joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101b4b50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0xa8
lea eax, [esp + 0x38]
lea ecx, [esp + 0x48]
mov edx, dword [0x101d4b64]
mov esi, edx
add esi, 0xffffff71
mov dword [0x101d4b64], esi
add edx, 0xfffff428
mov dword [0x101d4b68], edx
mov dword [esp], eax
mov dword [esp + 0x34], ecx
call fcn.101b4410
lea ecx, [0x101b4f50]
mov edx, 0xa69
mov esi, dword [esp + 0x38]
mov dword [esp + 0x9c], esi
mov dword [0x101d4b68], 0x12c8
mov dword [esp + 0x84], 0x145c00
mov esi, dword [0x101d4b50]
mov dword [esp + 0x6c], esi
mov esi, dword [0x101d4b54]
mov dword [esp + 0x7c], esi
mov esi, dword [0x101d4b58]
mov dword [esp + 0x70], esi
mov esi, dword [0x101d4b5c]
mov dword [esp + 0x94], esi
mov dword [0x101d4b64], 0x1bd1
mov esi, dword [0x101d4b60]
mov dword [esp + 0x48], esi
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
cmp word [ecx], 0x5a4d
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ecx
jne 0x101b4c3e
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov edx, dword [esp + 0x24]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], edx
je 0x101b4c63
mov eax, dword [esp + 0x20]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x10], eax
mov eax, 0x890
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], eax
jmp 0x101b4c07
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [0x101d4b68], ecx
mov dword [esp + 0x64], eax
mov dword [0x101d4b64], 0x39d
mov eax, dword [eax + edx + 0x50]
mov dword [esp + 0x8c], eax
call fcn.101b49c0
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0xc], ecx
jne 0x101b4cdc
lea eax, [esp + 0x48]
mov ecx, dword [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.101b5460
mov ecx, esp
lea edx, [esp + 0x48]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov ecx, dword [0x101d4b68]
add ecx, 0xffffd92f
mov dword [0x101d4b64], ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x101b4d90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x101d4b6c], 0
mov dword [0x101d4b70], 0
mov dword [0x101d4b7c], 0
mov edi, dword [0x101d4b68]
mov ebx, edi
add ebx, 0xffffe149
mov dword [0x101d4b64], ebx
add edi, 0xffffd49d
mov dword [0x101d4b68], edi
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jne 0x101b4e08
mov dword [0x101d4b64], 0x584
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov ecx, eax
mov edx, eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
jmp 0x101b4e19
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
add ecx, 1
mov dword [ebp - 0x2c], eax
mov eax, ecx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x101d4b6c], edx
mov dword [0x101d4b64], 0x13cb
mov ecx, dword [ebp - 0x1c]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x30]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x101d4b70], edx
mov dword [0x101d4b68], 0x7fe
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x101d4b74], cl
mov dword [0x101d4b64], 0xfae
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov edx, dword [0x101d4b68]
add edx, 0xffffe149
mov dword [0x101d4b64], edx
mov cl, byte [0x101d4b74]
mov edx, dword [0x101d4b70]
mov byte [edi + edx], cl
mov edx, dword [0x101d4b64]
add edx, 0xffffddc4
mov dword [0x101d4b64], edx
mov edx, dword [0x101d4b6c]
movzx edx, byte [edi + edx]
mov ebx, dword [0x101d4b70]
movzx ebx, byte [edi + ebx]
add ebx, edx
mov edx, dword [0x101d4b68]
mov ecx, edx
add ecx, 0xffffe149
and ebx, 0xff
mov dword [0x101d4b7c], ebx
mov dword [0x101d4b64], ecx
mov cl, byte [edi + ebx]
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x2c]
xor cl, byte [ebx + esi]
add edx, 0xffffa56d
mov dword [0x101d4b64], edx
mov edx, dword [ebp - 0x18]
mov byte [edx + esi], cl
mov dword [0x101d4b68], 0x87a
add esi, 1
mov ecx, dword [ebp - 0x10]
cmp esi, ecx
mov dword [ebp - 0x38], esi
je 0x101b4f48
mov eax, dword [0x101d4b6c]
mov ecx, dword [0x101d4b70]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], edx
jmp 0x101b4e19
jmp 0x101b4df6
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x40288e
pop dword [ebp - 0x4c]
mov eax, 0xab90f525
sub eax, 0xab50cc97
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xd6a70b7
sub dword [ebp - 0x5c], 0xbf182b6c
mov dword [ebp - 0x58], 0xb4fd3bf1
sub dword [ebp - 0x58], 0x82c9efac
mov dword [ebp - 0x54], 0x74c52d00
sub dword [ebp - 0x54], 0x2878e8d2
mov dword [ebp - 0x50], 0x5805d9be
add dword [ebp - 0x50], 0xa7fa2642
lea eax, [ebp - 0x5c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x3f3e8544
add dword [ebp - 0x5c], 0x3533e412
mov dword [ebp - 0x58], 0xbdee3778
sub dword [ebp - 0x58], 0x7c81d603
mov dword [ebp - 0x54], 0xbebaf796
add dword [ebp - 0x54], 0xa4b474d6
mov dword [ebp - 0x50], 0xf07e08c7
add dword [ebp - 0x50], 0xf81f739
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x4b1ea95b
sub eax, 0x4ade2887
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x39556
push 0
call eax
mov ecx, 0x52f3
mov edi, eax
mov edx, 0x6821b833
sub edx, 0x67e0a833
add edx, dword [ebp - 0x4c]
mov esi, 0x49a292c1
sub esi, 0xb759ce13
xor dword [ebp - 0x38], 0xcdbb1dc
mov ebx, dword [edx]
sub dword [ebp - 0x48], 0xbd4ba523
xor ebx, esi
xor dword [ebp - 8], 0xc65c22c2
mov dword [edi], ebx
mov dword [ebp - 0x20], 0x72ab263c
add edi, 0xa84ebd71
sub edi, 0xa84ebd6d
add edx, 4
loop 0x4029a5
add eax, 0xb66efe28
add eax, 0x49924077
mov ebx, eax
add eax, 0x1cd2a0e1
add eax, 0xe32d5f24
mov ecx, 0x400000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x42e301
Capabilities:
Encode data using xor

Disassembly:
xor dword [edi + 0x34], eax
lodsb al, byte [esi]
mov edi, 0xc60f1e84
shufps xmm6, xmm6, 0x84
mov byte [0x1b2bcfc6], al

Function at 0x44dc7d
Capabilities:
Encode data using xor

Disassembly:
push eax
mov es, esi
test eax, 0xf1f2be21
add eax, ebx
pop ebp
fldcw word [eax - 0x61]
cmpsd dword [esi], dword es:[edi]
xchg edx, eax
xchg ecx, eax
rcr byte [ecx - 0x59b6bbc3], 0x5a
iretd
cmpsd dword [esi], dword es:[edi]
sub byte [ecx - 0x3f], al
inc eax
stc
or ah, byte cs:[ecx]
enter 0x9ca, 0x34
cmp dword [eax + 0x1c89a629], esp
cmp dword [esi], edx
add eax, 0xd8177807
movsd dword es:[edi], dword [esi]
aaa
pop es
js 0x44dc57
fsub dword [ebp - 0x88528c9]
xlatb
jp 0x44dc3d
jp 0x44dc27
iretd
les ecx, [eax - 2]
xchg ebx, eax
jb 0x44dc01
lds ebp, [ecx + 0x24]
lcall 0x59bd, 0x7348600
mov dh, 0xe9
daa
xchg esp, eax
xchg dword [edi + 0x469ce83c], esi
add al, 0x5e
add edi, ecx
sbb dword [ecx], ebx
push 0xec791849
mov edi, 0x58183f37
aaa
aas
sbb byte [eax + 0x11], bl
cli
aaa
aas
sbb byte [eax + 0x11], bl
cli
adc dl, byte [ecx + 0x63]
sub al, 0xc
rcl dword [esi - 0x3cf82c67], cl
in eax, dx
movsd dword es:[edi], dword [esi]
xchg esp, eax
push edi
jg 0x44dc43
ret
xor byte [edx - 0x74], dh
arpl cx, bx
push edx
sbb dl, byte [ecx]
xor bl, byte [eax]
test eax, 0x4e9b29
adc dword [ecx + 0x24e5247c], esi
xchg dword [edx], ebp
jg 0x44dc8d
ret 0x57ed

Function at 0x464a2d
Capabilities:
Encode data using xor

Disassembly:
push eax
inc esp
sub dword [edi], eax
mov ebp, 0x8b28135
cmpsb byte [esi], byte es:[edi]
mov byte [0x497ce0a5], al
pop ecx
sub eax, 0x9656d91
add byte [edx + 0x70], dl
mov dword [0xfd482d65], eax
or byte [eax + 0x33b95310], bh
pcmpgtw mm0, mm0
xchg dword [ecx - 0x1a9a8f87], ebx
jge 0x464a04
fcom qword [eax]
pop eax
invalid
xor byte [ebp - 0x41], ah
leave
out 0xb1, al
push 0x11d7a83c
or ah, cl
loope 0x464a6b
insb byte es:[edi], dx
xor al, 0xe4
inc ebx
test esi, ebx
push esp
or dword [esi - 0x53cd4203], esi
pop esi
xor byte [esi], bh
xchg edx, eax
mov ebp, 0x305eac32
xchg edx, eax
and al, 0xe7
fisttp word [edx]
sub esp, dword [ebx]
jbe 0x464a7b
je 0x4649ca
dec esp
aad 0x17
dec ecx
inc esp
add al, 0xfa
js 0x464a65
and eax, 0x91b31410
test al, 0x85
cwde
loopne 0x4649fe
aad 0x53
mov dword [0x64552da0], eax
jae 0x464a45
cli
pushal
outsd dx, dword [esi]
mov esp, 0xdc6d960f
salc
jmp 0x464a17
jnp 0x464a42
arpl si, di
and eax, 0x61f0dfe5
fcompi st(0)
popal
in al, 0xca
dec ebx
sub al, 0xd2
salc
js 0x464a9b
jbe 0x464a3d
push ecx
adc ah, 0xa0
aam 0xa0
outsb dx, byte [esi]
jno 0x464a7a
inc eax
in al, dx
push edx
pop ebp
lodsd eax, dword [esi]
invalid
cmp al, 0xa0
sbb ecx, dword [edi + 0x1c5898f5]
add eax, 0x1c603739
ret 0x58fc

Function at 0x472c31
Capabilities:
Encode data using xor

Disassembly:
shl al, cl
push esi
test dword [edx + ecx*2 - 0x5b], eax
movsd dword es:[edi], dword [esi]
dec edx
jl 0x472b6b
leave
loope 0x472bd4
rcl byte [edi], 0x4d
push 0x62
Function at 0x48ae3d
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0xe8ce3d3d
jmp 0x48ae6b
movsd dword es:[edi], dword [esi]
mov esp, 0x46aa83b
add ebp, dword [ecx + 0x79801abb]
pushal
popfd
pushal
mov dh, 0x8d
pop esi
sbb eax, 0x5752e69e
sahf
out 0x52, al
push edi
xor bh, byte [0x370b55a7]
aam 0x89
std
loope 0x48ae58
pop eax
pop ebp
sal byte [esi], cl
lds esp, [0x9fda4d5]
test dword [ebx + ebp*4], ebx
lodsd eax, dword [esi]
add eax, 0x4cea7c24
scasd eax, dword es:[edi]
stosb byte es:[edi], al
std
invalid

Function at 0x4aab5d
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x95a0e0de]
cmp esi, dword [esi + 0x2f4874c8]
mov esp, 0x2a1f0ede
aaa
aas
mov ah, 0xfe
sbb al, 0xe0
or dword [esi - 0x43], 0x9dc63fba
stosd dword es:[edi], eax
push 0xfffffffffffffff1
push ebx
inc esp
in al, 0xb9
nop
mov bh, 0xc7
add byte [esi + 7], al
pop eax
or byte [edi], cl
dec esi
nop
popal
xor dword [edi - 0x30], ebx
invalid

Function at 0x4bad51
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c5398
cmp edx, dword [eax]
je 0x4bad73
add eax, 8
inc ecx
cmp eax, 0x4c5428
jl 0x4bad64
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c5398]
jne 0x4baea1
mov eax, dword [0x4c9d24]
cmp eax, 1
je 0x4bae7b
test eax, eax
jne 0x4bada4
cmp dword [0x4c52c0], 1
je 0x4bae7b
cmp edx, 0xfc
je 0x4baea1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4baddb
lea eax, [ebp - 0x1a4]
push 0x4c0d58
push eax
call fcn.004bb730
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bbbc0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bae1e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bbbc0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c0d54
push edi
call fcn.004bda90
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4c0d38
push eax
call fcn.004bb730
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bb740
lea eax, [ebp - 0xa0]
push 0x4c0d34
push eax
call fcn.004bb740
push dword [esi + 0x4c539c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bb740
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4c0d0c
push eax
call fcn.004bda04
add esp, 0x2c
pop edi
jmp 0x4baea1
lea eax, [ebp + 8]
lea esi, [esi + 0x4c539c]
push 0
push eax
push dword [esi]
call fcn.004bbbc0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40a066
Capabilities:
Encode data using xor

Disassembly:
xor bh, byte [ebx + ecx*4 - 0x46af9e95]
adc al, 0xa8
test bl, al
popfd
lds edx, [edi + ecx - 0x38aa9b24]
mov cl, 0x77
jmp 0x40a094
test al, 0x10
invalid

Function at 0x493a42
Capabilities:
Encode data using xor

Disassembly:
inc edx
mov byte [ebx + 0x4ee9620b], bl
dec ecx
rcr dword [ecx - 0x3b], 0x6d
and byte [ebx + 0x36], bh
test eax, 0xe6b309e7
out 9, eax
mov bl, 0xe6
out 9, eax
mov bl, 0xe6
mov esi, 0x26851279
cdq
test cl, dh
inc ecx
std
and ecx, dword [ecx + 0x16c4f3a7]
push ebp
cwde
adc edx, dword [edi + 0x69954b41]
mov edi, 0xef4154f8
xor dword [edi + 0x18], ebp
in eax, 0xd0
insd dword es:[edi], dx
ror byte [edx + 0x48], 0x3f
dec edx
dec eax
aas
mov ecx, 0x8523f634
push ecx
jae 0x493a0a
stosb byte es:[edi], al
insb byte es:[edi], dx
iretd

Function at 0x4bad51
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c53a0
cmp edx, dword [eax]
je 0x4bad73
add eax, 8
inc ecx
cmp eax, 0x4c5430
jl 0x4bad64
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c53a0]
jne 0x4baea1
mov eax, dword [0x4c9d34]
cmp eax, 1
je 0x4bae7b
test eax, eax
jne 0x4bada4
cmp dword [0x4c52cc], 1
je 0x4bae7b
cmp edx, 0xfc
je 0x4baea1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4baddb
lea eax, [ebp - 0x1a4]
push 0x4c0d58
push eax
call fcn.004bb730
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bbbc0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bae1e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bbbc0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c0d54
push edi
call fcn.004bda90
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4c0d38
push eax
call fcn.004bb730
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bb740
lea eax, [ebp - 0xa0]
push 0x4c0d34
push eax
call fcn.004bb740
push dword [esi + 0x4c53a4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bb740
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4c0d0c
push eax
call fcn.004bda04
add esp, 0x2c
pop edi
jmp 0x4baea1
lea eax, [ebp + 8]
lea esi, [esi + 0x4c53a4]
push 0
push eax
push dword [esi]
call fcn.004bbbc0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x419f74
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x41a478
call fcn.0041a288
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x419fd4
cmp eax, 0xffffffff
je 0x419fd4
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x419fcd
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x419fcd
cmp edx, 0x10000000
jae 0x419fcd
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x419fca
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
call fcn.0041a2cd
ret 4

Function at 0x41a020
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x41a05e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x41a056
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x41a060
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x41a046
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x41a130
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x41a146
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x41a161
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x404fdf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x404fee
pop dword [ebp - 0x48]
mov eax, 0x404fee
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x5e819dc4
sub dword [ebp - 0x58], 0x102f5879
mov dword [ebp - 0x54], 0x2df1bcf8
add dword [ebp - 0x54], 0x4418f4d
mov dword [ebp - 0x50], 0xdc4f742a
sub dword [ebp - 0x50], 0x90032ffc
mov dword [ebp - 0x4c], 0x928741de
sub dword [ebp - 0x4c], 0x928741de
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x3df80513
sub dword [ebp - 0x58], 0xc9859bbd
mov dword [ebp - 0x54], 0x65649221
sub dword [ebp - 0x54], 0x23f830ac
mov dword [ebp - 0x50], 0x5c32cd53
sub dword [ebp - 0x50], 0xf8c360e7
mov dword [ebp - 0x4c], 0xb6ae525f
add dword [ebp - 0x4c], 0x4951ada1
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x73b12a39
sub eax, 0x73708a25
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x36ebf
push 0
call eax
mov ecx, 0x4d538510
sub ecx, 0x4d534491
xor ebx, ebx
add ebx, eax
mov esi, 0x25396c0
add esi, 0xfdf02740
add esi, dword [ebp - 0x48]
mov edx, 0x6bef3452
sub dword [ebp - 0x34], 0xc8f64c99
mov edi, dword [esi]
sub dword [ebp - 0x2c], 0xa73d72e7
sub edi, edx
xor dword [ebp - 0x18], ecx
mov dword [ebx], edi
add dword [ebp - 0x44], 0x15285baa
add ebx, 0xa2429969
sub ebx, 0xa2429965
add esi, 0x863d8ce
add esi, 0xf79c2736
loop 0x405102
add eax, 0x9211954c
add eax, 0x6def5f83
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x8c435f9e
sub ecx, 0x8c035f9e
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x406020
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x40604e
mov al, byte [esi + 1]
mov ecx, esi
inc esi
cmp al, 0x22
je 0x406045
test al, al
jne 0x406037
cmp byte [esi], 0x22
cmovne esi, ecx
inc esi
jmp 0x406058
cmp al, 0x20
jle 0x406058
inc esi
cmp byte [esi], 0x20
jg 0x406052
mov al, byte [esi]
test al, al
je 0x40606c
nop
cmp al, 0x20
jg 0x40606c
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x406060
lea eax, [ebp - 0x44]
mov dword [ebp - 0x18], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x18], 1
movzx ebx, word [ebp - 0x14]
jne 0x40608c
mov ebx, 0xa
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0
mov edi, eax
push 0
push edi
call fcn.00406c90
test eax, eax
je 0x406113
call fcn.004068a0
test eax, eax
je 0x4060e8
push edi
push 1
call fcn.004066c0
add esp, 8
test eax, eax
je 0x4060e8
push 0
push 0x42b050
push str.LabWindows_CVI
call fcn.00406e90
add esp, 0xc
or esi, 0xffffffff
call fcn.00406c20
push esi
call fcn.00407140
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push esi
push 0
push edi
call fcn.004017b0
mov esi, eax
call fcn.004069a0
call fcn.00406950
call fcn.00406c20
push esi
call fcn.00407140
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
or esi, 0xffffffff
push esi
call fcn.00407140
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406320
Capabilities:
Check mutex on windows
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
cmp dword [0x42c06c], 0
je 0x406338
xor eax, eax
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x114]
push str.National_Instruments_LabWindows_CVI_Startup_library__d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
test edi, edi
jne 0x406374
lea eax, [edi - 3]
pop edi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x42c06c], 0
je 0x40639b
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.winmm.dll
call esi
mov dword [ebp - 8], eax
test eax, eax
jne 0x4063c7
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push str.advapi32.dll
call esi
mov ebx, eax
test ebx, ebx
je 0x4063f1
push str.kernel32.dll
call esi
mov dword [ebp - 0xc], eax
test eax, eax
je 0x4063f1
push str.user32.dll
call esi
mov dword [ebp - 4], eax
test eax, eax
jne 0x406409
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop esi
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.timeGetTime
push dword [ebp - 8]
call esi
mov dword [0x42c070], eax
test eax, eax
je 0x40649e
push str.RegOpenKeyExA
push ebx
call esi
mov dword [0x42c074], eax
test eax, eax
je 0x40649e
push str.RegQueryValueExA
push ebx
call esi
mov dword [0x42c078], eax
test eax, eax
je 0x40649e
push str.GetFileTime
push dword [ebp - 0xc]
call esi
mov dword [0x42c07c], eax
test eax, eax
je 0x40649e
push str.KillTimer
push dword [ebp - 4]
call esi
mov dword [0x42c080], eax
test eax, eax
je 0x40649e
push str.SetTimer
push dword [ebp - 4]
call esi
mov dword [0x42c084], eax
test eax, eax
je 0x40649e
push edi
mov dword [0x42c06c], 1
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
call esi
push ebx
call esi
push dword [ebp - 0xc]
call esi
push dword [ebp - 4]
call esi
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop esi
mov eax, 0xfffffffe
pop edi
mov esp, ebp
pop ebp
ret