joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4083fc
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
jmp 0x408431
mov ecx, dword [edx + 0xc]
cmp dword [ebp + 0xc], ecx
jb 0x40842e
mov eax, dword [edx + 8]
add eax, ecx
cmp dword [ebp + 0xc], eax
jb 0x40843a
add edx, 0x28
cmp edx, esi
jne 0x40841c
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x408437

Function at 0x408e92
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x408ed1
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x408ed1
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x408ed1
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x408ed1
cmp dword [ecx + 0x74], 0xe
jbe 0x408ed1
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x432072
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x735d6bd3
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x432060
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4320d2
nop
nop
nop
nop
nop
mov ebx, 0x42f314
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x4f5c5de2
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x994cdc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x994d03
call fcn.00937288
mov dword [eax], esi
call fcn.00937275
push 0x16
pop esi
mov dword [eax], esi
call fcn.00937eca
mov eax, esi
jmp 0x994d58
test dword [ebp + 0xc], 0xfffffff9
jne 0x994ce9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x994d30
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0093729b
pop ecx
call fcn.00937275
mov eax, dword [eax]
jmp 0x994d58
test al, 0x10
jne 0x994d56
test al, 1
je 0x994d56
test byte [ebp + 0xc], 2
je 0x994d56
call fcn.00937288
mov dword [eax], 5
call fcn.00937275
mov dword [eax], 0xd
jmp 0x994d27
xor eax, eax
pop esi
pop ebp
ret

Function at 0x408937
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 0x4085d8
mov edx, edx
call fcn.00408964
and ebx, ebx
add edx, 0x30cccf5a
xor dword [esi], eax
inc esi
sub edx, 0xb4a5e846
cmp esi, ecx
jne fcn.00408937
inc ebx
sub ebx, 0xd083cf3
ret
Function at 0x403418
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov cl, 0x22
mov al, byte [esi]
cmp al, cl
jne 0x403444
mov al, byte [esi + 1]
inc esi
cmp al, cl
je 0x40343d
test al, al
jne 0x403431
cmp byte [esi], cl
jne 0x40344e
inc esi
jmp 0x40344e
cmp al, 0x20
jle 0x40344e
inc esi
cmp byte [esi], 0x20
jg 0x403448
mov al, byte [esi]
test al, al
je 0x403458
cmp al, 0x20
jle 0x403441
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x18], 1
je 0x403472
movzx ebx, word [ebp - 0x14]
jmp 0x403475
push 0xa
pop ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
push 0
push 0
push edi
call fcn.00403d00
test eax, eax
je 0x4034da
call fcn.004034f0
test eax, eax
je 0x4034bd
push edi
push 1
call fcn.00403555
pop ecx
test eax, eax
pop ecx
je 0x4034bd
push 0
push str.This_Demo_of_LabWindows_CVI_has_expired.
push 0xc82698
call fcn.00403508
add esp, 0xc
or esi, 0xffffffff
jmp 0x4034d3
push ebx
push esi
push 0
push edi
call fcn.00404060
mov esi, eax
call fcn.00403c28
call fcn.00403c7f
call fcn.00403de4
jmp 0x4034dd
or esi, 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x403555
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push edi
push dword [ebp + 0xc]
xor ebx, ebx
mov byte [ebp - 1], bl
call esi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push eax
push dword [0xc826a8]
lea eax, [ebp - 0x12c]
push eax
call edi
mov eax, dword [ebp + 0xc]
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [str.CVIDEMOTIMERWNDCLASS__d__d]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], 0x403951
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
call fcn.00403909
cmp ax, bx
mov word [0x42a084], ax
je 0x4036a3
push ebx
mov eax, 0x80000000
push dword [ebp + 0xc]
push ebx
push ebx
push eax
push eax
push eax
push eax
mov eax, dword [str.CVIDEMOTIMERWNDCLASS__d__d]
push 0xcf0000
push eax
push eax
push ebx
call fcn.004038c7
cmp eax, ebx
je 0x4036a3
push ebx
push 0x927c0
push dword [0x42a090]
mov dword [0x42a08c], eax
push eax
call fcn.00403927
cmp eax, ebx
mov dword [0x42a090], eax
je 0x4036a3
cmp dword [ebp + 8], ebx
je 0x403646
call esi
push eax
lea eax, [ebp - 0x12c]
push 0xc826e4
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x12c]
push eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x4036a3
call esi
push eax
lea eax, [ebp - 0x12c]
push str.CVI_Demo_Last_Time_Timer_Called___d
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x12c]
push eax
push 4
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, ebx
mov dword [0x42a094], eax
je 0x4036a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x403689
mov byte [ebp - 1], 1
push ebx
push ebx
push ebx
push 2
push dword [0x42a094]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, ebx
mov dword [0x42a098], eax
jne 0x4036a8
push 1
pop eax
jmp 0x4036bc
cmp byte [ebp - 1], bl
je 0x4036ba
call fcn.004036c1
mov ecx, dword [0x42a098]
mov dword [ecx], eax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4036d8
Capabilities:
Check mutex on windows
Link many functions at runtime

Disassembly:
sub esp, 0x114
push ebx
xor ebx, ebx
cmp dword [0x42a0a0], ebx
push ebp
push esi
push edi
jne 0x4038ba
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [esp + 0x20]
push str.National_Instruments_LabWindows_CVI_Startup_library__d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
cmp esi, ebx
jne 0x403724
push 0xfffffffffffffffd
jmp 0x4038a1
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
or ebp, 0xffffffff
push ebp
push esi
call edi
cmp dword [0x42a09c], ebx
je 0x403752
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
push dword [0x42a09c]
call edi
jmp 0x403758
mov dword [0x42a09c], esi
cmp dword [0x42a0a0], ebx
jne 0x4038ba
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.winmm.dll
call esi
cmp eax, ebx
mov dword [esp + 0x14], eax
je 0x4037a4
push str.advapi32.dll
call esi
cmp eax, ebx
mov dword [esp + 0x10], eax
je 0x4037a4
push 0xc8276c
call esi
cmp eax, ebx
mov dword [esp + 0x18], eax
je 0x4037a4
push str.user32.dll
call esi
mov edi, eax
cmp edi, ebx
jne 0x4037ab
mov eax, ebp
jmp 0x4038bc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.timeGetTime
push dword [esp + 0x18]
call esi
cmp eax, ebx
mov dword [0x42a07c], eax
je 0x403884
push str.RegOpenKeyExA
push dword [esp + 0x14]
call esi
cmp eax, ebx
mov dword [0x42a070], eax
je 0x403884
push str.RegQueryValueExA
push dword [esp + 0x14]
call esi
cmp eax, ebx
mov dword [0x42a060], eax
je 0x403884
push str.GetFileTime
push dword [esp + 0x1c]
call esi
cmp eax, ebx
mov dword [0x42a068], eax
je 0x403884
push str.CreateWindowExA
push edi
call esi
cmp eax, ebx
mov dword [0x42a078], eax
je 0x403884
push str.DefWindowProcA
push edi
call esi
cmp eax, ebx
mov dword [0x42a064], eax
je 0x403884
push str.DestroyWindow
push edi
call esi
cmp eax, ebx
mov dword [0x42a074], eax
je 0x403884
push str.KillTimer
push edi
call esi
cmp eax, ebx
mov dword [0x42a080], eax
je 0x403884
push str.RegisterClassA
push edi
call esi
cmp eax, ebx
mov dword [0x42a058], eax
je 0x403884
push str.SetTimer
push edi
call esi
cmp eax, ebx
mov dword [0x42a05c], eax
je 0x403884
push str.UnregisterClassA
push edi
call esi
cmp eax, ebx
mov dword [0x42a06c], eax
jne 0x4038a4
push dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
call esi
push dword [esp + 0x10]
call esi
push dword [esp + 0x18]
call esi
push edi
call esi
push 0xfffffffffffffffe
pop eax
jmp 0x4038bc
push dword [0x42a09c]
mov dword [0x42a0a0], 1
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret
Function at 0x40a540
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x42a680]
push ebx
xor ebx, ebx
push esi
test eax, eax
push edi
je 0x40a562
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x40a5db
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x108]
push str.National_Instruments_Analysis_Library__d
push eax
call sub.cvirte.dll_sprintf
add esp, 0xc
lea ecx, [ebp - 0x108]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
jne 0x40a599
or ebx, 0xffffffff
jmp 0x40a5fa
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push esi
call edi
mov eax, dword [0x42a680]
test eax, eax
je 0x40a5c8
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x42a680]
push 0xffffffffffffffff
push edx
call edi
jmp 0x40a5db
push 0x40a670
mov dword [0x42a680], esi
call fcn.00403b58
add esp, 4
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
jne 0x40a5ed
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov edx, dword [0x42a680]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [ebp + 0xc]
xor eax, eax
test ebx, ebx
sete al
mov dword [ecx], eax
pop edi
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4038ca
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x4038f3
cmp al, 0x22
je 0x4038eb
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x4038df
cmp byte [esi], 0x22
jne 0x4038fd
inc esi
jmp 0x4038fd
cmp al, 0x20
jle 0x4038fd
inc esi
cmp byte [esi], 0x20
jg 0x4038f7
mov al, byte [esi]
test al, al
je 0x403907
cmp al, 0x20
jle 0x4038f0
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00403975
push 0x405004
push section..data
call fcn.0040395b
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x403937
movzx eax, word [ebp - 0x14]
jmp 0x40393a
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.0040398d
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x40894f
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop eax
sub ecx, 0xe6b847d8
or ecx, ecx
call fcn.0040897b
add ecx, edi
add edi, ecx
xor dword [ebx], eax
sub ecx, 1
inc ebx
inc edi
sub ecx, edi
cmp ebx, edx
jne fcn.0040894f
sub ecx, ecx
ret
Function at 0x403ad0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor eax, 0xffffffff
test ecx, ecx
mov esi, dword [ebp + 8]
je 0x403af9
xor al, byte [esi]
movzx edx, al
shr eax, 8
mov edx, dword [edx*4 + section..data]
inc esi
xor eax, edx
dec ecx
jne 0x403ae4
xor eax, 0xffffffff
pop esi
leave
ret 0xc

Function at 0x407a40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x407015
lea edi, [esi - 0x6015]
push edi
or ebp, 0xffffffff
jmp 0x407a62
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407a69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407a58
mov eax, 1
add ebx, ebx
jne 0x407a7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407a70
jne 0x407a8c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407a70
xor ecx, ecx
sub eax, 3
jb 0x407aa0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x407b12
mov ebp, eax
add ebx, ebx
jne 0x407aab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ab8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x407adc
inc ecx
add ebx, ebx
jne 0x407ac8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407abd
jne 0x407ad9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407abd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x407afc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x407aed
jmp 0x407a5e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x407afc
add edi, ecx
jmp 0x407a5e
pop esi
mov edi, esi
mov ecx, 0x40
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x407b1a
cmp byte [edi], 0
jne 0x407b1a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x407b1f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x407b8e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x70a0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x70f0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x407b4c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x70f4]
or eax, eax
je 0x407b88
mov dword [ebx], eax
add ebx, 4
jmp 0x407b69
call dword [esi + 0x70f8]
popal
jmp 0x401219
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43b004]
jne 0x401010
repz ret
jmp fcn.00401462

Function at 0x4061e5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004015da
and dword [ebp - 4], 0
cmp dword [0x43e494], 0
mov ebx, eax
jne 0x406296
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406347
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406347
push eax
call fcn.00401568
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43e494], eax
call esi
push eax
call fcn.00401568
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43e498], eax
call esi
push eax
call fcn.00401568
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43e49c], eax
call esi
push eax
call fcn.00401568
pop ecx
mov dword [0x43e4a4], eax
test eax, eax
je 0x406296
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00401568
pop ecx
mov dword [0x43e4a0], eax
mov eax, dword [0x43e4a0]
cmp eax, ebx
je 0x4062ee
cmp dword [0x43e4a4], ebx
je 0x4062ee
push eax
call fcn.004015e3
push dword [0x43e4a4]
mov esi, eax
call fcn.004015e3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4062ee
test edi, edi
je 0x4062ee
call esi
test eax, eax
je 0x4062e5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4062e5
test byte [ebp - 0xc], 1
jne 0x4062ee
or dword [ebp + 0x10], 0x200000
jmp 0x406327
mov eax, dword [0x43e498]
cmp eax, ebx
je 0x406327
push eax
call fcn.004015e3
pop ecx
test eax, eax
je 0x406327
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406327
mov eax, dword [0x43e49c]
cmp eax, ebx
je 0x406327
push eax
call fcn.004015e3
pop ecx
test eax, eax
je 0x406327
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43e494]
call fcn.004015e3
pop ecx
test eax, eax
je 0x406347
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406349
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433a30
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x804
mov eax, dword [0x43b004]
xor eax, esp
mov dword [esp + 0x800], eax
cmp dword [0x80f2b4], 0x114e
mov eax, dword [esp + 0x808]
mov dword [0x80f0f8], eax
jne 0x433a71
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0
lea ecx, [esp + 4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.00401006
add esp, 0x804
ret
Function at 0x433aa0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
push edi
cmp ebp, 0x182
jne 0x433ac7
push 0
push 0
push 0
push str.Fal_yusujucecimirijimamawi
push str.nalamediw_tevufefizibulecojivagojitimajive_cililarerakurehofehel
push 0
call dword [sym.imp.KERNEL32.dll_UpdateResourceA]
xor edi, edi
test ebp, ebp
jle 0x433b07
push esi
mov edi, edi
lea esi, [esp + 0xc]
mov dword [esp + 0x14], 5
mov dword [esp + 0xc], 0
call fcn.00433a90
mov eax, dword [esp + 0xc]
add eax, 0x46
mov dword [esp + 0x14], eax
nop
sub dword [esp + 0x14], 0x46
mov al, byte [esp + 0x14]
xor byte [edi + ebx], al
inc edi
cmp edi, ebp
jl 0x433ad0
pop esi
pop edi
cmp ebp, 0x2d
pop ebp
jne 0x433b22
mov dword [0x80f3e8], 0xa62e7790
mov dword [0x80f3ec], 0xffffffff
pop ecx
ret

Function at 0x433b30
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x43c010]
push ebx
mov ebx, dword [0x80f0fc]
push esi
mov esi, dword [0x80f2b4]
push eax
call fcn.00433a30
add esp, 4
cmp dword [0x80f2b4], 0x2f
jne 0x433b5b
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
push esi
call fcn.00433aa0
add esp, 4
cmp dword [0x80f2b4], 0x568
pop esi
pop ebx
jne 0x433b7a
push 0
call dword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointA]
ret
Function at 0x432037
Capabilities:
Encrypt data using rc4 prga

Disassembly:
ret 0xb2a0
xor eax, 0xa229f711
cmp dl, byte [0x91044768]
or al, 0xdd
nop
pop ebp
sub ecx, 6
nop
imul ebx, esi, 0xffffffba
dec edx
lodsb al, byte [esi]
jg 0x43205e
mov byte [0x21fe0926], al
cld
inc ecx
add esp, dword [ebp + 0x7c61ea7d]
inc esp
jl 0x4320a4
mov cl, 0x89
inc edi
fcom qword [eax]
das
or al, 0x6a
inc eax
invalid
sbb esp, dword [eax - 0x79]
loope 0x432029
in al, dx
imul ebx, esp, 0x22ae5206
dec esp
xchg esp, ecx
fldenv [ebx - 0x4ad8f5a0]
mov dh, 0x53
sbb dword [ecx - 0x1a], esp
cld
inc esp
invalid

Function at 0x47a307
Capabilities:
Encode data using xor

Disassembly:
sbb byte [eax + 0x69], 0x5e
ror edx, 0x8e
or eax, 0x7c204f67
cmp eax, 0x31ef2ce7
sub al, 0x6a
pop eax
imul ebx, dword [esi - 0x3f], 0x670d8eca
dec edi
and byte [ebp + edi - 0x19], bh
sub al, 0xef
xor dword [edx + ebp*2], ebp
inc ecx
jae 0x47a2f3
invalid
jmp 0x47a2f2
jmp 0x886117ff

Function at 0x4c6d25
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4d1390
cmp edx, dword [eax]
je 0x4c6d47
add eax, 8
inc ecx
cmp eax, 0x4d1420
jl 0x4c6d38
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4d1390]
jne 0x4c6e75
mov eax, dword [0x4d6dc0]
cmp eax, 1
je 0x4c6e4f
test eax, eax
jne 0x4c6d78
cmp dword [0x4d12bc], 1
je 0x4c6e4f
cmp edx, 0xfc
je 0x4c6e75
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4c6daf
lea eax, [ebp - 0x1a4]
push 0x4ccd48
push eax
call fcn.004c7710
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004c7ba0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4c6df2
lea eax, [ebp - 0x1a4]
push eax
call fcn.004c7ba0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4ccd44
push edi
call fcn.004c9a70
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4ccd28
push eax
call fcn.004c7710
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004c7720
lea eax, [ebp - 0xa0]
push 0x4ccd24
push eax
call fcn.004c7720
push dword [esi + 0x4d1394]
lea eax, [ebp - 0xa0]
push eax
call fcn.004c7720
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4cccfc
push eax
call fcn.004c99e4
add esp, 0x2c
pop edi
jmp 0x4c6e75
lea eax, [ebp + 8]
lea esi, [esi + 0x4d1394]
push 0
push eax
push dword [esi]
call fcn.004c7ba0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x6f2e2570
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f314
mov ecx, 0x8ce7e4f
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219