joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5159de0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor edx, edx
push ebp
push 0x5159f61
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebx + 0x64], 0
mov byte [ebx + 0x31], 0
mov byte [ebx + 0x4c], 1
mov eax, dword [ebx + 0x44]
add eax, 0x18
mov edx, dword [0x516cb14]
mov edx, dword [edx]
call fcn.05094c9c
mov ecx, dword [0x516c740]
mov ecx, dword [ecx]
mov edx, dword [0x516c48c]
mov edx, dword [edx]
mov eax, dword [ebx + 0x44]
add eax, 0x1c
call fcn.05094f54
mov eax, dword [ebx + 0x44]
add eax, 0xc
mov edx, dword [0x516c48c]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x44]
mov byte [eax + 8], 1
mov byte [eax + 0x20], 3
mov dword [eax + 0x28], 9
mov dword [eax + 0x2c], 7
mov dword [eax + 0x34], 2
mov eax, dword [ebx + 0x34]
mov dword [eax + 0x38], 5
mov dword [eax + 0x3c], 4
mov byte [eax + 4], 1
mov eax, dword [ebx + 0x44]
mov byte [eax + 9], 1
mov dword [eax + 0x30], 2
mov byte [eax + 0xa], 1
mov byte [eax + 0x21], 1
mov eax, dword [ebx + 0x3c]
add eax, 4
mov edx, dword [0x516c80c]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x3c]
add eax, 8
mov edx, dword [0x516c564]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x3c]
add eax, 0xc
mov edx, dword [0x516c498]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x3c]
add eax, 0x10
mov edx, dword [0x516c8f8]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x38]
add eax, 4
mov edx, dword [0x516c44c]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x38]
add eax, 8
mov edx, dword [0x516cb78]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x38]
add eax, 0xc
mov edx, dword [0x516c518]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x38]
add eax, 0x1c
mov edx, dword [0x516c548]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x38]
add eax, 0x24
mov edx, dword [0x516c570]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x38]
add eax, 0x28
mov edx, dword [0x516c540]
mov edx, dword [edx]
call fcn.05094c9c
mov dword [ebx + 0x54], ebx
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov dword [ebx + 0x50], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5159f6b
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x515a128
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor edx, edx
push ebp
push 0x515a2a9
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebx + 0x64], 0
mov byte [ebx + 0x31], 0
mov byte [ebx + 0x4c], 1
mov eax, dword [ebx + 0x44]
add eax, 0x18
mov edx, dword [0x516c6c8]
mov edx, dword [edx]
call fcn.05094c9c
mov ecx, dword [0x516c740]
mov ecx, dword [ecx]
mov edx, dword [0x516c854]
mov edx, dword [edx]
mov eax, dword [ebx + 0x44]
add eax, 0x1c
call fcn.05094f54
mov eax, dword [ebx + 0x44]
add eax, 0xc
mov edx, dword [0x516c854]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x44]
mov byte [eax + 8], 1
mov byte [eax + 0x20], 0xa
mov dword [eax + 0x28], 9
mov dword [eax + 0x2c], 7
mov dword [eax + 0x34], 2
mov eax, dword [ebx + 0x34]
mov dword [eax + 0x38], 5
mov dword [eax + 0x3c], 4
mov byte [eax + 4], 1
mov eax, dword [ebx + 0x44]
mov byte [eax + 9], 1
mov dword [eax + 0x30], 2
mov byte [eax + 0xa], 1
mov byte [eax + 0x21], 1
mov eax, dword [ebx + 0x3c]
add eax, 4
mov edx, dword [0x516cbc0]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x3c]
add eax, 8
mov edx, dword [0x516c93c]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x3c]
add eax, 0xc
mov edx, dword [0x516c860]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x3c]
add eax, 0x10
mov edx, dword [0x516c494]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x38]
add eax, 4
mov edx, dword [0x516c7fc]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x38]
add eax, 8
mov edx, dword [0x516c73c]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x38]
add eax, 0xc
mov edx, dword [0x516c8e4]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x38]
add eax, 0x1c
mov edx, dword [0x516c924]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x38]
add eax, 0x24
mov edx, dword [0x516c944]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x38]
add eax, 0x28
mov edx, dword [0x516c910]
mov edx, dword [edx]
call fcn.05094c9c
mov dword [ebx + 0x54], ebx
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov dword [ebx + 0x50], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x515a2b3
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x515a470
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor edx, edx
push ebp
push 0x515a54c
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebx + 0x64], 0
mov byte [ebx + 0x31], 0
mov byte [ebx + 0x4c], 1
mov byte [ebx + 0x30], 0
mov eax, dword [ebx + 0x44]
mov byte [eax + 8], 0
mov eax, dword [ebx + 0x34]
mov dword [eax + 0x38], 5
mov dword [eax + 0x3c], 4
mov byte [eax + 4], 1
mov eax, dword [ebx + 0x3c]
add eax, 4
mov edx, dword [0x516cbd4]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x3c]
add eax, 8
mov edx, dword [0x516c94c]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x3c]
add eax, 0xc
mov edx, dword [0x516c878]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x3c]
add eax, 0x10
mov edx, dword [0x516c4b0]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x38]
add eax, 4
mov edx, dword [0x516c824]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x38]
add eax, 8
mov edx, dword [0x516c74c]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x38]
add eax, 0x10
mov edx, dword [0x516c59c]
mov edx, dword [edx]
call fcn.05094c9c
mov dword [ebx + 0x54], ebx
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov dword [ebx + 0x50], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x515a556
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x515a7e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor edx, edx
push ebp
push 0x515a8b8
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebx + 0x64], 0
mov byte [ebx + 0x31], 0
mov byte [ebx + 0x30], 1
mov eax, dword [ebx + 0x44]
mov byte [eax + 8], 0
mov eax, dword [ebx + 0x34]
mov dword [eax + 0x38], 6
mov dword [eax + 0x3c], 4
mov byte [eax + 4], 1
mov eax, dword [ebx + 0x3c]
add eax, 4
mov edx, dword [0x516ca78]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x3c]
add eax, 8
mov edx, dword [0x516c7c0]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x3c]
add eax, 0xc
mov edx, dword [0x516c6dc]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x3c]
add eax, 0x10
mov edx, dword [0x516cb34]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x38]
add eax, 4
mov edx, dword [0x516c68c]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x38]
add eax, 8
mov edx, dword [0x516c5b4]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x38]
add eax, 0x10
mov edx, dword [0x516cc38]
mov edx, dword [edx]
call fcn.05094c9c
mov dword [ebx + 0x54], ebx
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov dword [ebx + 0x50], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x515a8c2
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x515aaf0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor edx, edx
push ebp
push 0x515ac4d
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebx + 0x64], 0
mov byte [ebx + 0x70], 0
mov eax, dword [ebx + 0x44]
add eax, 0x18
mov edx, dword [0x516c5c8]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x44]
add eax, 0x1c
mov edx, dword [0x516c9fc]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x44]
mov byte [eax + 8], 1
mov byte [eax + 0x20], 8
mov dword [eax + 0x28], 8
mov dword [eax + 0x2c], 8
mov dword [eax + 0x34], 3
mov byte [eax + 9], 0
mov byte [ebx + 0x18], 1
mov eax, dword [ebx + 0x44]
xor edx, edx
mov dword [eax + 0x30], edx
mov byte [eax + 0xa], 0
mov byte [eax + 0x21], 2
mov eax, dword [ebx + 0x34]
mov byte [eax + 4], 0
mov dword [eax + 0x38], 6
mov eax, dword [ebx + 0x3c]
add eax, 4
mov edx, dword [0x516cab8]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x3c]
add eax, 8
mov edx, dword [0x516c830]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x3c]
add eax, 0xc
mov edx, dword [0x516c750]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x3c]
add eax, 0x10
mov edx, dword [0x516cb88]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x38]
add eax, 4
mov edx, dword [0x516c704]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x38]
add eax, 8
mov edx, dword [0x516c620]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x38]
add eax, 0xc
mov edx, dword [0x516c7d4]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x38]
add eax, 0x1c
mov edx, dword [0x516c7f8]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x38]
add eax, 0x24
mov edx, dword [0x516c83c]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x38]
add eax, 0x28
mov edx, dword [0x516c7e0]
mov edx, dword [edx]
call fcn.05094c9c
mov dword [ebx + 0x54], ebx
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov dword [ebx + 0x50], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x515ac57
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x515b06c
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor edx, edx
push ebp
push 0x515b1d9
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebx + 0x64], 0
mov byte [ebx + 0x70], 0
mov byte [ebx + 0x31], 1
mov eax, dword [ebx + 0x44]
add eax, 0x18
mov edx, dword [0x516c538]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x44]
add eax, 0x1c
mov edx, dword [0x516c970]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x44]
mov byte [eax + 8], 1
mov byte [eax + 0x20], 9
mov dword [eax + 0x28], 8
mov dword [eax + 0x2c], 8
mov dword [eax + 0x34], 3
mov byte [eax + 9], 0
xor edx, edx
mov dword [eax + 0x30], edx
mov byte [eax + 0xa], 0
mov byte [eax + 0x21], 2
mov eax, dword [ebx + 0x34]
mov byte [eax + 4], 1
mov dword [eax + 0x38], 6
mov eax, dword [ebx + 0x3c]
add eax, 4
mov edx, dword [0x516ca38]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x3c]
add eax, 8
mov edx, dword [0x516c78c]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x3c]
add eax, 0xc
mov edx, dword [0x516c694]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x3c]
add eax, 0x10
mov edx, dword [0x516cae4]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x38]
add eax, 0x20
mov edx, dword [0x516cc0c]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x38]
add eax, 4
mov edx, dword [0x516c650]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x38]
add eax, 8
mov edx, dword [0x516c598]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x38]
add eax, 0xc
mov edx, dword [0x516c72c]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x38]
add eax, 0x1c
mov edx, dword [0x516c764]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x38]
add eax, 0x24
mov edx, dword [0x516c794]
mov edx, dword [edx]
call fcn.05094c9c
mov eax, dword [ebx + 0x38]
add eax, 0x28
mov edx, dword [0x516c754]
mov edx, dword [edx]
call fcn.05094c9c
mov dword [ebx + 0x54], ebx
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov dword [ebx + 0x50], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x515b1e3
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x5165eac
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
mov eax, ebx
call fcn.0510c220
xor edx, edx
push ebp
push 0x5165f1e
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebx + 0x70]
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 4]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 8]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0xc]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0x10]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0x14]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0x18]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0x1c]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov eax, dword [eax + 0x20]
mov byte [eax + 0x30], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5165f28
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4bf024
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe28
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1d4], edx
mov dword [ebp - 0x1d8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405868
xor eax, eax
push ebp
push 0x4bf165
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4bf135
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.00405878
mov ebx, eax
push ebx
call sub.kernel32.dll_DeleteFileA
push ebx
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebp - 4]
call fcn.0040a7ac
test al, al
jne 0x4bf0a5
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push ebx
call sub.kernel32.dll_CreateFileA_1
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.00403858
lea eax, [ebp - 0x1d0]
call fcn.004035f4
call fcn.004030d4
push dword [0x4cde08]
push 0x4bf17c
push dword [0x4cde0c]
push 0x4bf17c
push dword [0x4cde10]
lea eax, [ebp - 0x1d8]
mov edx, 5
call fcn.0040577c
mov eax, dword [ebp - 0x1d8]
lea edx, [ebp - 0x1d4]
call fcn.004b98d4
mov edx, dword [ebp - 0x1d4]
lea eax, [ebp - 0x1d0]
call fcn.00405b98
call fcn.00403f50
call fcn.004030d4
lea eax, [ebp - 0x1d0]
call fcn.00403920
call fcn.004030d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bf13f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bf16c
lea eax, [ebp - 0x1d8]
mov edx, 2
call fcn.0040540c
lea eax, [ebp - 4]
call fcn.004053e8
ret

Function at 0x402b3d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, 0x401000
call 0x402b3d
lcall 0x5de5, 0x8b10c483
jmp loc.008779fc
Function at 0x41ee23
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x4223d8
call fcn.0041fd98
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x423e5c
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x41ee75
cmp eax, esi
jne 0x41ee68
xor esi, esi
inc esi
mov edi, esi
jmp 0x41ee78
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41ee4c
xor esi, esi
inc esi
cmp dword [0x423e60], esi
jne 0x41ee8a
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x41eec4
cmp dword [0x423e60], ebx
jne 0x41eebe
mov dword [0x423e60], esi
push 0x401028
push 0x401018
call fcn.0041effe
pop ecx
pop ecx
test eax, eax
je 0x41eec4
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x41efee
mov dword [0x423ae0], esi
cmp dword [0x423e60], esi
jne 0x41eee7
push 0x401014
push section..text
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x423e60], 2
test edi, edi
jne 0x41eef4
xor eax, eax
mov ecx, 0x423e5c
xchg dword [ecx], eax
cmp dword [0x423e70], 0
je 0x41ef20
push 0x423e70
call fcn.0041fbf0
pop ecx
test eax, eax
je 0x41ef20
push ebx
push 2
push ebx
mov esi, dword [0x423e70]
mov ecx, esi
call dword [0x42486c]
call esi
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
mov ecx, dword [eax]
test ecx, ecx
je 0x41eead
mov dword [ebp - 0x20], ecx
push 0x20
pop esi
mov edx, dword [ebp - 0x1c]
movzx eax, word [ecx]
cmp ax, si
ja 0x41ef8b
test ax, ax
je 0x41ef5a
test edx, edx
jne 0x41ef8b
test ax, ax
je 0x41ef5a
cmp ax, si
ja 0x41ef5a
add ecx, 2
mov dword [ebp - 0x20], ecx
movzx eax, word [ecx]
jmp 0x41ef45
test byte [ebp - 0x3c], 1
je 0x41ef66
movzx eax, word [ebp - 0x38]
jmp 0x41ef69
push 0xa
pop eax
push eax
push ecx
push ebx
push 0x400000
call main
mov dword [0x423adc], eax
cmp dword [0x423af4], 0
jne 0x41efd3
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp eax, 0x22
jne 0x41ef9c
xor eax, eax
test edx, edx
sete al
mov edx, eax
mov dword [ebp - 0x1c], edx
add ecx, 2
mov dword [ebp - 0x20], ecx
jmp 0x41ef34
cmp dword [0x423ae0], 0
jne 0x41efe7
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x423adc]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
call fcn.00556000
jmp 0x41ee23

Function at 0x41fad4
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x422418
call fcn.0041fd98
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x41fb34
cmp eax, 0xffffffff
je 0x41fb34
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x41fb2d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x41fb2d
cmp edx, 0x10000000
jae 0x41fb2d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x41fb2a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x409be9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x409bf8
pop dword [ebp - 0x3c]
mov eax, 0xdbd81b17
sub eax, 0xdb977f1f
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x15016402
sub dword [ebp - 0x4c], 0xc6af1eb7
mov dword [ebp - 0x48], 0xe6aa81de
add dword [ebp - 0x48], 0x4b88ca67
mov dword [ebp - 0x44], 0x74d6e0ed
add dword [ebp - 0x44], 0xd7756341
mov dword [ebp - 0x40], 0x6eb0a41
add dword [ebp - 0x40], 0xf914f5bf
lea eax, [ebp - 0x4c]
push eax
mov eax, 0xc891fa2c
add eax, 0x37b03648
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x7326fda7
add dword [ebp - 0x4c], 0x14b6baf
mov dword [ebp - 0x48], 0xf14d154e
sub dword [ebp - 0x48], 0xafe0b3d9
mov dword [ebp - 0x44], 0xfc568fa8
add dword [ebp - 0x44], 0x6718dcc4
mov dword [ebp - 0x40], 0xa7414d7a
add dword [ebp - 0x40], 0x58beb286
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3ecaf
push 0
call eax
mov ecx, 0x9bbc4f83
sub ecx, 0x9bbc03a1
xor edx, edx
add edx, eax
mov ebx, 0x53897ea7
add ebx, 0xacb9c559
add ebx, dword [ebp - 0x3c]
mov edi, 0x25b6ef10
add edi, 0xebc60ef
add dword [ebp - 0x14], 0xf25629cb
mov esi, dword [ebx]
sub dword [ebp - 4], 0x9453cf6
xor esi, edi
sub dword [ebp - 0x10], 0x739fed6a
mov dword [edx], esi
xor dword [ebp - 0x10], esi
add edx, 0x29e305e2
sub edx, 0x29e305de
add ebx, 0x95bd26a6
sub ebx, 0x95bd26a2
loop 0x409d17
add eax, 0x1c9c8b9b
add eax, 0xe36496c0
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0xa16ab0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x4a2015
lea edi, [esi - 0xa1015]
push edi
or ebp, 0xffffffff
jmp 0xa16ad2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xa16ad9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa16ac8
mov eax, 1
add ebx, ebx
jne 0xa16aeb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xa16afc
jne 0xa16b1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa16b1b
dec eax
add ebx, ebx
jne 0xa16b08
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xa16ae0
add ebx, ebx
jne 0xa16b17
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xa16b6d
xor ecx, ecx
sub eax, 3
jb 0xa16b33
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xa16ba2
sar eax, 1
mov ebp, eax
jmp 0xa16b3e
add ebx, ebx
jne 0xa16b3e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa16b0c
inc ecx
add ebx, ebx
jne 0xa16b4c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa16b0c
add ebx, ebx
jne 0xa16b59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xa16b4e
jne 0xa16b6a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xa16b4e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xa16b8c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xa16b7e
jmp 0xa16ace
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xa16b8c
add edi, ecx
jmp 0xa16ace
pop esi
mov edi, esi
mov ecx, 0x76
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xa16baa
cmp byte [edi], 0
jne 0xa16baa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xa16baf
lea edi, [esi + 0x614000]
mov eax, dword [edi]
or eax, eax
je 0xa16c1e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x6160dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x61612c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xa16bdc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x616130]
or eax, eax
je 0xa16c18
mov dword [ebx], eax
add ebx, 4
jmp 0xa16bf9
call dword [esi + 0x616140]
mov ebp, dword [esi + 0x616134]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xa16c52
sub esp, 0xffffff80
jmp 0x401ae1
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x40cfbb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x40cfca
pop dword [ebp - 0x1c]
mov eax, 0x40cfca
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x1f3a1bc8
sub dword [ebp - 0x2c], 0xd0e7d67d
mov dword [ebp - 0x28], 0x6d16eb81
sub dword [ebp - 0x28], 0x3ae39f3c
mov dword [ebp - 0x24], 0xd1459832
add dword [ebp - 0x24], 0x7b06abfc
mov dword [ebp - 0x20], 0x922640be
add dword [ebp - 0x20], 0x6dd9bf42
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xcacb449d
sub dword [ebp - 0x2c], 0x5658db47
mov dword [ebp - 0x28], 0xcd5d414a
sub dword [ebp - 0x28], 0x8bf0dfd5
mov dword [ebp - 0x24], 0xd6ad0922
sub dword [ebp - 0x24], 0x733d9cb6
mov dword [ebp - 0x20], 0x7cbdcc4f
add dword [ebp - 0x20], 0x834233b1
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x660f9d09
add eax, 0x9a32941b
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x4108b
push 0
call eax
mov ecx, 0x546681ee
add ecx, 0xab99d375
mov edx, eax
mov ebx, 0xff3d97ba
add ebx, 0x105ac46
add ebx, dword [ebp - 0x1c]
mov esi, 0x5524508f
sub esi, 0xee508b16
mov edi, dword [ebx]
sub dword [ebp - 0x10], 0x70e676f
add edi, esi
xor dword [ebp - 0xc], edx
mov dword [edx], edi
mov dword [ebp - 0xc], 0x332f8c34
add edx, 0x51e08c95
add edx, 0xae1f736f
add ebx, 0x216ac030
sub ebx, 0x216ac02c
loop 0x40d0e2
add eax, 0x6db6b563
sub eax, 0x6db56d04
xor ebx, ebx
add ebx, eax
add eax, 0xadd53145
sub eax, 0xadd53140
mov ecx, 0xec00e6c4
sub ecx, 0xebc0e6c4
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret