joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418070
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 2
mov esi, ecx
mov dword [0x420e6c], 0
push 1
push esi
mov dword [0x420e68], 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x4181e0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [0x420e6c], eax
test eax, eax
je 0x4181e5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [0x420e64], eax
test eax, eax
je 0x4181eb
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, 0x28
jbe 0x4181eb
mov esi, dword [0x420e64]
cmp dword [esi], 0x28
jne 0x4181eb
mov eax, dword [esi + 4]
movzx ecx, word [esi + 0xe]
mov dword [0x420e60], eax
mov eax, dword [esi + 8]
mov dword [0x420e5c], eax
cmp ecx, 0x18
jne 0x41810c
mov dword [ebp - 4], 0
jmp 0x418126
cmp dword [esi + 0x20], 0
je 0x418118
movzx eax, word [esi + 0x20]
jmp 0x418123
mov eax, 1
shl ax, cl
movzx eax, ax
mov dword [ebp - 4], eax
movzx eax, word [esi + 0xe]
cmp eax, 4
je 0x41813f
cmp eax, 8
jne 0x4181cf
mov edi, 0x100
jmp 0x418144
mov edi, 0x10
push ebx
lea eax, [edi*4 + 8]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x4181c8
mov word [ebx + 2], di
mov eax, 0x300
mov word [ebx], ax
test edi, edi
jle 0x4181a2
lea ecx, [ebx + 5]
lea edx, [esi + 0x29]
jmp 0x418180
movzx eax, byte [edx + 1]
lea edx, [edx + 4]
mov byte [ecx - 1], al
lea ecx, [ecx + 4]
movzx eax, byte [edx - 4]
mov byte [ecx - 4], al
movzx eax, byte [edx - 5]
mov byte [ecx - 3], al
mov byte [ecx - 2], 0
dec edi
jne 0x418180
push ebx
call dword [sym.imp.GDI32.dll_CreatePalette]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push ebx
mov dword [0x420e68], eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov esi, dword [0x420e64]
pop ebx
mov eax, dword [ebp - 4]
movzx eax, ax
add eax, 0xa
lea eax, [esi + eax*4]
mov dword [0x420e70], eax
mov eax, dword [0x420e6c]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push dword [0x420e6c]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov dword [0x420e6c], 0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4cae90
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x88000]
push edi
jmp 0x4caeaa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4caeb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4caea0
mov eax, 1
add ebx, ebx
jne 0x4caec3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4caed4
jne 0x4caef3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4caef3
dec eax
add ebx, ebx
jne 0x4caee0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4caeb8
add ebx, ebx
jne 0x4caeef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4caf45
xor ecx, ecx
sub eax, 3
jb 0x4caf0b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4caf7a
sar eax, 1
mov ebp, eax
jmp 0x4caf16
add ebx, ebx
jne 0x4caf16
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4caee4
inc ecx
add ebx, ebx
jne 0x4caf24
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4caee4
add ebx, ebx
jne 0x4caf31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4caf26
jne 0x4caf42
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4caf26
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4caf64
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4caf56
jmp 0x4caea6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4caf64
add edi, ecx
jmp 0x4caea6
pop esi
mov edi, esi
mov ecx, 0x379b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4caf82
cmp byte [edi], 0x13
jne 0x4caf82
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4caf87
lea edi, [esi + 0xc6000]
mov eax, dword [edi]
or eax, eax
je 0x4cafff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xe4250]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xe43a4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4cafb4
mov ecx, edi
jns 0x4cafe3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xe43a8]
or eax, eax
je 0x4caff9
mov dword [ebx], eax
add ebx, 4
jmp 0x4cafd1
call dword [esi + 0xe43b8]
mov ebp, dword [esi + 0xe43ac]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4cb033
sub esp, 0xffffff80
jmp 0x4165c1
Function at 0x402e00
Capabilities:
Persist via run registry key

Disassembly:
sub esp, 0x8c
lea eax, [esp + 8]
push esi
lea ecx, [esp + 8]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov dword [esp + 0x24], 0
push 0x80000001
mov dword [esp + 0x28], 0x80
call dword [section.v59d1hje]
mov ecx, dword [esp + 8]
lea edx, [esp + 4]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push str.Desktop
push ecx
call dword [fcn.00404004]
mov edx, dword [esp + 8]
push edx
call dword [fcn.00404008]
mov esi, dword [esp + 0x94]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.0040370a
mov eax, esi
pop esi
add esp, 0x8c
ret

Function at 0x402ff0
Capabilities:
Persist via run registry key

Disassembly:
sub esp, 0x10c
push ebx
push esi
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
mov dword [esp + 0x10], 0x100
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
lea ecx, [esp + 0xc]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call dword [section.v59d1hje]
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
push 0
push 0
push str.Favorites
push ecx
call dword [fcn.00404004]
mov edx, dword [esp + 0xc]
push edx
call dword [fcn.00404008]
mov edi, 0x406208
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x18]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x124]
mov ecx, ebx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x124]
lea edx, [esp + 0x1c]
push ecx
push edx
call fcn.00402e90
add esp, 0xc
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
Function at 0x4032f0
Capabilities:
Persist via run registry key

Disassembly:
sub esp, 0x10c
push ebx
push esi
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
mov dword [esp + 0x10], 0x100
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
lea ecx, [esp + 0xc]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call dword [section.v59d1hje]
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
push 0
push 0
push str.AppData
push ecx
call dword [fcn.00404004]
mov edx, dword [esp + 0xc]
push edx
call dword [fcn.00404008]
mov edi, str.MicrosoftInternet_ExplorerQuick_Launch_
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x18]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x124]
mov ecx, ebx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x124]
lea edx, [esp + 0x1c]
push ecx
push edx
call fcn.00402e90
add esp, 0xc
pop edi
pop esi
pop ebx
add esp, 0x10c
ret

Function at 0x4033f0
Capabilities:
Persist via run registry key

Disassembly:
sub esp, 8
lea eax, [esp + 4]
lea ecx, [esp]
push ebx
push esi
push edi
push eax
mov esi, dword [section.v59d1hje]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call esi
mov edi, dword [0x40400c]
mov ebx, dword [fcn.00404008]
test eax, eax
jne 0x403442
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
push edx
push eax
call edi
mov ecx, dword [esp + 0xc]
push ecx
call ebx
lea edx, [esp + 0x10]
lea eax, [esp + 0xc]
push edx
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call esi
test eax, eax
jne 0x40347c
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0xc]
push ecx
push edx
call edi
mov eax, dword [esp + 0xc]
push eax
call ebx
lea ecx, [esp + 0x18]
call fcn.00403710
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x4045a4
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
call fcn.00404639
pushal
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov ebp, esp
movzx ecx, word [edx + 0x26]
mov esi, dword [edx + 0x28]
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x4045cb
sub al, 0x20
ror edi, 0xd
add edi, eax
dec ecx
jne 0x4045c2
push edx
push edi
mov edx, dword [edx + 0x10]
mov eax, dword [edx + 0x3c]
add eax, edx
mov eax, dword [eax + 0x78]
test eax, eax
je 0x404630
add eax, edx
mov ebx, dword [eax + 0x20]
add ebx, edx
push eax
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x40462f
xor edi, edi
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edx
xor eax, eax
ror edi, 0xd
lodsb al, byte [esi]
add edi, eax
cmp al, ah
jne 0x4045fb
add edi, dword [ebp - 8]
cmp edi, dword [ebp + 0x24]
jne 0x4045ef
pop eax
mov ebx, dword [eax + 0x24]
add ebx, edx
mov cx, word [ebx + ecx*2]
mov ebx, dword [eax + 0x1c]
add ebx, edx
mov eax, dword [ebx + ecx*4]
add eax, edx
mov dword [esp + 0x24], eax
pop ebx
pop ebx
popal
pop ecx
pop edx
push ecx
jmp eax
pop eax
pop edi
pop edx
mov edx, dword [edx]
jmp 0x4045b9
Function at 0x401661
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push eax
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
push ecx
mov ecx, dword [eax + 2]
mov dword [ebp - 4], ecx
pop ecx
add esp, 4
pop ebp
ret

Function at 0x479f20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6d000]
push edi
jmp 0x479f3a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x479f41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x479f30
mov eax, 1
add ebx, ebx
jne 0x479f53
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x479f64
jne 0x479f83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x479f83
dec eax
add ebx, ebx
jne 0x479f70
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x479f48
add ebx, ebx
jne 0x479f7f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x479fd5
xor ecx, ecx
sub eax, 3
jb 0x479f9b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x47a00a
sar eax, 1
mov ebp, eax
jmp 0x479fa6
add ebx, ebx
jne 0x479fa6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x479f74
inc ecx
add ebx, ebx
jne 0x479fb4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x479f74
add ebx, ebx
jne 0x479fc1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x479fb6
jne 0x479fd2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x479fb6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x479ff4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x479fe6
jmp 0x479f36
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x479ff4
add edi, ecx
jmp 0x479f36
pop esi
mov edi, esi
mov ecx, 0x91a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x47a012
cmp byte [edi], 9
jne 0x47a012
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x47a017
lea edi, [esi + 0x77000]
mov eax, dword [edi]
or eax, eax
je 0x47a08f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xd5a1c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xd5afc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x47a044
mov ecx, edi
jns 0x47a073
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xd5b04]
or eax, eax
je 0x47a089
mov dword [ebx], eax
add ebx, 4
jmp 0x47a061
call dword [esi + 0xd5b00]
mov ebp, dword [esi + 0xd5b08]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x17f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x47a0c3
sub esp, 0xffffff80
jmp 0x41382f
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
push ebx
pcmpeqw mm7, mm7
push ecx
pxor mm6, mm6
push esi
psllw mm7, 0xf
push edi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
sub eax, 4
jl 0x401089
jmp 0x401030
movq mm0, qword [esi]
pxor mm0, mm7
movq mm3, mm0
movq mm1, qword [ebx + esi]
punpcklwd mm0, mm6
pxor mm1, mm7
movq mm2, qword [esi + ebx*2]
movq mm4, mm1
pxor mm2, mm7
add edi, 0x10
prefetcht0 byte [esi + ebx*2 + 0x40]
punpcklwd mm1, mm6
movq mm5, mm2
punpcklwd mm2, mm6
paddd mm1, mm1
punpckhwd mm3, mm6
paddd mm0, mm2
punpckhwd mm4, mm6
paddd mm0, mm1
punpckhwd mm5, mm6
paddd mm4, mm4
paddd mm3, mm5
paddd mm3, mm4
movq qword [edi - 0x10], mm0
add esi, 8
sub eax, 4
movq qword [edi - 8], mm3
jge 0x401030
add eax, 4
jle 0x4010be
push edx
movzx ecx, word [esi]
xor ecx, 0x8000
movzx edx, word [ebx + esi]
xor edx, 0x8000
add edx, edx
add ecx, edx
movzx edx, word [esi + ebx*2]
xor edx, 0x8000
add ecx, edx
add esi, 2
mov dword [edi], ecx
add edi, 4
dec eax
jg 0x40108f
pop edx
pop edi
pop esi
pop ecx
pop ebx
ret

Function at 0x417e10
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, 0x190
push edi
mov ebx, esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
mov eax, dword [0x634b9c]
push eax
call dword [sym.imp.ole32.dll_RevokeDragDrop]
mov ecx, dword [0x631038]
mov ebp, dword [0x63103c]
mov dword [esp + 0x2c], 0
sub al, 0
add byte [eax], al
add byte [ebp - 0x72dbdbbc], cl
adc al, 9
Function at 0x629a59
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x631450
cmp edx, dword [eax]
je 0x629a7b
add eax, 8
inc ecx
cmp eax, 0x6314e0
jl 0x629a6c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x631450]
jne 0x629ba9
mov eax, dword [0x635de0]
cmp eax, 1
je 0x629b83
test eax, eax
jne 0x629aac
cmp dword [0x63137c], 1
je 0x629b83
cmp edx, 0xfc
je 0x629ba9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x629ae3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0062a440
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0062a8d0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x629b26
lea eax, [ebp - 0x1a4]
push eax
call fcn.0062a8d0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62e8bc
push edi
call fcn.0062c7a0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0062a440
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0062a450
lea eax, [ebp - 0xa0]
push 0x62e89c
push eax
call fcn.0062a450
push dword [esi + 0x631454]
lea eax, [ebp - 0xa0]
push eax
call fcn.0062a450
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062c714
add esp, 0x2c
pop edi
jmp 0x629ba9
lea eax, [ebp + 8]
lea esi, [esi + 0x631454]
push 0
push eax
push dword [esi]
call fcn.0062a8d0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x403fe1
Capabilities:
Query environment variable

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x40401d
cmp dword [esp + 0xc], 0
je 0x40401d
push 0x25
push esi
call fcn.0040434e
pop ecx
test eax, eax
pop ecx
je 0x404011
push 0x103
push dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
pop esi
ret
push esi
push dword [esp + 0x10]
call fcn.0040421e
pop ecx
pop ecx
pop esi
ret

Function at 0x4044a9
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x4044d2
mov al, byte [esi + 1]
inc esi
test al, al
je 0x4044ca
cmp al, 0x22
jne 0x4044be
cmp byte [esi], 0x22
jne 0x4044dc
inc esi
jmp 0x4044dc
cmp al, 0x20
jle 0x4044dc
inc esi
cmp byte [esi], 0x20
jg 0x4044d6
mov al, byte [esi]
test al, al
je 0x4044e6
cmp al, 0x20
jle 0x4044cf
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00404556
push 0x406004
push section..data
call fcn.0040453c
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x404516
movzx eax, word [ebp - 0x14]
jmp 0x404519
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.0040456e
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x407e30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407f09
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407e68
mov eax, dword [ebp - 4]
call fcn.00407220
jmp 0x407e70
mov eax, dword [ebp - 4]
call fcn.00407c1c
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407ebc
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407ea6
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.00407220
jmp 0x407eb8
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407c1c
inc ebx
dec esi
jne 0x407e80
push 1
push dword [ebp - 4]
push 0x407f20
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f84
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407f10
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x4024cf
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x405028]
jne 0x4024d9
repz ret
jmp fcn.00402918
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
mov ecx, 0x173e3fd0
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
mov ecx, 0x403e77f5
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x417ac2
Capabilities:
Encode data using xor

Disassembly:
shr byte [edx + 0x75cf15c8], cl
fcmovbe st(0), st(0)
inc edi
sub byte [ecx], ah
imul esp, dword [eax - 0x66], 0xffffff8d
cmc
outsd dx, dword [esi]
sbb bx, word [esi + 0x1e]
dec eax
mov ecx, 0xc141ad26
pop esp
bound esp, qword [eax]
outsb dx, byte [esi]
in al, 0x50
and byte [esi - 0x4a], bh
in eax, 0xb1
in eax, dx
cmp eax, 0xd3a21311
xor dh, byte [ebx]
out dx, al
mov al, byte [0xa1bd267b]
test dword [0x2ba6265a], esi
je 0x417acb
push 0xffffffffffffffbd
add edx, edx
and bh, byte [eax + esi*2 - 0x30b1b4b5]
mov byte [esi - 0x6a08947d], bh
xor dl, byte [ebx]
pop ds
adc ebx, dword [edi]
add al, 0x41
sahf
sal esi, 0xd
xor dword [ecx + 0x3c], 0xffffff99
add eax, 0x82462e9e
test dword [edx - 0x76], ecx
jae 0x417b76
push edx
imul ecx, dword [ebx + 0x5f], 0x9228203c
mov ebp, 0x87e8e08d
dec ecx
loopne 0x417b52
mov byte [0x5e1e4a8], al
int 0xf1
mov esp, 0x69638fe3
dec ebx
and dword [edi + 0xa], edx
invalid
inc edi
vmptrld qword [ebx - 0x47]
jae 0x417b10
invalid
sti
loop 0x417ba8
jg 0x417b55
les eax, [ebx - 0x12]
arpl word [ebx], bx
push eax
mov eax, dword [ebx + esi*4 - 0x671c743]
add dword [edi + edx*2], edi
push esp
mov bh, 0x5a
adc byte [ebp + 0x45], 0x78
mov ecx, 0x2eed521e
jb 0x417bb4
les eax, ss:[eax]
invalid
fnstenv [ecx - 0x62]
and edx, esp
sahf
push ecx
mov edx, 0x79b94f7b
inc byte [edx]
inc ebx
shr byte [ebx + 0x2478a9c5], 1
adc ebx, ecx
outsd dx, dword [esi]
mov edx, 0x1b11c455
insb byte es:[edi], dx
adc bh, bl
lock and dword [ebx + 0x3f], eax
loopne 0x417be7
rcr edi, 0xaf
movsb byte es:[edi], byte [esi]
xchg dword [eax], ebx
inc esi
xor eax, 0xa8d51dcf
push ss
xor eax, 0x8d5eb626
jecxz 0x417b88
stosb byte es:[edi], al
sbb ecx, dword [eax + 0x6f]
salc
push dword [ebx]
jne 0x417be6
and al, 0xf3
and ebp, edi
cmp byte [ecx], al
push eax
inc dword [edi]
pop ebp
mov ss, word [ecx + 0x2a]
and dh, bl
out dx, eax
pop ds
fist word [ecx + ecx + 0x1bcfb64a]
imul ebp, dword [ecx + esi*4 + 0x37], 0xffffff8a
cmp eax, 0x29e4c9c0
mov dh, 0xcf
sbb ebp, dword [ebx + 0x6c]
mov cl, 0x37
mov bh, byte [0x29e4c9c0]
lodsd eax, dword [esi]
jns 0x417c02
aam 0x7f
add byte [eax], 0xd2
into
dec edi
insd dword es:[edi], dx
cmp eax, 0x315f90c5
jmp 0x456ce7cd

Function at 0x45cd86
Capabilities:
Encode data using xor

Disassembly:
push ebp
out 0x33, al
cmp byte [eax], 0x1e
push esp
xor edx, esi
jp 0x45cdd7
push ss
push cs
jns fcn.0045ce52
mov bh, 0x67
push ebx