joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40532c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esi, 0x4a37
pop esi
push ebx
push esi
add esp, 4
or ebx, 0x8a17
and ebx, 0x4d3d
and ebx, 0xbe26
pop ebx
cmp dword [ebp - 0xd1c], 0
jne 0x405363
mov dword [ebp - 0x2c0], 0
jmp 0x4055ae
mov ecx, dword [ebp - 0xd1c]
mov dword [ebp - 0x514], ecx
push eax
or eax, 0x10b75
pop eax
push eax
push edx
add esp, 4
call 0x40538b
add byte [eax + 0x46], dl
inc ebx
dec ebx
inc edi
xor eax, 0xc4833e42
add al, 0xe8
or al, byte [eax]
add byte [eax], al
add byte [edi], dh
aaa
cmp dword [ebp + 0x4d], eax
inc ebx
dec ebx
dec esi
dec ebx
add esp, 4
pop eax
lea edx, [ebp - 0x16c0]
mov dword [ebp - 0xd18], edx
mov eax, dword [ebp - 0x514]
mov ecx, dword [eax + 0x30]
dec eax
xor byte [ecx - 0xd1373], cl
push dword [ebx]
shl byte [esi - 0x77], cl
xchg ebp, eax
sub al, 0xfe
invalid
push dword [ebx]
shl byte [esi - 0x77], 0x45
int3
push ecx
jmp 0x4053d1
and ecx, 0xa73a
or ecx, 0xa191
pop ecx
push eax
jmp 0x4053e5
call 0x4053f3
add byte [edx + 0x33], cl
xor dh, byte [ebx]
cmp dword [ebx], esi
inc esi
dec ecx
add esp, 4
or eax, 0x15254
pop eax
mov ecx, dword [ebp - 0xd14]
mov dx, word [ecx]
mov word [ebp - 0x10ae], dx
mov eax, dword [ebp - 0xd14]
add eax, 2
mov dword [ebp - 0xd14], eax
mov cx, word [ebp - 0x10ae]
mov word [ebp - 0x1d4], cx
mov edx, dword [ebp - 0xd18]
mov ax, word [edx]
mov word [ebp - 0x10b0], ax
mov ecx, dword [ebp - 0xd18]
add ecx, 2
mov dword [ebp - 0xd18], ecx
mov dx, word [ebp - 0x10b0]
mov word [ebp - 0x34], dx
push esi
or esi, 0x5448
add esi, 0x10be9
pop esi
push edx
jmp 0x40546a
call 0x405476
add byte [0x4a4d3b48], bh
aas
add esp, 4
add al, 0x81
retf 0x1ea4
add byte [eax], al
and edx, 0x6873
pop edx
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x4054a3
movzx ecx, word [ebp - 0x1d4]
movzx edx, word [ebp - 0x34]
int3
movzx eax, word [ebp - 0x1d4]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x4053cb
movzx edx, word [ebp - 0x1d4]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x4053cb
movzx ecx, word [ebp - 0x1d4]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x4054e7
mov dword [ebp - 0x1658], 0xffffffff
jmp 0x4054f1
mov dword [ebp - 0x1658], 1
mov eax, dword [ebp - 0x1658]
mov dword [ebp - 0x165c], eax
Function at 0x405476
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esi, 0x4a37
pop esi
push ebx
push esi
add esp, 4
or ebx, 0x8a17
and ebx, 0x4d3d
and ebx, 0xbe26
pop ebx
cmp dword [ebp - 0xd1c], 0
jne 0x405363
mov dword [ebp - 0x2c0], 0
jmp 0x4055ae
mov ecx, dword [ebp - 0xd1c]
mov dword [ebp - 0x514], ecx
push eax
or eax, 0x10b75
pop eax
push eax
push edx
add esp, 4
call 0x40538b
add byte [eax + 0x46], dl
inc ebx
dec ebx
inc edi
xor eax, 0xc4833e42
add al, 0xe8
or al, byte [eax]
add byte [eax], al
add byte [edi], dh
aaa
cmp dword [ebp + 0x4d], eax
inc ebx
dec ebx
dec esi
dec ebx
add esp, 4
pop eax
lea edx, [ebp - 0x16c0]
mov dword [ebp - 0xd18], edx
mov eax, dword [ebp - 0x514]
mov ecx, dword [eax + 0x30]
dec eax
xor byte [ecx - 0xd1373], cl
push dword [ebx]
shl byte [esi - 0x77], cl
xchg ebp, eax
sub al, 0xfe
invalid
push dword [ebx]
shl byte [esi - 0x77], 0x45
int3
push ecx
jmp 0x4053d1
and ecx, 0xa73a
or ecx, 0xa191
pop ecx
push eax
jmp 0x4053e5
call 0x4053f3
add byte [edx + 0x33], cl
xor dh, byte [ebx]
cmp dword [ebx], esi
inc esi
dec ecx
add esp, 4
or eax, 0x15254
pop eax
mov ecx, dword [ebp - 0xd14]
mov dx, word [ecx]
mov word [ebp - 0x10ae], dx
mov eax, dword [ebp - 0xd14]
add eax, 2
mov dword [ebp - 0xd14], eax
mov cx, word [ebp - 0x10ae]
mov word [ebp - 0x1d4], cx
mov edx, dword [ebp - 0xd18]
mov ax, word [edx]
mov word [ebp - 0x10b0], ax
mov ecx, dword [ebp - 0xd18]
add ecx, 2
mov dword [ebp - 0xd18], ecx
mov dx, word [ebp - 0x10b0]
mov word [ebp - 0x34], dx
push esi
or esi, 0x5448
add esi, 0x10be9
pop esi
push edx
jmp 0x40546a
call 0x405476
add byte [0x4a4d3b48], bh
aas
add esp, 4
add al, 0x81
retf 0x1ea4
add byte [eax], al
and edx, 0x6873
pop edx
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x4054a3
movzx ecx, word [ebp - 0x1d4]
movzx edx, word [ebp - 0x34]
int3
movzx eax, word [ebp - 0x1d4]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x4053cb
movzx edx, word [ebp - 0x1d4]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x4053cb
movzx ecx, word [ebp - 0x1d4]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x4054e7
mov dword [ebp - 0x1658], 0xffffffff
jmp 0x4054f1
mov dword [ebp - 0x1658], 1
mov eax, dword [ebp - 0x1658]
mov dword [ebp - 0x165c], eax

Function at 0x405570
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor al, 0x3a
inc edx
add esp, 4
pop ecx
mov edx, dword [ebp - 0x514]
mov eax, dword [edx]
mov dword [ebp - 0x514], eax
mov ecx, dword [ebp - 0x514]
cmp ecx, dword [ebp - 0xd1c]
je 0x4055a4
mov edx, dword [ebp - 0x514]
cmp dword [edx + 0x30], 0
jne 0x40536f
mov dword [ebp - 0x2c0], 0
push edx
push ebx
add esp, 4
add edx, 0x3a60
pop edx
push esi
push ecx
add esp, 4
xor esi, 0x1043a
add esi, 0x13d7
xor esi, 0x43
pop esi
push eax
and eax, 0xb3a4
and eax, 0x3c8b
pop eax
invalid
test dword [eax - 3], eax
Function at 0x405574
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor al, 0x3a
inc edx
add esp, 4
pop ecx
mov edx, dword [ebp - 0x514]
mov eax, dword [edx]
mov dword [ebp - 0x514], eax
mov ecx, dword [ebp - 0x514]
cmp ecx, dword [ebp - 0xd1c]
je 0x4055a4
mov edx, dword [ebp - 0x514]
cmp dword [edx + 0x30], 0
jne 0x40536f
mov dword [ebp - 0x2c0], 0
push edx
push ebx
add esp, 4
add edx, 0x3a60
pop edx
push esi
push ecx
add esp, 4
xor esi, 0x1043a
add esi, 0x13d7
xor esi, 0x43
pop esi
push eax
and eax, 0xb3a4
and eax, 0x3c8b
pop eax
invalid
test dword [eax - 3], eax

Function at 0x405614
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop eax
push edx
push esi
add esp, 4
xor edx, 0x110ae
pop edx
mov dword [ebp - 0x7c4], 0
mov edx, dword [ebp - 0x338]
xchg ebp, eax
enter 0xfffffffffffffffc, 0xffffffffffffffff
mov dword [ebp - 0x1660], edx
cmp dword [ebp - 0x1660], 0
jne 0x405651
mov eax, dword [ebp - 0x7c4]
mov dword [ebp - 0x518], eax
jmp 0x405942
invalid
mov ecx, dword [ebp - 0x1660]
mov edx, dword [ebp - 0x338]
inc dword [ebx]
push ecx
cmp al, 0x89
xchg ebp, eax
pushfd
jmp 0x11b65667
mov eax, dword [ebp - 0x7c4]
mov dword [ebp - 0x518], eax
jmp 0x405942
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x1664]
jmp 0x4ccc5688
adc byte [eax - 0x77], bh
lea ebx, [eax - 0x7c000017]
mov ebp, 0xffffe998
add byte [ebp + 0x11], dh
mov edx, dword [ebp - 0x7c4]
mov dword [ebp - 0x518], edx
jmp 0x405942
mov eax, dword [ebp - 0x338]
add eax, dword [ebp - 0x1668]
mov dword [ebp - 0x7b8], eax
jne 0x4056d0
mov ecx, dword [ebp - 0x7c4]
mov dword [ebp - 0x518], ecx
jmp 0x405942
mov edx, dword [ebp - 0x7b8]
mov eax, dword [ebp - 0x338]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x1d8c], eax
mov ecx, dword [ebp - 0x7b8]
mov edx, dword [ebp - 0x338]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x1d90], edx
mov eax, dword [ebp - 0x7b8]
mov ecx, dword [ebp - 0x338]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x1d94], ecx
mov dword [ebp - 0x7bc], 0
jmp 0x40572a

Function at 0x4076d0
Capabilities:
Encode data using xor

Disassembly:
xchg ebp, eax
xchg ebp, eax
xor al, 0xf1
pop es
pop es
xchg ecx, eax
xchg ebp, eax
js 0x4076ca
pop es
pop es
adc al, 0x95
xchg ebp, eax
popfd
and cl, dh
pop es
pop es
xchg ecx, eax
popfd
js 0x4076d8
pop es
pop es
xchg ebx, eax
lea edi, [eax - 0xa]
pop es
pop es
xchg ecx, eax
lea esi, [esi + esi*8 + 7]
pop es
xchg ebx, eax
xchg ebp, eax
je 0x4076ea
test byte [edi], 7
pop es
pop es
xchg ecx, eax
xchg ebp, eax
mov eax, 0x93070702
popfd
or al, 0xfd
pop es
pop es
xchg ecx, eax
popfd
js 0x4076f3
pop es
pop es
pop edi
lock adc byte [eax], cl
or byte [eax], cl
or byte [esi + 0x45], dl
pop eax
inc edi
inc edx
dec esi
cmp cl, byte [ebx - 0x3076f334]
pop edx
les ecx, [eax]
or byte [ecx + 0x8957bd7], cl
or byte [ecx + 0x89257f7], cl
or byte [edi + 0x5e], ah
mov esi, esi
xor byte [ebx], dl
or byte [eax], cl
or al, 0x47
push edi
push esp
push eax
pop di
mov edi, esi
sub al, 0x39
or byte [eax], cl
mov edi, edi
sub byte [ebx], dh
or dword [eax], ecx
mov edi, ebp
retf
Function at 0x407750
Capabilities:
Check for vm using instruction vpcext

Disassembly:
add byte [eax], cl
or byte [edi + 0x58], ah
pop edx
mov ecx, esp
or al, 0x89
call 0x849f5e4
mov eax, esi
xchg esp, eax
jl 0x40776c
or byte [ecx + 0x8cd46f8], cl
or byte [eax + 0x58], ah
pop eax
mov eax, ecx
add eax, 0xf308087e
invalid

Function at 0x42fbbc
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42fbc2
ret

Function at 0x481b94
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
xor edx, edx
mov dword [eax + 0x14], edx
xor edx, edx
mov dword [eax + 0x18], edx
ret

Function at 0x4ab76c
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x50c43c
mov eax, esi
mov edx, 8
test al, 1
je 0x4ab788
shr eax, 1
xor eax, 0xedb88320
jmp 0x4ab78a
shr eax, 1
dec edx
jne 0x4ab77b
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4ab774
pop esi
ret

Function at 0x4ab7a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x50c438], 0
jne 0x4ab7c3
call fcn.004ab76c
push 1
push 0x50c438
call fcn.00409530
mov eax, edi
test esi, esi
je 0x4ab7ee
mov edx, ebx
and edx, 0xff
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x50c43c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x4ab7c9
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x4ac358
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
ret
Function at 0x4bffb0
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffd4c
mov ebx, edx
mov esi, eax
push 0x200
push 0x2b4
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.004064d4
push eax
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x4bfff0
mov eax, ebx
lea edx, [esp + 0xc]
mov ecx, 0x104
call fcn.00406640
jmp 0x4bfff9
mov eax, ebx
xor edx, edx
call fcn.00406448
add esp, 0x2b4
pop esi
pop ebx
ret

Function at 0x4c0004
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffd4c
mov ebx, edx
mov esi, eax
movzx eax, bl
mov eax, dword [eax*4 + 0x5053b8]
or eax, 0x4001
push eax
push 0x2b4
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.004064d4
push eax
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x4c0043
mov eax, dword [esp + 4]
jmp 0x4c0045
xor eax, eax
add esp, 0x2b4
pop esi
pop ebx
ret

Function at 0x4c0050
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffd4c
mov ebx, eax
movzx eax, bl
mov eax, dword [eax*4 + 0x5053c0]
or eax, 0x4011
push eax
push 0x2b4
lea eax, [esp + 8]
push eax
push 0x10
push 0x4c0094
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x4c0089
mov eax, dword [esp + 4]
jmp 0x4c008b
xor eax, eax
add esp, 0x2b4
pop ebx
ret

Function at 0x4c0073
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffd4c
mov ebx, eax
movzx eax, bl
mov eax, dword [eax*4 + 0x5053c0]
or eax, 0x4011
push eax
push 0x2b4
lea eax, [esp + 8]
push eax
push 0x10
push 0x4c0094
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x4c0089
mov eax, dword [esp + 4]
jmp 0x4c008b
xor eax, eax
add esp, 0x2b4
pop ebx
ret
Function at 0x4c4f68
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd44
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x2bc], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c515e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x4b0]
mov edx, 0x20
call fcn.0045a7f0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x4b0]
mov edx, 0x20
call fcn.0045a824
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x4b4]
mov edx, 0x20
call fcn.0045a7f0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x4b4]
mov edx, 0x20
call fcn.0045a824
xor eax, eax
push ebp
push 0x4c5133
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x1010
push 0x2b4
lea eax, [ebp - 0x2b8]
push eax
push 0x10
push 0x4c516c
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x4c5048
cmp word [ebp - 0x2ac], 0
je 0x4c5048
mov eax, dword [ebp - 0x2b4]
push eax
lea eax, [ebp - 0x2ac]
push eax
mov eax, dword [0x509b50]
push eax
call sub.shell32.dll_ExtractIconW
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x4b0]
call fcn.004c4ea4
xor edx, edx
mov al, 6
call fcn.004daef4
test al, al
je 0x4c50a6
push 0x27
lea edx, [ebp - 0x2bc]
mov eax, dword [0x506064]
mov eax, dword [eax]
call fcn.0047e328
lea eax, [ebp - 0x2bc]
mov edx, 0x4c5194
call fcn.00406854
mov eax, dword [ebp - 0x2bc]
call fcn.004064d4
push eax
mov eax, dword [0x509b50]
push eax
call sub.shell32.dll_ExtractIconW
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x4b4]
call fcn.004c4ea4
jmp 0x4c5129
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov dl, 2
xor eax, eax
call fcn.004e06ec
cmp dword [ebp - 4], 0
jne 0x4c50ca
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov dl, 2
mov al, 1
call fcn.004e06ec
cmp dword [ebp - 4], 0
je 0x4c5129
push 0x1000
push 0x2b4
lea eax, [ebp - 0x2b8]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x4c5129
cmp word [ebp - 0x2ac], 0
je 0x4c5129
mov eax, dword [ebp - 0x2b4]
push eax
lea eax, [ebp - 0x2ac]
push eax
mov eax, dword [0x509b50]
push eax
call sub.shell32.dll_ExtractIconW
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x4b4]
call fcn.004c4ea4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c513d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c5165
lea eax, [ebp - 0x2bc]
call fcn.00406438
lea eax, [ebp - 4]
call fcn.00406438
ret
Function at 0x4e5ba0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, 3
lea ebx, [ebp - 8]
lea esi, [ebp - 0xc]
lea edi, [ebp - 4]
movzx eax, byte [esi]
movzx edx, byte [ebx]
sub eax, edx
imul dword [ebp - 0x10]
push ecx
mov ecx, 0xff
cdq
idiv ecx
pop ecx
movzx edx, byte [ebx]
add eax, edx
mov byte [edi], al
inc edi
inc esi
inc ebx
dec ecx
jne 0x4e5bc5
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406c80
Capabilities:
Packed with generic packer

Disassembly:
mov ecx, dword [esp + 4]
test ecx, 3
je 0x406ca0
mov al, byte [ecx]
inc ecx
test al, al
je 0x406cd3
test ecx, 3
jne 0x406c8c
add eax, 0
mov eax, dword [ecx]
mov edx, 0x7efefeff
jmp loc.00494d7f
lea eax, [ecx - 1]
mov ecx, dword [esp + 4]
sub eax, ecx
ret

Function at 0x406d00
Capabilities:
Packed with generic packer

Disassembly:
jne 0x406d03
ret
push ebp
mov ebp, esp
sub esp, 0
push eax
push edx
push ebx
push esi
push edi
push str.The_value_of_ESP_was_not_properly_saved_across_a_function_call.__This_is_usually_a_result_of_calling_a_function_declared_with_one_calling_convention_with_a_function_pointer_declared_with_a_different_calling_convention.
push 0x427800
push 0x2a
push 0x4277f0
push 1
jmp loc.0049fb69

Function at 0x406d40
Capabilities:
Packed with generic packer

Disassembly:
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 4]
test edx, edx
je 0x406d93
xor eax, eax
mov al, byte [esp + 8]
push edi
mov edi, ecx
cmp edx, 4
jb 0x406d87
neg ecx
and ecx, 3
je 0x406d69
sub edx, ecx
mov byte [edi], al
inc edi
dec ecx
jne 0x406d63
jmp 0x4a05ba
mov byte [edi], al
inc edi
dec edx
jne 0x406d87
mov eax, dword [esp + 8]
pop edi
ret
mov eax, dword [esp + 4]
ret

Function at 0x407630
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x43a820], 1
jne fcn.0040764e
mov eax, dword [ebp + 8]
push eax
jmp loc.0049cc3f

Function at 0x407740
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4278e0
push 0x40b1a4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffa4
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x43a7e4], eax
mov eax, dword [0x43a7e4]
shr eax, 8
and eax, 0xff
mov dword [0x43a7f0], eax
mov ecx, dword [0x43a7e4]
and ecx, 0xff
mov dword [0x43a7ec], ecx
mov edx, dword [0x43a7ec]
shl edx, 8
add edx, dword [0x43a7f0]
mov dword [0x43a7e8], edx
mov eax, dword [0x43a7e4]
shr eax, 0x10
and eax, 0xffff
mov dword [0x43a7e4], eax
push 0
call fcn.0040afc0
add esp, 4
test eax, eax
jne 0x4077d4
push 0x1c
call fcn.004078d0
add esp, 4
mov dword [ebp - 4], 0
call fcn.0040ac50
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x43c1f8], eax
call fcn.0040aa30
mov dword [0x43a828], eax
call fcn.0040a520
call fcn.0040a3d0
call fcn.00407570
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x5c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.0040a310
jmp loc.0049d28e

Function at 0x4078d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x43a830], 1
jne fcn.004078e1
jmp loc.00495840

Function at 0x407a10
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x302c
call fcn.0040b9d0
push edi
mov byte [ebp - 0x3008], 0
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x3007]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
jmp loc.0049d6ed

Function at 0x408690
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
jmp loc.0049f4d9
Function at 0x408c80
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ecx
jmp loc.0049f596

Function at 0x4096f0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x429ac0]
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0xffffffff
je fcn.0040970b
mov ecx, dword [ebp + 8]
jmp loc.004973b0

Function at 0x40a2b0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ecx
jmp loc.0049e1db

Function at 0x40a520
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [0x43c214], 0
jne fcn.0040a534
jmp loc.0049472d

Function at 0x40b766
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
jmp 0x40b74b
cmp dword [ebp + 0xc], 0
ja loc.0040b6ea
jb 0x40b759
cmp dword [ebp + 8], 0
ja loc.0040b6ea
mov edx, dword [ebp - 4]
mov byte [edx], 0
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov dl, byte [ecx]
jmp 0x4934c8

Function at 0x40b9d0
Capabilities:
Packed with generic packer

Disassembly:
push ecx
cmp eax, 0x1000
lea ecx, [esp + 8]
jb 0x40b9f0
jmp loc.00495198
sub ecx, eax
mov eax, esp
test dword [ecx], eax
mov esp, ecx
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push eax
ret

Function at 0x40c820
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0xffffffe0
jbe 0x40c82e
xor eax, eax
jmp 0x40c873
cmp dword [ebp + 8], 0xffffffe0
ja 0x40c845
mov eax, dword [ebp + 8]
push eax
call fcn.0040c880
add esp, 4
mov dword [ebp - 4], eax
jmp 0x40c84c
jmp 0x4a14c4
cmp dword [ebp - 4], 0
jne 0x40c858
cmp dword [ebp + 0xc], 0
jne 0x40c85d
mov eax, dword [ebp - 4]
jmp 0x40c873
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040c7d0
add esp, 4
test eax, eax
jne 0x40c871
xor eax, eax
jmp 0x40c873
jmp 0x40c82e
mov esp, ebp
pop ebp
ret

Function at 0x40cca0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x43c084]
imul eax, eax, 0x14
mov ecx, dword [0x43c088]
add ecx, eax
mov dword [ebp - 0xc], ecx
mov edx, dword [0x43c088]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jae 0x40ccef
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
jmp loc.004961b6
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x40e9b0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
add eax, 1
cmp eax, 0x100
ja 0x40e9da
mov ecx, dword [ebp + 8]
mov edx, dword [str.________________________________H]
xor eax, eax
mov ax, word [edx + ecx*2]
and eax, dword [ebp + 0xc]
jmp 0x40ea63
jmp loc.0049a358
mov esp, ebp
pop ebp
ret

Function at 0x40eb70
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push 4
push 0
mov eax, dword [ebp + 8]
push eax
jmp loc.00498cf2

Function at 0x4118d0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x43a808]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0
jmp loc.00498b29
Function at 0x4124e0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
jmp loc.00493807

Function at 0x412890
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
jne 0x4128b0
xor eax, eax
jmp loc.0049b3b7
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xc]
add eax, 4
mov dword [ebp - 0xc], eax
test edx, edx
je 0x4128cd
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
jmp 0x4128b0
push 0x146
push str.setenv.c
push 2
mov edx, dword [ebp - 0x10]
lea eax, [edx*4 + 4]
push eax
call fcn.00408290
add esp, 0x10
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jne 0x412905
push 9
call fcn.004078a0
add esp, 4
jmp loc.00497e39

Function at 0x412b10
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x43be4c], 0
jne 0x412b32
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004081b0
add esp, 8
jmp loc.00495d08
jmp 0x412b3d
mov edx, dword [ebp + 8]
add edx, 1
mov dword [ebp + 8], edx
mov eax, dword [ebp + 8]
movzx cx, byte [eax]
mov word [ebp - 4], cx
mov edx, dword [ebp - 4]
and edx, 0xffff
test edx, edx
je 0x412bbd
mov eax, dword [ebp - 4]
and eax, 0xff
xor ecx, ecx
mov cl, byte [eax + 0x43bf61]
and ecx, 4
test ecx, ecx
je 0x412ba8
mov edx, dword [ebp + 8]
add edx, 1
mov dword [ebp + 8], edx
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax]
test ecx, ecx
jne 0x412b84
xor eax, eax
jmp fcn.00412bd1
mov edx, dword [ebp - 4]
and edx, 0xffff
shl edx, 8
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax]
or edx, ecx
cmp dword [ebp + 0xc], edx
jne 0x412ba6
mov eax, dword [ebp + 8]
sub eax, 1
jmp fcn.00412bd1
jmp 0x412bb8
mov edx, dword [ebp - 4]
and edx, 0xffff
cmp dword [ebp + 0xc], edx
jne 0x412bb8
jmp 0x412bbd
jmp 0x412b34
mov eax, dword [ebp - 4]
and eax, 0xffff
cmp dword [ebp + 0xc], eax
jne 0x412bcf
mov eax, dword [ebp + 8]
jmp fcn.00412bd1
xor eax, eax

Function at 0x49797d
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414c50
push 0x411f80
push eax
push ebx
push edi
xor ebx, ebx
push 2
pop ecx
mov ecx, dword [0x41791c]
mov ecx, dword [0x417918]
add esp, 0x18
leave
popal
popfd
mov dword [0x43a840], ecx
jmp fcn.0040905f