joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408270
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push ebx
mov ebx, dword [ebp + 8]
push esi
mov eax, ebx
push edi
mov dword [ebp - 8], 0x10
lea edx, [eax + 1]
jmp 0x408290
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408290
mov edi, dword [ebp + 0xc]
push 0xf0000020
push 1
sub eax, edx
push 0
mov esi, eax
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x408330
mov edx, dword [ebp - 4]
lea ecx, [ebp + 8]
push ecx
push 0
push 0
push 0x8003
push edx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x408330
mov eax, dword [ebp + 8]
push 0
push esi
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x408330
mov eax, dword [ebp + 8]
push 0
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x88]
push edx
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x408330
xor esi, esi
jmp 0x408310
movzx ecx, byte [ebp + esi - 0x88]
push ecx
push str._02x
push edi
call fcn.0041d658
inc esi
add esp, 0xc
add edi, 2
cmp esi, 0x10
jl 0x408310
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 4]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp + 0xc]
pop edi
pop esi
mov byte [ecx + 0x20], 0
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408420
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.00413380
mov ecx, eax
call fcn.00401280
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x408452
test al, 0x10
je 0x408452
mov al, 1
mov ecx, esi
push eax
call fcn.00412ca0
pop esi
pop ebp
ret
xor al, al
mov ecx, esi
push eax
call fcn.00412ca0
pop esi
pop ebp
ret

Function at 0x4084a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4084bd
shr eax, 4
not al
and al, 1
pop esi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4084e4
cmp eax, 3
je 0x4084e4
cmp eax, 0x7b
je 0x4084e4
push esi
call fcn.00408460
add esp, 4
test al, al
je 0x4084e4
mov al, 1
pop esi
pop ebp
ret
xor al, al
pop esi
pop ebp
ret
Function at 0x4153e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
lea ecx, [ebp - 0xc]
call fcn.00401f50
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
call fcn.00415320
mov edx, dword [ebp + 0xc]
push 0x4322a0
push edx
mov edi, eax
call fcn.0041c738
mov ecx, dword [ebp - 0xc]
mov esi, eax
mov eax, dword [ebp - 8]
push esi
push eax
push 1
push ecx
call fcn.0041c600
push esi
call fcn.0041c435
add esp, 0x24
lea ecx, [ebp - 0xc]
call fcn.00401f60
lea ecx, [ebp - 0xc]
call fcn.00403600
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x415440
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push esi
push edi
push 0x43235c
push eax
call fcn.0041c738
push 2
mov esi, eax
push 0
push esi
call fcn.0041d102
push esi
call fcn.0041d013
push 0
push 0
push esi
mov edi, eax
call fcn.0041d102
add esp, 0x24
push edi
lea ecx, [ebp - 0xc]
call fcn.0040f7f0
mov ecx, dword [ebp - 0xc]
push esi
push 1
push edi
push ecx
call fcn.0041ce62
push esi
call fcn.0041c435
mov eax, dword [ebp + 8]
lea edx, [ebp - 0xc]
push edx
push eax
call fcn.00415380
add esp, 0x1c
lea ecx, [ebp - 0xc]
mov esi, eax
call fcn.00403600
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x415dd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [edi + 0x2c]
push esi
mov esi, dword [edi + 0x3c]
sub esi, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x2c]
lea edx, [ebx + ecx - 0x106]
sub esi, eax
cmp eax, edx
jb 0x415e49
mov eax, dword [edi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.0041b2b0
mov edx, dword [edi + 0x4c]
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
add esp, 0xc
sub dword [edi + 0x5c], ebx
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x415e20
sub eax, ebx
jmp 0x415e22
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x415e11
mov ecx, dword [edi + 0x40]
mov edx, ebx
lea ecx, [ecx + ebx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x415e3f
sub eax, ebx
jmp 0x415e41
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x415e30
add esi, ebx
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x415f1b
mov edx, dword [edi + 0x74]
add edx, dword [edi + 0x6c]
mov ecx, esi
add edx, dword [edi + 0x38]
mov esi, eax
push edx
call fcn.00415b70
add dword [edi + 0x74], eax
mov edx, dword [edi + 0x74]
add esp, 4
cmp edx, 3
jb 0x415e93
mov esi, dword [edi + 0x6c]
add esi, dword [edi + 0x38]
mov ecx, dword [edi + 0x58]
movzx eax, byte [esi]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [esi + 1]
xor eax, ecx
and eax, dword [edi + 0x54]
mov dword [edi + 0x48], eax
cmp edx, 0x106
jae 0x415ea7
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x415dd5
mov eax, dword [edi + 0x16c0]
mov ecx, dword [edi + 0x3c]
cmp eax, ecx
jae 0x415f1b
mov esi, dword [edi + 0x6c]
add esi, edx
cmp eax, esi
jae 0x415eea
sub ecx, esi
mov ebx, ecx
cmp ebx, 0x102
jbe 0x415ece
mov ebx, 0x102
mov ecx, dword [edi + 0x38]
push ebx
add ecx, esi
push 0
push ecx
call fcn.0041d980
add esp, 0xc
add ebx, esi
pop esi
mov dword [edi + 0x16c0], ebx
pop ebx
ret
lea edx, [esi + 0x102]
cmp eax, edx
jae 0x415f1b
sub esi, eax
add esi, 0x102
sub ecx, eax
cmp esi, ecx
jbe 0x415f04
mov esi, ecx
mov ecx, dword [edi + 0x38]
push esi
add ecx, eax
push 0
push ecx
call fcn.0041d980
add esp, 0xc
add dword [edi + 0x16c0], esi
pop esi
pop ebx
ret

Function at 0x41ff86
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x448350]
jne 0x41ff90
repz ret
jmp fcn.0042b6bc
Function at 0x42ca7c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x448350]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0041ff95
and dword [ebp - 0x14], 0
cmp dword [0x44a624], 0
mov dword [ebp - 0x18], eax
jne 0x42cb2f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x42cbd7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4437f8
push ebx
call edi
test eax, eax
je 0x42cbd7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4437e8
push ebx
mov dword [0x44a624], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x44a628], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x44a62c], eax
call edi
push eax
call esi
mov dword [0x44a634], eax
test eax, eax
je 0x42cb2f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x44a630], eax
mov eax, dword [0x44a630]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x42cb88
cmp dword [0x44a634], ecx
je 0x42cb88
push eax
call esi
push dword [0x44a634]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x42cb88
test ebx, ebx
je 0x42cb88
call edi
test eax, eax
je 0x42cb7f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x42cb7f
test byte [ebp - 8], 1
jne 0x42cb88
or dword [ebp + 0x10], 0x200000
jmp 0x42cbbb
mov eax, dword [0x44a628]
cmp eax, dword [ebp - 0x18]
je 0x42cbbb
push eax
call esi
test eax, eax
je 0x42cbbb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x42cbbb
mov eax, dword [0x44a62c]
cmp eax, dword [ebp - 0x18]
je 0x42cbbb
push eax
call esi
test eax, eax
je 0x42cbbb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x44a624]
call esi
test eax, eax
je 0x42cbd7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x42cbd9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041ff86
leave
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x4047e5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x4047f4
pop dword [ebp - 0x48]
mov eax, 0x4047f4
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x31780
push 0
mov eax, 0x23a5bced
add eax, 0xdc9b23eb
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0x90cc9a83
sub ecx, 0x90cc718a
xor ebx, ebx
add ebx, eax
mov edi, 0x9826c517
sub edi, 0x97e58953
add edi, dword [ebp - 0x48]
mov edx, 0x99737997
sub edx, 0x33d2a596
xor dword [ebp - 0x30], 0xf4e1d33e
mov esi, dword [edi]
add dword [ebp - 0xc], edx
sub esi, edx
mov dword [ebp - 0x34], 0x9128c8af
mov dword [ebx], esi
add dword [ebp - 0x18], 0xa27e03b3
add ebx, 0x320fd14f
add ebx, 0xcdf02eb5
add edi, 4
loop 0x404850
add eax, 0x96b7
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x1005ad60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x101258d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x1005ad90
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e5f10
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x1005adc0
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x1005adc0
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e5f10
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x1005aebe
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x1005ade9
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1005ae1d
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e5f10
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x1005ae7c
sub eax, 1
je 0x1005ae7c
sub eax, 2
jne 0x1005aebe
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.100b9836
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e5f10
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1005ae9d
lfence
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1005aebe
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x1005aebe
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e5f10
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100e5f10
mov esp, ebp
pop ebp
ret 4
Function at 0x100b9836
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x100b9845
pop dword [ebp - 0x18]
mov eax, 0xdad1c5c
add eax, 0x25e7be9
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x222ef911
add dword [ebp - 0x28], 0x2c234c3a
mov dword [ebp - 0x24], 0x9e69b4f
add dword [ebp - 0x24], 0x284cb0f6
mov dword [ebp - 0x20], 0xfaee9d46
sub dword [ebp - 0x20], 0xaea25918
mov dword [ebp - 0x1c], 0xe66a0370
sub dword [ebp - 0x1c], 0xe66a0370
lea eax, [ebp - 0x28]
push eax
mov eax, 0x4e5dcf47
add eax, 0xc1b161c9
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x4a12b881
add dword [ebp - 0x28], 0x2a5fb0d5
mov dword [ebp - 0x24], 0x44f92907
add dword [ebp - 0x24], 0xfc73386e
mov dword [ebp - 0x20], 0xf169d2d7
sub dword [ebp - 0x20], 0x8dfa666b
mov dword [ebp - 0x1c], 0xc777b23f
sub dword [ebp - 0x1c], 0xc777b23f
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x85030
push 0
call eax
mov ecx, 0x44e5
mov edi, eax
mov esi, 0x897f724c
sub esi, 0x796c084c
add esi, dword [ebp - 0x18]
mov ebx, 0x24e28486
add ebx, 0x5e973af0
xor dword [ebp - 0x10], ecx
mov edx, dword [esi]
xor edx, ebx
xor dword [ebp - 0xc], esi
mov dword [edi], edx
add dword [ebp - 8], edx
add edi, 0x61455315
sub edi, 0x61455311
add esi, 4
loop 0x100b995c
add eax, 0xd6521fac
sub eax, 0xd6511945
mov ebx, eax
add eax, 0x5baca47b
add eax, 0xa4535b8a
mov ecx, 0x9e6962ff
sub ecx, 0x8e6962ff
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x422780
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x46f990]
jne 0x42278a
repz ret
jmp fcn.0042f520
Function at 0x401426
Capabilities:
Terminate process

Disassembly:
push eax
mov ax, 0x5eb
xor eax, eax
je 0x4013e7
jmp 0x4013ee
call 0x4645875
add bl, byte [eax - 0x3d]
push eax
mov ax, 0x5eb
xor eax, eax
je 0x4013f8
add dword [esp + 4], 2
pop eax
ret
jmp 0x4013ff
call 0x2444975b
add eax, ebx
push eax
mov ax, 0x5eb
xor eax, eax
je 0x401408
pop eax
add dword [esp], 3
ret
jmp 0x40140f
call 0x2444976b
add al, 0xc3
push eax
mov ax, 0x5eb
xor eax, eax
je 0x401418
pop eax
add dword [esp], 4
ret
jmp 0x40141f
call 0x46458a6
add eax, 0xd3bc358
cmp ecx, dword [0x40e004]
jne 0x401430
add dword [esp + 4], 5
pop eax
ret
repz ret

Function at 0x403937
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x40395e
call fcn.00401a4b
mov dword [eax], esi
call fcn.00401a38
push 0x16
pop esi
mov dword [eax], esi
call fcn.00402466
mov eax, esi
jmp 0x4039b3
test dword [ebp + 0xc], 0xfffffff9
jne 0x403944
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40398b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401a5e
pop ecx
call fcn.00401a38
mov eax, dword [eax]
jmp 0x4039b3
test al, 0x10
jne 0x4039b1
test al, 1
je 0x4039b1
test byte [ebp + 0xc], 2
je 0x4039b1
call fcn.00401a4b
mov dword [eax], 5
call fcn.00401a38
mov dword [eax], 0xd
jmp 0x403982
xor eax, eax
pop esi
pop ebp
ret
Function at 0x40506b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40e004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004043fb
and dword [ebp - 0x14], 0
cmp dword [0x40fb18], 0
mov dword [ebp - 0x18], eax
jne 0x40511e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4051c6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4051c6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x40fb18], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x40fb1c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40fb20], eax
call edi
push eax
call esi
mov dword [0x40fb28], eax
test eax, eax
je 0x40511e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x40fb24], eax
mov eax, dword [0x40fb24]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x405177
cmp dword [0x40fb28], ecx
je 0x405177
push eax
call esi
push dword [0x40fb28]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x405177
test ebx, ebx
je 0x405177
call edi
test eax, eax
je 0x40516e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40516e
test byte [ebp - 8], 1
jne 0x405177
or dword [ebp + 0x10], 0x200000
jmp 0x4051aa
mov eax, dword [0x40fb1c]
cmp eax, dword [ebp - 0x18]
je 0x4051aa
push eax
call esi
test eax, eax
je 0x4051aa
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4051aa
mov eax, dword [0x40fb20]
cmp eax, dword [ebp - 0x18]
je 0x4051aa
push eax
call esi
test eax, eax
je 0x4051aa
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40fb18]
call esi
test eax, eax
je 0x4051c6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4051c8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401426
leave
ret
Function at 0x42ea92
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
pushal
call fcn.0042eaa1

Function at 0x42f262
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
pushal
call fcn.0042f26e

Function at 0x42f8e7
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
pushal
mov dword [ebp - 4], 0
call fcn.0042f8fa

Function at 0x42f961
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
pushal
mov dword [ebp - 4], 0
call fcn.0042f974
Function at 0x2580434e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x2580435d
pop dword [ebp - 0x4c]
mov eax, 0x3e9960e2
sub eax, 0x19191d85
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xb3b7d9f9
add dword [ebp - 0x5c], 0x9a9a6b52
mov dword [ebp - 0x58], 0x89d865b2
sub dword [ebp - 0x58], 0x57a5196d
mov dword [ebp - 0x54], 0x60c310d
sub dword [ebp - 0x54], 0xb9bfecdf
mov dword [ebp - 0x50], 0x11dd2ffb
sub dword [ebp - 0x50], 0x11dd2ffb
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x394f3535
add eax, 0xec329b0f
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xdc464788
add dword [ebp - 0x5c], 0x982c21ce
mov dword [ebp - 0x58], 0xa992d8
sub dword [ebp - 0x58], 0xbf3d3163
mov dword [ebp - 0x54], 0x39ad3a62
sub dword [ebp - 0x54], 0xd63dcdf6
mov dword [ebp - 0x50], 0x4f33a517
add dword [ebp - 0x50], 0xb0cc5ae9
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x2cd955bf
sub eax, 0x757853f
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x38070
push 0
call eax
mov ecx, 0x35b9
xor ebx, ebx
add ebx, eax
mov esi, 0x25829600
add esi, dword [ebp - 0x4c]
mov edi, 0x96db3533
add edi, 0xded320b5
mov edx, dword [esi]
add dword [ebp - 8], ebx
add edx, edi
xor dword [ebp - 0x2c], 0x683bdca9
mov dword [ebx], edx
xor dword [ebp - 0x1c], esi
add ebx, 0xb285575e
add ebx, 0x4d7aa8a6
add esi, 0x31a1c9c9
sub esi, 0x31a1c9c5
loop 0x25804475
add eax, 0xf89ece88
add eax, 0x761fb2f
mov ebx, eax
add eax, 0x66e8ffa4
add eax, 0x99170061
mov ecx, 0x20b0fb6e
add ecx, 0x4cf0492
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x406384
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4063a8
xor eax, eax
test eax, eax
je 0x4063bb
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4063bb
xor ecx, ecx
jmp 0x4063be
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x409014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4064a5
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x426d8c], 0
push esi
jne 0x4064dc
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4064b6
mov dword [ecx*4 + 0x426d88], eax
inc ecx
cmp ecx, 0x100
jl 0x4064b1
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40650d
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x426d88]
xor eax, esi
inc ecx
dec edx
jne 0x4064ef
pop edi
not eax
pop esi
ret 0xc

Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.USER32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push 0x5040d1
push 0x504088
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.USER32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.USER32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret