joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402de0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
and esp, 0xfffffff8
sub esp, 0x98
mov byte [esp + 0x87], 1
mov dword [esp + 0x7c], 0x4b5d
mov dword [esp + 0x54], 0
mov dword [esp + 0x4c], eax
mov bl, byte [esp + 0x83]
mov bh, bl
add bh, bh
mov byte [esp + 0x83], 0x7b
mov dword [esp + 0x48], ecx
mov dword [esp + 0x58], edx
mov dword [esp + 0x38], esi
mov byte [esp + 0x83], bh
mov byte [esp + 0x34], bl
call fcn.00402dd0
mov dword [esp + 0x44], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call eax
mov ecx, esp
mov dword [ecx], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetThreadPriority]
call eax
sub esp, 4
mov esi, dword [esp + 0x8c]
mov ebx, esi
mov edx, dword [esp + 0x88]
mov edi, edx
add edi, 0x62f6
adc ebx, 0
mov ecx, dword [esp + 0x7c]
add ecx, 0xffffb4a3
cmp eax, ecx
mov dword [esp + 0x88], edi
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x30], edx
mov dword [esp + 0x2c], esi
je 0x402eae
mov eax, dword [sym.imp.KERNEL32.dll_GetTickCount]
call eax
mov dword [esp + 0x28], eax
call entry0
mov ecx, dword [esp + 0x7c]
xor ecx, 0x4b5d
lea eax, [0x401231]
mov dword [esp], eax
mov dword [esp + 0x24], ecx
call fcn.004038a1
mov ecx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x20], eax
call ecx
mov ecx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x1c], eax
call ecx
mov edx, dword [esp + 0x24]
mov dword [esp + 0x50], edx
lea ecx, [0x40123c]
mov dword [esp + 0x40], ecx
mov dword [esp + 0x18], eax
mov edx, esp
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x40]
mov dword [edx + 4], eax
mov dword [edx], ecx
lea ecx, [esp + 0x3c]
call fcn.00402fd0
sub esp, 8
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov bl, byte [esp + 0x87]
neg bl
add ecx, ecx
adc edx, edx
cmp eax, 0
setne bh
xor bh, bl
test bh, 1
mov dword [esp + 0x8c], edx
mov dword [esp + 0x88], ecx
jne 0x402f45
jmp 0x402f9c
mov ecx, dword [esp + 0x7c]
xor ecx, 0x4b5c
add ecx, dword [esp + 0x50]
mov dword [esp + 0x50], ecx
mov eax, 0x1d1fd
sub eax, dword [esp + 0x7c]
cmp dword [esp + 0x50], eax
jle 0x402f75
mov al, byte [esp + 0x34]
or al, 0x7e
mov byte [esp + 0x83], al
jmp 0x402f9c
mov edx, dword [esp + 0x50]
lea ecx, [esp + 0x5c]
mov dword [esp], ecx
lea eax, [0x401244]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.00403932
mov dword [esp + 0x14], eax
jmp 0x402ef8
mov ecx, esp
mov eax, dword [esp + 0x7c]
mov dword [ecx], 0xbc54fdf4
xor eax, 0x4b5d
mov dword [esp + 0x10], eax
call fcn.00411cb0
mov eax, dword [esp + 0x10]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x406183
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
mov esi, esi
push esi
push 0x401958
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x4061a0
call fcn.00405eb1
xor eax, eax
pop esi
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401998
push esi
call edi
push 0x40198c
push esi
mov dword [0x4165d4], eax
call edi
push 0x401980
push esi
mov dword [0x4165d8], eax
call edi
push 0x401978
push esi
mov dword [0x4165dc], eax
call edi
cmp dword [0x4165d4], 0
mov edi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0x4165e0], eax
je 0x406200
cmp dword [0x4165d8], 0
je 0x406200
cmp dword [0x4165dc], 0
je 0x406200
test eax, eax
jne 0x406224
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [0x4165d8], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsFree]
mov dword [0x4165d4], 0x405e7e
mov dword [0x4165dc], edi
mov dword [0x4165e0], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x41523c], eax
je 0x406297
push dword [0x4165d8]
push eax
call edi
test eax, eax
je 0x406297
call fcn.00405255
push dword [0x4165d4]
call fcn.00405da9
push dword [0x4165d8]
mov dword [0x4165d4], eax
call fcn.00405da9
push dword [0x4165dc]
mov dword [0x4165d8], eax
call fcn.00405da9
push dword [0x4165e0]
mov dword [0x4165dc], eax
call fcn.00405da9
add esp, 0x10
mov dword [0x4165e0], eax
call fcn.00408984
test eax, eax
jne 0x40629c
call fcn.00405eb1
xor eax, eax
pop edi
pop esi
ret
push 0x406038
push dword [0x4165d4]
call fcn.00405e18
pop ecx
call eax
mov dword [0x415240], eax
cmp eax, 0xffffffff
je 0x406292
push 0x214
push 1
call fcn.0040aa4d
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x406292
push edi
push dword [0x415240]
push dword [0x4165dc]
call fcn.00405e18
pop ecx
call eax
test eax, eax
jne 0x4062ef
push edi
call fcn.004088f6
pop ecx
jmp 0x406292
push 0
push edi
call fcn.00405eee
or dword [edi + 4], 0xffffffff
pop ecx
xor eax, eax
pop ecx
inc eax
jmp 0x406299

Function at 0x407681
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
add esp, 0xfffffd30
mov eax, dword [0x415e80]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x234], edi
mov word [ebp - 0x208], ss
mov word [ebp - 0x214], cs
mov word [ebp - 0x238], ds
mov word [ebp - 0x23c], es
mov word [ebp - 0x240], fs
mov word [ebp - 0x244], gs
pushfd
pop dword [ebp - 0x210]
mov eax, dword [ebp + 4]
mov dword [ebp - 0x218], eax
lea eax, [ebp + 4]
mov dword [ebp - 0x2d0], 0x10001
mov dword [ebp - 0x20c], eax
mov eax, dword [eax - 4]
push 0x401a1c
mov dword [ebp - 0x21c], eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409e8a
leave
ret

Function at 0x407727
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00407681
Function at 0x409c8d
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.0040601e
mov ebx, dword [ebp + 8]
mov esi, eax
add esi, 0x9c
test ebx, ebx
jne 0x409cb5
or dword [esi + 8], 0x104
jmp 0x409d79
lea eax, [ebx + 0x40]
test eax, eax
lea edi, [esi + 4]
mov dword [esi], ebx
mov dword [edi], eax
je 0x409cd8
cmp byte [eax], 0
je 0x409cd8
push edi
push 0x16
push 0x402b00
call fcn.004096ab
add esp, 0xc
mov eax, dword [esi]
and dword [esi + 8], 0
or eax, eax
je 0x409d35
cmp byte [eax], 0
je 0x409d35
mov eax, dword [edi]
test eax, eax
je 0x409cf9
cmp byte [eax], 0
je 0x409cf9
call fcn.00409bd2
jmp 0x409cfe
call fcn.00409c45
cmp dword [esi + 8], 0
jne 0x409d8f
push esi
push 0x41
push 0x4028f0
call fcn.004096ab
add esp, 0xc
test eax, eax
je 0x409d85
mov edi, dword [edi]
test edi, edi
je 0x409d2e
cmp byte [edi], 0
je 0x409d2e
call fcn.00409bd2
jmp 0x409d85
call fcn.00409c45
jmp 0x409d85
mov edi, dword [edi]
test edi, edi
je 0x409d72
cmp byte [edi], 0
je 0x409d72
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409d45
xor ecx, ecx
sub eax, edx
cmp eax, 3
sete cl
push 1
push 0x4097fc
mov dword [esi + 0x14], ecx
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
test byte [esi + 8], 4
jne 0x409d85
and dword [esi + 8], 0
jmp 0x409d85
mov dword [esi + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
cmp dword [esi + 8], 0
je 0x409e83
mov eax, ebx
add ebx, 0x80
neg eax
sbb eax, eax
and eax, ebx
push eax
mov edx, esi
call fcn.0040970d
mov edi, eax
test edi, edi
pop ecx
mov dword [ebp + 8], edi
je 0x409e83
cmp edi, 0xfde8
je 0x409e83
cmp edi, 0xfde9
je 0x409e83
movzx eax, di
push eax
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x409e83
push 1
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x409e83
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x409e0a
mov cx, word [esi + 0x18]
mov word [eax], cx
mov cx, word [esi + 0x1c]
mov word [eax + 2], cx
mov word [eax + 4], di
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x409e7e
cmp word [eax], 0x814
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jne 0x409e43
push 0x402bd4
push 0x40
push ebx
call fcn.0040952a
add esp, 0xc
test eax, eax
je 0x409e54
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00407681
add esp, 0x14
jmp 0x409e54
push 0x40
push ebx
push 0x1001
push dword [esi + 0x18]
call edi
test eax, eax
je 0x409e83
push 0x40
lea eax, [ebx + 0x40]
push eax
push 0x1002
push dword [esi + 0x1c]
call edi
test eax, eax
je 0x409e83
push 0xa
push 0x10
add ebx, 0x80
push ebx
push dword [ebp + 8]
call fcn.0040d092
add esp, 0x10
xor eax, eax
inc eax
jmp 0x409e85
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x409e8a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x415e80]
jne 0x409e94
repz ret
jmp fcn.0040d0be
Function at 0x40a3c0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x40a3d3
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40a3cf
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x40a3f0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
or esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x40a42f
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x40a425
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x40a431
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x40a415
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40a7f7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00405e0f
xor ebx, ebx
cmp dword [0x4167ac], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40a8ce
push 0x402c94
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x40a839
xor eax, eax
jmp 0x40a992
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402c88
push edi
call esi
cmp eax, ebx
je 0x40a832
push eax
call fcn.00405da9
mov dword [esp], 0x402c78
push edi
mov dword [0x4167ac], eax
call esi
push eax
call fcn.00405da9
mov dword [esp], 0x402c64
push edi
mov dword [0x4167b0], eax
call esi
push eax
call fcn.00405da9
mov dword [0x4167b4], eax
lea eax, [ebp - 8]
push eax
call fcn.00405038
test eax, eax
pop ecx
pop ecx
je 0x40a89c
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00407681
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40a8ce
push 0x402c48
push edi
call esi
push eax
call fcn.00405da9
cmp eax, ebx
pop ecx
mov dword [0x4167bc], eax
je 0x40a8ce
push 0x402c30
push edi
call esi
push eax
call fcn.00405da9
pop ecx
mov dword [0x4167b8], eax
mov eax, dword [0x4167b8]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40a947
cmp dword [0x4167bc], esi
je 0x40a947
push eax
call fcn.00405e18
pop ecx
call eax
cmp eax, ebx
je 0x40a914
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4167bc]
call fcn.00405e18
pop ecx
call eax
test eax, eax
je 0x40a914
test byte [ebp - 0x18], 1
jne 0x40a947
lea eax, [ebp - 0xc]
push eax
call fcn.00405074
test eax, eax
pop ecx
je 0x40a92f
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00407681
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40a93e
or dword [ebp + 0x10], 0x200000
jmp 0x40a978
or dword [ebp + 0x10], 0x40000
jmp 0x40a978
mov eax, dword [0x4167b0]
cmp eax, esi
je 0x40a978
push eax
call fcn.00405e18
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40a978
mov eax, dword [0x4167b4]
cmp eax, esi
je 0x40a978
push dword [ebp - 4]
push eax
call fcn.00405e18
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x4167ac]
call fcn.00405e18
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40d0be
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
add esp, 0xfffffcd8
mov dword [0x416998], eax
mov dword [0x416994], ecx
mov dword [0x416990], edx
mov dword [0x41698c], ebx
mov dword [0x416988], esi
mov dword [0x416984], edi
mov word [0x4169b0], ss
mov word [0x4169a4], cs
mov word [0x416980], ds
mov word [0x41697c], es
mov word [0x416978], fs
mov word [0x416974], gs
pushfd
pop dword [0x4169a8]
mov eax, dword [ebp]
mov dword [0x41699c], eax
mov eax, dword [ebp + 4]
mov dword [0x4169a0], eax
lea eax, [ebp + 8]
mov dword [0x4169ac], eax
mov eax, dword [ebp - 0x320]
mov dword [0x4168e8], 0x10001
mov eax, dword [0x4169a0]
mov dword [0x4168a4], eax
mov dword [0x416898], 0xc0000409
mov dword [0x41689c], 1
mov eax, dword [0x415e80]
mov dword [ebp - 0x328], eax
mov eax, dword [0x415e84]
mov dword [ebp - 0x324], eax
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x402ce0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret
Function at 0x40e73d
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x415e80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
xor edi, edi
push eax
mov dword [ebp - 0xc], edi
call fcn.00405038
test eax, eax
pop ecx
je 0x40e772
push edi
push edi
push edi
push edi
push edi
call fcn.00407681
add esp, 0x14
push 4
pop eax
call fcn.0040e8a0
mov dword [ebp - 0x14], esp
push 0x1c
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
or eax, eax
je 0x40e880
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x58]
dec esi
neg esi
sbb esi, esi
and esi, 0x103
inc esi
cmp dword [ebp - 0xc], 2
mov dword [ebp - 8], edi
jne 0x40e7f9
push 0x402c14
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, edi
je 0x40e7f9
push 0x402ce8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x40e7f9
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 0x10], edi
call eax
cmp eax, 1
jne 0x40e7f9
mov eax, dword [ebp - 0x10]
cmp eax, edi
jbe 0x40e7f9
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea edi, [ebx - 1]
push edi
push dword [ebp - 8]
call fcn.00405746
add esp, 0xc
test eax, eax
jl 0x40e880
not edi
and dword [ebp - 8], edi
je 0x40e82b
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp - 8]
call fcn.00405746
add esp, 0xc
test eax, eax
jl 0x40e880
lea eax, [ebx + ebx]
cmp dword [ebp - 8], eax
jae 0x40e836
mov dword [ebp - 8], eax
lea edi, [ebx - 1]
not edi
and edi, dword [ebp - 0x14]
sub edi, dword [ebp - 8]
cmp dword [ebp - 0xc], 1
jne 0x40e84a
push 0x11
pop ebx
mov eax, dword [ebp - 0x18]
add ebx, eax
cmp edi, ebx
jb 0x40e880
push 4
push 0x1000
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x40e880
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x40e880
xor eax, eax
inc eax
jmp 0x40e882
xor eax, eax
lea esp, [ebp - 0x68]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409e8a
leave
ret
Function at 0x410280
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x60
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov byte [esp + 0x57], 0xde
mov dl, byte [esp + 0x57]
mov dh, dl
sub dh, 0xfa
mov byte [esp + 0x4f], dh
mov si, word [esp + 0x54]
add dl, 0xb3
mov byte [esp + 0x42], dl
mov edi, dword [esp + 0x50]
mov byte [esp + 0x43], 0xde
cmp byte [esp + 0x42], 0xe0
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ecx
mov word [esp + 0x1e], si
mov dword [esp + 0x18], edi
jae 0x4103b1
mov eax, dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x34], ecx
mov edx, dword [esp + 0x34]
mov dword [esp + 0x38], edx
mov si, word [esp + 0x1e]
test si, si
mov edx, dword [esp + 0x2c]
mov word [esp + 0x54], si
cmp edx, 0
jne 0x410307
jmp 0x4103d4
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.00411c00
xor ecx, ecx
add ecx, 0x18
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
add eax, ecx
mov ecx, dword [esp + 0x28]
movzx ecx, word [ecx + 0x14]
add eax, ecx
mov dword [esp + 0x48], eax
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
movzx ecx, word [ecx + 6]
cmp eax, ecx
jge 0x4103b1
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x48]
add eax, dword [ecx + 0xc]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x18]
add edx, 0x59d8
mov ecx, dword [ecx + 0x14]
mov eax, dword [eax + 0x10]
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x50], edx
mov edx, dword [esp + 0x3c]
add esi, ecx
mov dword [esp], edx
mov dword [esp + 4], esi
mov dword [esp + 8], eax
call fcn.00410120
mov dword [esp + 0x14], eax
mov al, 0x9f
cmp al, byte [esp + 0x43]
jae 0x4103d4
mov eax, dword [esp + 0x30]
add eax, 1
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x48]
add eax, 0x28
mov dword [esp + 0x48], eax
jmp 0x410338
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov eax, dword [eax + 0x54]
mov edx, dword [esp + 0x38]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00410120
mov dword [esp + 0x10], eax
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
Function at 0x411aa0
Capabilities:
Encode data using xor
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [ebp + 8]
mov word [esp + 0x32], 0x6b9c
mov ecx, dword [esp + 0x20]
mov edx, ecx
and edx, 0x5aa9
mov dword [esp + 0x20], edx
mov byte [esp + 0x1f], 0x17
mov bl, byte [esp + 0x1f]
add bl, 0x92
mov edx, ecx
xor edx, 0x9d3
mov dword [esp + 0x20], edx
mov byte [esp + 0xf], bl
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
mov dword [esp], ecx
jne 0x411afb
mov dword [esp + 0x10], 0
jmp 0x411bf4
jmp 0x411afd
mov al, byte [esp + 0x1f]
xor al, 0x8d
cmp byte [esp + 0xf], al
je 0x411afd
mov eax, dword [esp + 4]
mov cx, word [eax]
mov eax, dword [esp]
add eax, 0x55fb
movzx edx, cx
mov dword [esp + 0x20], eax
cmp edx, 0x5a4d
jne 0x411b90
mov eax, 0x7936
mov ecx, dword [esp + 4]
mov dword [esp + 0x18], ecx
mov dword [esp + 8], 0x56b
cmp eax, dword [esp + 8]
jbe 0x411b90
mov eax, dword [esp + 0x18]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0x3f6a
mov ecx, dword [esp + 4]
mov eax, dword [eax + 0x3c]
mov eax, dword [ecx + eax]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x28], 0xffffc095
mov ecx, dword [esp]
or ecx, 0x2f71
mov dword [esp + 0x20], ecx
cmp eax, 0x4550
jne 0x411b8e
mov eax, dword [esp + 4]
mov dword [esp + 0x10], eax
jmp 0x411bf4
jmp 0x411b90
mov eax, dword [esp + 4]
mov word [esp + 0x1c], 0x5a52
mov cx, word [esp + 0x32]
xor cx, 0x36ae
mov byte [esp + 0x27], 0xd1
mov dx, word [esp + 0x1c]
mov dword [esp + 0x14], eax
cmp cx, dx
jb 0x411bca
mov eax, dword [esp + 0x14]
sub eax, 0x1000
and eax, 0xfffff000
mov dword [esp + 4], eax
mov al, 1
test al, 1
jne 0x411afd
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
add eax, 0x2c34
adc ecx, 0
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x10]
lea esp, [ebp - 4]
pop ebx
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401452
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
xor eax, eax
push 3
inc eax
call fcn.00401392
cmp byte [0x403366], 0
jne 0x401534
push ebx
push edi
mov ebx, 0x403366
push ebx
push str.VisualFoxProRuntime.9
call fcn.004012d8
test eax, eax
mov edi, dword [sym.imp.MSVCR71.dll__access]
je 0x4014a5
push 0
push ebx
call edi
test eax, eax
pop ecx
pop ecx
je 0x4014a5
mov byte [0x403366], 0
jmp 0x401528
cmp byte [0x403366], 0
jne 0x401532
push 0x104
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x40151f
add eax, 0xc
cmp eax, 0x105
jg 0x40151f
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x4020e8
lea eax, [ebp - 0x118]
push eax
call esi
push 3
call fcn.00401037
push eax
lea eax, [ebp - 0x118]
push eax
call esi
lea eax, [ebp - 0x118]
push 0
push eax
call edi
test eax, eax
pop ecx
pop ecx
pop esi
jne 0x40151f
push 1
lea eax, [ebp - 0x118]
push eax
mov edx, 0x106
mov ecx, ebx
call section..text
cmp byte [0x403366], 0
jne 0x401532
xor eax, eax
inc eax
push 3
call fcn.00401392
pop edi
pop ebx
leave
ret

Function at 0x407ef0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xffffffef
out dx, eax
cmp dword [ebp + 0x10], 0x4f
jl 0x407f03
mov dword [ebp + 0x10], 0xb9
or eax, dword [ebp + 8]
fcomp qword [0x2940c230]
mov ecx, dword [ebp + 0x18]
add cl, byte [ebx + 0x3356205d]
pop ds
push edi
fnstsw ax
mov dword [ebp - 4], esi
mov dword [ecx], esi
add ah, al
add eax, 0xe7afb8b
fld qword [ebp + 8]
push cs
loopne 0x407f8a
pop ebp
je 0x407ef5
add dword [ecx], eax
add byte [eax], al
push 0xffffffffffffff8b
dec ebp
or al, 0x8b
push ebp
or byte [ebp + 0x5150ec45], cl
push edx
call dword [0x66c118]
imul ebx, dword [ebp + 8], 0xdcec45dd
sbb eax, 0x40c230
add edi, 0xc
fnstsw ax
dec eax
invalid
add ch, bl
pop ebp
pop edx
daa
inc ebp
hlt

Function at 0x40b580
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, 0x8153c0e8
mov cl, 0x17
rcr dword [edx - 0x75], 0x12

Function at 0x40b744
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x40b78d
xor ebx, ebx
mov eax, dword fs:[ebx + 0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
mov ebp, dword [eax + 8]
pop esi
push bx
push 0x3233
push 0x5f327377
push esp
mov cx, 0x6072
call esi
xchg ebp, eax
push ebx
push ebx
push ebx
push ebx
push ebx
inc ebx
push ebx
inc ebx
push ebx
mov edi, esp
sub di, 0x208
push edi
push ebx
mov cx, 0xdfe7
call esi
mov cx, 0x6fa8
call esi
xchg edi, eax
push 0x7b00
push bx
mov ecx, esp
push 0x10
push ecx
push edi
mov cx, 0x3b80
call esi
push ebx
push edi
mov cx, 0x4975
call esi
push esp
push esp
push esp
push edi
mov cx, 0x4c32
call esi
xchg edi, eax
push eax
mov cx, LocalFree
call esi
mov ecx, esp
push eax
mov ah, 0xc
push eax
push ecx
push edi
push ecx
mov cx, 0x38c0
jmp esi
Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..reloc
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x71f17e9f
nop
nop
nop
nop
test eax, eax
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..rdata
nop
nop
mov ebx, 0x42f314
mov ecx, 0x18fd4c3e
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx