn.00405659
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x40581e
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40583a
and al, 0xfe
push eax
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
ret 4

Function at 0x40583d
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_CreateFileA]
ret 0xc