joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408d50
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x444c30]
jne 0x408d5a
repz ret
jmp fcn.0040b86c

Function at 0x40b037
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004051e7
and dword [ebp - 4], 0
cmp dword [0x445fc4], 0
mov ebx, eax
jne 0x40b0e8
push 0x402ab4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b199
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402aa8
push edi
call esi
test eax, eax
je 0x40b199
push eax
call fcn.00405175
mov dword [esp], 0x402a98
push edi
mov dword [0x445fc4], eax
call esi
push eax
call fcn.00405175
mov dword [esp], 0x402a84
push edi
mov dword [0x445fc8], eax
call esi
push eax
call fcn.00405175
mov dword [esp], 0x402a68
push edi
mov dword [0x445fcc], eax
call esi
push eax
call fcn.00405175
pop ecx
mov dword [0x445fd4], eax
test eax, eax
je 0x40b0e8
push 0x402a50
push edi
call esi
push eax
call fcn.00405175
pop ecx
mov dword [0x445fd0], eax
mov eax, dword [0x445fd0]
cmp eax, ebx
je 0x40b140
cmp dword [0x445fd4], ebx
je 0x40b140
push eax
call fcn.004051f0
push dword [0x445fd4]
mov esi, eax
call fcn.004051f0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b140
test edi, edi
je 0x40b140
call esi
test eax, eax
je 0x40b137
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b137
test byte [ebp - 0xc], 1
jne 0x40b140
or dword [ebp + 0x10], 0x200000
jmp 0x40b179
mov eax, dword [0x445fc8]
cmp eax, ebx
je 0x40b179
push eax
call fcn.004051f0
pop ecx
test eax, eax
je 0x40b179
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b179
mov eax, dword [0x445fcc]
cmp eax, ebx
je 0x40b179
push eax
call fcn.004051f0
pop ecx
test eax, eax
je 0x40b179
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x445fc4]
call fcn.004051f0
pop ecx
test eax, eax
je 0x40b199
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b19b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..reloc
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x1d774a4a
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x432024
mov eax, section..rdata
nop
mov ebx, 0x42f314
nop
mov ecx, 0xabe04ae
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x4073a0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov dword [0x8048d2e8], esi
sub al, 0xb0
sbb al, 0x32
jo 0x40741a
cmp byte [esp + 9], 0x82
je 0x40740a
nop
cmp eax, 0x505df94b
pop es
push esp
cmp al, 3
pushfd
add al, 0xb9
sub al, 0xf9
dec ecx
add dword [eax], esp
jne 0x4073dd
inc esp
cmp ecx, 0x26
cmp al, 0xf9
salc
adc ecx, dword [edx]
jmp 0x32807925
inc ebx
std
dec ebp
add dword [esp + esi*2], eax
ja 0x4073ed
dec eax
stc
imul eax, dword [eax], 4
push ecx
add byte [eax], 0x75
sub bl, byte [edx]
out 5, al
dec edx
stc
imul ecx, dword [edx], 0x97fcaa83
call 0xf4ae72a
add byte [ebp + 0x2a], dh
sbb ah, dh
add eax, 0xa69f94a
sub dword [edx + 0x2ae897fc], 0x73
or cl, byte [edi]
mov dh, 8
xor byte [esi - 0x40], dh
add bh, bh
and al, 0x85
lodsb al, byte [esi]
inc eax
or cl, dh
salc
or eax, dword [0x3349e964]
cmp al, 0xf
push edx
cmp eax, 0x4afdfbf
jae 0x40746e
mov edi, 0x7304afdf
dec esi
add eax, esp
inc ecx
pop esi
invalid
je 0x407485
or byte [edi + 2], 0xc4
inc ecx
je 0x407485
lcall 0xc826, 0x2b0a74d1
aas
mov edx, 0x5fc1aac1
xlatb
inc esp
push cs
mov bh, 0xf3
sub esi, dword [esi - 0x79]
mov dl, 0x7e
lea ecx, [ebx]
aaa
inc ecx
or byte [esi - 0x7b], dh
dec eax
xor al, 0xe
bound edi, qword [ebx]
je 0x40748c
mov dword [ebx + 0x5fdc92dc], ecx
or eax, eax
push ss
ret

Function at 0x4463f0
Capabilities:
Check for vm using instruction vpcext

Disassembly:
adc eax, 0xa280fcf
cmp dword [edi + 4], 0
ja 0x446421
xor eax, dword [eax + 0x3200c9dd]
ja 0x44641a
push edx
push ebp
clc
test dword [eax], eax
add al, 0x80
or dword [ebp - 0x5c], edi
sbb dword [edi - 0x5c], 0xffffff89
invalid
pop esi
jle 0x44645d
jns 0x446430
mov dl, 0x40
and byte [ecx], al
jbe 0x446434
sbb al, byte [eax]
cmp al, 0x58
sub byte [edi - 7], dh
add esp, ecx
test dh, dh
jg 0x44643d
inc edi
push edi
push ebx
enter 0x23f, 3
add byte [ebx + 0x6c40480], ah
les eax, [esi]
xor al, byte [eax]
retf 0x4407
add dword [eax + 0x2076ab22], esp
xchg ebp, eax
div byte [esi]
xor eax, 0xf8105e88
clc
add dword [esi + 0x10], 0x628e0f74
add al, 0x45
xor byte [eax + ebp*2 + 0x52], 0xe9
pop edi
and dword [0x4c0c332], esi
push edi
stosd dword es:[edi], eax
dec esi
aas
add dword [eax], 0xffffff8b
les eax, [ebx + eax*4]
inc ebp
test byte [eax], ah
add byte [eax], al
inc eax
mov byte [edi + 0x48], 0x48
jmp 0x446450

Function at 0x446a30
Capabilities:
Check for vm using instruction vpcext

Disassembly:
xor edi, dword [ebx + 0x7e]
xor al, 0x46
wait
inc edi
add al, 0xf2
invalid

Function at 0x45b600
Capabilities:
Encode data using xor

Disassembly:
inc esi
or byte [edx + 1], ch
cmp eax, dword [eax]
push ecx
inc dword [esp + ebp*4 - 0xb]
dec eax
pop eax
dec edi
pop esi
pop ebp
fiadd dword [ebx + 0xce438d4]
add byte [ebx - 0x7d95bfbb], cl
popfd
push esp
xor al, 0x3c
pop esi
push eax
push 0x22
aas
adc eax, 0x1ccddc5
invalid
xor eax, esp
cmp bl, 0xff
xor al, 0x35
push ebp
push esi
push edi
mov edi, dword [ecx + 0x2c]
xor bh, dl
test dword [edi + 0x6ba9a074], esi
adc ah, ch
jne 0x45b599
mov word [eax + 0x6180024], fs
add byte [eax + 0x1665526f], ah
mov esp, 0xfe107681
ret 0x8150
Function at 0x4830d0
Capabilities:
Encode data using xor

Disassembly:
jp 0x4830ee
dec eax
sbb byte [eax - 0x7bd7fcb3], al
cmpsd dword [esi], dword es:[edi]
invalid
xchg ecx, ecx
aam 0x2d

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130
Function at 0x704962be
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 8]
cdq
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
jmp 0x70496389
jmp 0x70496443
jmp 0x704964fd
jmp 0x704965b7
jmp 0x70496671
jmp 0x7049672b
jmp 0x704967e5
jmp 0x7049689f
jmp 0x70496959
jmp 0x70496a13
jmp 0x70496acd
jmp 0x70496b87
jmp 0x70496c41
jmp 0x70496cfb
jmp 0x70496db5
jmp 0x70496e6f
jmp 0x70496f29
jmp 0x70496fe3
jmp 0x7049709d
jmp 0x70497157
jmp 0x70497211
jmp 0x704972cb
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
jmp 0x7049738b
jmp 0x70497445
jmp 0x704974ff
jmp 0x704975b9
jmp 0x70497673
jmp 0x7049772d
jmp 0x704977e7
jmp 0x704978a1
jmp 0x7049795b
jmp 0x70497a15
jmp 0x70497acf
jmp 0x70497b89
jmp 0x70497c43
jmp 0x70497cfd
jmp 0x70497db7
jmp 0x70497e71
jmp 0x70497f2b
jmp 0x70497fe5
jmp 0x7049809f
jmp 0x70498159
jmp 0x70498213
jmp 0x704982cd
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x3c]
mov ecx, eax
mov ebx, eax
sar ebx, 0x1f
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x20], eax
jmp 0x704983a1
jmp 0x7049845b
jmp 0x70498515
jmp 0x704985cf
jmp 0x70498689
jmp 0x70498743
jmp 0x704987fd
jmp 0x704988b7
jmp 0x70498971
jmp 0x70498a2b
jmp 0x70498ae5
jmp 0x70498b9f
jmp 0x70498c59
jmp 0x70498d13
jmp 0x70498dcd
jmp 0x70498e87
jmp 0x70498f41
jmp 0x70498ffb
jmp 0x704990b5
jmp 0x7049916f
jmp 0x70499229
jmp 0x704992e3
mov eax, dword [ebp - 0x20]
add eax, 0x78
mov dword [ebp - 0x24], eax
jmp 0x704993a6
jmp 0x70499460
jmp 0x7049951a
jmp 0x704995d4
jmp 0x7049968e
jmp 0x70499748
jmp 0x70499802
jmp 0x704998bc
jmp 0x70499976
jmp 0x70499a30
jmp 0x70499aea
jmp 0x70499ba4
jmp 0x70499c5e
jmp 0x70499d18
jmp 0x70499dd2
jmp 0x70499e8c
jmp 0x70499f46
jmp 0x7049a000
jmp 0x7049a0ba
jmp 0x7049a174
jmp 0x7049a22e
jmp 0x7049a2e8
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov ecx, eax
mov ebx, 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x28], eax
jmp 0x7049a3bb
jmp 0x7049a475
jmp 0x7049a52f
jmp 0x7049a5e9
jmp 0x7049a6a3
jmp 0x7049a75d
jmp 0x7049a817
jmp 0x7049a8d1
jmp 0x7049a98b
jmp 0x7049aa45
jmp 0x7049aaff
jmp 0x7049abb9
jmp 0x7049ac73
jmp 0x7049ad2d
jmp 0x7049ade7
jmp 0x7049aea1
jmp 0x7049af5b
jmp 0x7049b015
jmp 0x7049b0cf
jmp 0x7049b189
jmp 0x7049b243
jmp 0x7049b2fd
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x1c]
mov ecx, eax
mov ebx, 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x2c], eax
jmp 0x7049b3d1
jmp 0x7049b48b
jmp 0x7049b545
jmp 0x7049b5ff
jmp 0x7049b6b9
jmp 0x7049b773
jmp 0x7049b82d
jmp 0x7049b8e7
jmp 0x7049b9a1
jmp 0x7049ba5b
jmp 0x7049bb15
jmp 0x7049bbcf
jmp 0x7049bc89
jmp 0x7049bd43
jmp 0x7049bdfd
jmp 0x7049beb7
jmp 0x7049bf71
jmp 0x7049c02b
jmp 0x7049c0e5
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x68353030
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x1f9f7ead
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x40ce09
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x422234]
jne 0x40ce13
repz ret
jmp fcn.00413639

Function at 0x413b7e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004104e0
and dword [ebp - 4], 0
cmp dword [0x423e1c], 0
mov ebx, eax
jne 0x413c2f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x413ce0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x413ce0
push eax
call fcn.0041046e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x423e1c], eax
call esi
push eax
call fcn.0041046e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x423e20], eax
call esi
push eax
call fcn.0041046e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x423e24], eax
call esi
push eax
call fcn.0041046e
pop ecx
mov dword [0x423e2c], eax
test eax, eax
je 0x413c2f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041046e
pop ecx
mov dword [0x423e28], eax
mov eax, dword [0x423e28]
cmp eax, ebx
je 0x413c87
cmp dword [0x423e2c], ebx
je 0x413c87
push eax
call fcn.004104e9
push dword [0x423e2c]
mov esi, eax
call fcn.004104e9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x413c87
test edi, edi
je 0x413c87
call esi
test eax, eax
je 0x413c7e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x413c7e
test byte [ebp - 0xc], 1
jne 0x413c87
or dword [ebp + 0x10], 0x200000
jmp 0x413cc0
mov eax, dword [0x423e20]
cmp eax, ebx
je 0x413cc0
push eax
call fcn.004104e9
pop ecx
test eax, eax
je 0x413cc0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x413cc0
mov eax, dword [0x423e24]
cmp eax, ebx
je 0x413cc0
push eax
call fcn.004104e9
pop ecx
test eax, eax
je 0x413cc0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x423e1c]
call fcn.004104e9
pop ecx
test eax, eax
je 0x413ce0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x413ce2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x5c80601e
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0xd1c5b2d
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x403250
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x407020]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
mov ebx, dword [esp + 0x114]
push esi
push edi
mov edi, dword [esp + 0x118]
push 0x103
lea eax, [esp + 0x11]
push 0
push eax
mov esi, ecx
mov byte [esp + 0x18], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
push edi
push 0x104
lea ecx, [esp + 0x14]
push ecx
push 0
push str.Path
push str.Redirect
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + 0xc]
test al, al
lea ecx, [esp + 0xc]
je 0x4032d2
lea esp, [esp]
cmp al, 0x20
je 0x4032c8
cmp al, 9
jne 0x403325
mov al, byte [ecx + 1]
add ecx, 1
test al, al
jne 0x4032c0
test ebx, ebx
je 0x40330b
mov esi, dword [esp + 0x120]
test esi, esi
jle 0x40330b
test edi, edi
je 0x40330b
mov eax, edi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4032f0
sub eax, edx
cmp eax, esi
jae 0x40330b
push edi
push esi
push ebx
call dword [sym.imp.MSVCR80.dll_strcpy_s]
add esp, 0xc
mov ecx, dword [esp + 0x110]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00403a3e
add esp, 0x108
ret 0xc
lea edx, [esp + 0xc]
push 0x3a
push edx
call dword [sym.imp.MSVCR80.dll__mbschr]
add esp, 8
test eax, eax
jne 0x403354
cmp byte [esp + 0xc], 0x5c
je 0x403354
push ebx
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x128]
call fcn.004036a0
jmp 0x40330b
mov ecx, dword [esp + 0x120]
push ecx
push ebx
lea edx, [esp + 0x14]
push edx
mov ecx, esi
call fcn.00403250
jmp 0x40330b

Function at 0x403a3e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x407020]
jne 0x403a48
repz ret
jmp fcn.00403eb4
Function at 0x4030a0
Capabilities:
Create mailslot

Disassembly:
push ecx
cmp dword [0x2b887dc], 3
jne 0x4030c6
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [esp], 0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
mov eax, dword [esp + 0xc]
xor dword [esp], eax
mov eax, dword [esp]
mov ecx, dword [esp + 8]
mov dword [ecx], eax
pop ecx
ret 0xc

Function at 0x4032f0
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, dword [0x2b887dc]
mov ecx, dword [0x2b88750]
sub esp, 0xc0c
push ebx
push ebp
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x403404
mov edi, dword [sym.imp.KERNEL32.dll_SetHandleCount]
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
cmp dword [0x2b887dc], 0x959
jne 0x4033ea
push 0
call edi
push 0
lea eax, [esp + 0x41c]
push eax
push 0
call ebx
push 0
push 0
call esi
push 0
call ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
push 0
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
push 0
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0x402d00
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0x402d10
push 0x402d24
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov edx, dword [esp + 0x10]
push edx
call fcn.00403110
add dword [esp + 0x10], 8
sub dword [esp + 0x14], 1
jne 0x403330
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc0c
ret
Function at 0x409930
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42fb70]
jne 0x40993a
repz ret
jmp fcn.0040b95c

Function at 0x40a303
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405e53
and dword [ebp - 4], 0
cmp dword [0x4319ac], 0
mov ebx, eax
jne 0x40a3b4
push 0x402bfc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a465
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402bf0
push edi
call esi
test eax, eax
je 0x40a465
push eax
call fcn.00405de1
mov dword [esp], 0x402be0
push edi
mov dword [0x4319ac], eax
call esi
push eax
call fcn.00405de1
mov dword [esp], 0x402bcc
push edi
mov dword [0x4319b0], eax
call esi
push eax
call fcn.00405de1
mov dword [esp], 0x402bb0
push edi
mov dword [0x4319b4], eax
call esi
push eax
call fcn.00405de1
pop ecx
mov dword [0x4319bc], eax
test eax, eax
je 0x40a3b4
push 0x402b98
push edi
call esi
push eax
call fcn.00405de1
pop ecx
mov dword [0x4319b8], eax
mov eax, dword [0x4319b8]
cmp eax, ebx
je 0x40a40c
cmp dword [0x4319bc], ebx
je 0x40a40c
push eax
call fcn.00405e5c
push dword [0x4319bc]
mov esi, eax
call fcn.00405e5c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a40c
test edi, edi
je 0x40a40c
call esi
test eax, eax
je 0x40a403
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a403
test byte [ebp - 0xc], 1
jne 0x40a40c
or dword [ebp + 0x10], 0x200000
jmp 0x40a445
mov eax, dword [0x4319b0]
cmp eax, ebx
je 0x40a445
push eax
call fcn.00405e5c
pop ecx
test eax, eax
je 0x40a445
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a445
mov eax, dword [0x4319b4]
cmp eax, ebx
je 0x40a445
push eax
call fcn.00405e5c
pop ecx
test eax, eax
je 0x40a445
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4319ac]
call fcn.00405e5c
pop ecx
test eax, eax
je 0x40a465
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a467
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40ad8e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
and dword [edi + 4], 0
and dword [edi], 0
mov eax, 0x8000
cmp dword [ebp + 0xc], eax
jae 0x40adaa
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push eax
push esi
push dword [edi + 0xc]
call fcn.0041c290
xor eax, eax
inc eax
add esp, 0xc
xor bl, bl
cmp dword [ebp + 0xc], eax
jbe 0x40adcd
xor bl, byte [eax + esi]
inc eax
cmp eax, dword [ebp + 0xc]
jb 0x40adc4
push 8
mov ecx, edi
call fcn.004097ba
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
and dword [esi + 0x14], 0
cmp bl, byte [eax]
jne 0x40ae2b
push dword [ebp + 0xc]
mov ecx, edi
push eax
call fcn.0040ac2a
mov edi, eax
test edi, edi
je 0x40ae2b
push 1
mov ecx, esi
call fcn.0040ad14
mov eax, dword [esi + 0x14]
lea ecx, [eax + 1]
imul eax, eax, 0x28
add eax, dword [esi]
mov dword [esi + 0x14], ecx
lea ecx, [eax + 0xc]
mov dword [ecx], edi
mov dword [eax + 0x14], ecx
lea ecx, [eax + 0x1c]
push 3
mov dword [eax + 0x24], ecx
pop ecx
mov dword [eax], 0x28
mov dword [eax + 0x18], ecx
mov dword [eax + 8], ecx
jmp 0x40ae8b
push 1
mov ecx, esi
call fcn.0040ad14
mov eax, dword [esi + 0x14]
lea ecx, [eax + 1]
imul eax, eax, 0x28
add eax, dword [esi]
mov dword [esi + 0x14], ecx
lea ecx, [eax + 0xc]
mov dword [eax + 0x14], ecx
lea ecx, [eax + 0x1c]
mov dword [eax + 0x24], ecx
push 3
pop ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 8], ecx
xor edx, edx
mov dword [eax], 0x16
xor ecx, ecx
cmp dword [esi + 0x14], edx
jle 0x40ae8b
xor edi, edi
mov eax, dword [esi]
add eax, edi
cmp dword [eax + 0x14], edx
jne 0x40ae77
lea ebx, [eax + 0xc]
mov dword [eax + 0x14], ebx
cmp dword [eax + 0x24], edx
jne 0x40ae82
lea ebx, [eax + 0x1c]
mov dword [eax + 0x24], ebx
inc ecx
add edi, 0x28
cmp ecx, dword [esi + 0x14]
jl 0x40ae68
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x40c46d
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push ecx
cmp dword [ebp + 0xc], 0
mov eax, dword [ebp + 0x10]
push ebx
push esi
lea ebx, [ecx + 8]
movdqu xmm1, xmmword [ebx]
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], eax
lea esi, [ecx + 0x18]
jbe 0x40c4f2
mov eax, edi
movdqu xmm2, xmmword [eax]
mov eax, dword [ecx + 4]
mov edx, eax
shl edx, 4
add edx, esi
movdqu xmm0, xmmword [edx]
add edi, 0x10
dec eax
pxor xmm0, xmm2
test eax, eax
jle 0x40c4c9
mov edx, eax
shl edx, 4
add edx, esi
movdqu xmm3, xmmword [edx]
dec eax
sub edx, 0x10
aesdec xmm0, xmm3
test eax, eax
jg 0x40c4b8
cmp byte [ecx + 1], 0
movdqu xmm3, xmmword [esi]
aesdeclast xmm0, xmm3
je 0x40c4dc
pxor xmm0, xmm1
mov eax, dword [esp + 0xc]
add dword [esp + 0xc], 0x10
dec dword [ebp + 0xc]
movdqa xmm1, xmm2
movdqu xmmword [eax], xmm0
jne 0x40c491
pop edi
pop esi
movdqu xmmword [ebx], xmm1
pop ebx
mov esp, ebp
pop ebp
ret 0xc