joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d4b7c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0xc], 0
je 0x4d4b92
mov ecx, dword [esi]
mov eax, dword [esi + 0x10]
cmp eax, dword [ecx]
je 0x4d4bb6
mov eax, dword [esi]
push dword [esi + 0xc]
mov eax, dword [eax + 0x18]
push eax
call dword [eax + 4]
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [esi + 0x10], ecx
mov eax, dword [eax + 0x18]
push ecx
push eax
call dword [eax]
add esp, 0x10
mov dword [esi + 0xc], eax
test eax, eax
je 0x4d4c13
cmp dword [esi + 4], 0
je 0x4d4bc6
mov ecx, dword [esi]
mov eax, dword [esi + 8]
cmp eax, dword [ecx + 4]
je 0x4d4beb
mov eax, dword [esi]
push dword [esi + 4]
mov eax, dword [eax + 0x18]
push eax
call dword [eax + 4]
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov dword [esi + 8], ecx
mov eax, dword [eax + 0x18]
push ecx
push eax
call dword [eax]
add esp, 0x10
mov dword [esi + 4], eax
test eax, eax
je 0x4d4c13
and dword [esi + 0x34], 0
lea eax, [esi + 0x3c]
and dword [esi + 0x38], 0
push eax
call fcn.004d7bf7
pop ecx
test eax, eax
jne 0x4d4c0f
lea eax, [esi + 0x40]
push eax
call fcn.004d7bf7
pop ecx
test eax, eax
je 0x4d4c16
push 0xc
jmp 0x4d4c15
push 2
pop eax
pop esi
pop ebp
ret

Function at 0x4d4c7d
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
and dword [esi + 0xc], 0
lea eax, [esi + 4]
push eax
call fcn.004d7bf7
pop ecx
test eax, eax
jne 0x4d4cb3
lea eax, [esi + 8]
push eax
call fcn.004d7bf7
pop ecx
test eax, eax
jne 0x4d4cb3
push esi
push 0x4d4c19
push esi
call fcn.004d7d73
add esp, 0xc
pop esi
pop ebp
ret

Function at 0x4d798f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor bl, bl
push edi
mov edi, dword [ebp + 0xc]
xor cl, cl
xor eax, eax
or dword [esi], 0xffffffff
mov byte [esi + 4], 0
test edi, edi
je 0x4d79f4
mov edx, dword [ebp + 8]
xor cl, byte [eax + edx]
inc eax
cmp eax, edi
jb 0x4d79ae
test cl, cl
jne 0x4d79f4
test edi, edi
je 0x4d79f4
mov ecx, dword [ebp + 8]
xor ebx, ebx
inc ebx
mov edx, edi
mov byte [esi + 4], bl
call fcn.004bf75e
mov edx, eax
xor ecx, ecx
xor eax, eax
cmp dword [eax + 0x552594], edx
jne 0x4d79e4
cmp dword [eax + 0x552590], edi
je 0x4d79fd
add eax, 0xc
inc ecx
cmp eax, 0x48
jb 0x4d79d4
or dword [esi], 0xffffffff
mov byte [esi + 4], 0
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret 8
mov dword [esi], ecx
test ecx, ecx
js 0x4d79f0
jmp 0x4d79f4

Function at 0x4d7d73
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
push esi
call fcn.005090f2
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
jne 0x4d7d9f
call fcn.004d7cb7
mov esi, eax
mov eax, esi
pop esi
leave
ret
Function at 0x4dc731
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0x200
jb 0x4dc797
mov edx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [edx], ax
jne 0x4dc797
mov ecx, dword [edx + 0x3c]
cmp ecx, 0x1000
jae 0x4dc797
lea eax, [ecx + 0x200]
cmp eax, dword [ebp + 0xc]
ja 0x4dc797
test cl, 7
jne 0x4dc797
add ecx, edx
cmp dword [ecx], 0x4550
jne 0x4dc797
movzx eax, word [ecx + 4]
sub eax, 0x14c
je 0x4dc7b0
sub eax, 0x74
je 0x4dc7a9
dec eax
sub eax, 1
je 0x4dc7a9
dec eax
sub eax, 1
je 0x4dc7a2
sub eax, 0x3c
je 0x4dc79b
sub eax, 0x8464
je 0x4dc7b0
xor eax, eax
pop ebp
ret
mov edx, 0x3030401
jmp 0x4dc7b5
mov edx, 0x3030701
jmp 0x4dc7b5
mov edx, 0x3030501
jmp 0x4dc7b5
mov edx, 0x3030103
mov eax, 0x400
cmp word [ecx + 0x14], ax
ja 0x4dc797
movzx eax, word [ecx + 0x18]
mov ecx, 0x10b
cmp ax, cx
je 0x4dc7d8
mov ecx, 0x20b
cmp ax, cx
jne 0x4dc797
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
xor eax, eax
inc eax
pop ebp
ret
Function at 0x4e1cfd
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x18], 0
and dword [eax + 0x1c], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
pop ebp
ret

Function at 0x4e1eff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x57b300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x44]
push esi
push edi
push 5
mov esi, ecx
push eax
push esi
mov dword [ebp - 0x88], esi
call fcn.004e1346
push 5
lea ecx, [ebp - 0x84]
lea eax, [esi + 0x60]
push ecx
push eax
mov dword [ebp - 0x8c], eax
call fcn.004e1346
add esp, 0x18
lea edi, [ebp - 0x44]
mov esi, ebx
push 5
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4e1fa3
lea esi, [ebp - 0x44]
sub esi, ebx
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x88]
call fcn.004e1475
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x84]
push eax
push dword [ebp - 0x8c]
call fcn.004e1475
add esp, 0x18
mov ecx, ebx
push 5
pop edx
mov eax, dword [esi + ecx]
xor dword [ecx], eax
lea ecx, [ecx + 4]
sub edx, 1
jne 0x4e1f91
sub edi, 1
jne 0x4e1f5d
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046170f
leave
ret 8
Function at 0x4e1fb4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
mov eax, dword [0x57b300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
push 0x10
xor eax, eax
mov dword [ebp - 0xbc], ebx
pop ecx
lea edi, [ebp - 0x58]
mov dword [ebp - 0xc0], esi
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 0xc]
cmp edi, 0x40
jbe 0x4e2032
lea eax, [ebp - 0xb8]
push eax
call fcn.004e1cfd
push edi
lea eax, [ebp - 0xb8]
push esi
push eax
call fcn.004e1d2f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xb8]
push eax
call fcn.004e13e5
add esp, 0x18
xor esi, esi
mov ecx, esi
mov eax, dword [ebp + ecx - 0x18]
bswap eax
mov dword [ebp + ecx - 0x58], eax
add ecx, 4
cmp ecx, 0x14
jb 0x4e201e
jmp 0x4e2069
xor esi, esi
mov ebx, esi
test edi, edi
je 0x4e2063
mov esi, dword [ebp - 0xc0]
mov eax, ebx
mov edx, ebx
and eax, 3
shr edx, 2
push 3
pop ecx
sub ecx, eax
movzx eax, byte [esi + ebx]
shl ecx, 3
shl eax, cl
or dword [ebp + edx*4 - 0x58], eax
inc ebx
cmp ebx, edi
jb 0x4e2040
xor esi, esi
mov ebx, dword [ebp - 0xbc]
mov eax, esi
movups xmm0, xmmword [ebp + eax*4 - 0x58]
pxor xmm0, xmmword [str.6666666666666666jjjjjjjjjjjjjjjj]
movups xmmword [ebp + eax*4 - 0x58], xmm0
add eax, 4
cmp eax, 0x10
jb 0x4e206b
push ebx
call fcn.004e1cfd
push 0x10
lea eax, [ebp - 0x58]
push eax
push ebx
call fcn.004e1396
add esp, 0x10
movups xmm0, xmmword [ebp + esi*4 - 0x58]
pxor xmm0, xmmword [0x552c50]
movups xmmword [ebp + esi*4 - 0x58], xmm0
add esi, 4
cmp esi, 0x10
jb 0x4e209a
lea esi, [ebx + 0x60]
push esi
call fcn.004e1cfd
push 0x10
lea eax, [ebp - 0x58]
push eax
push esi
call fcn.004e1396
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0046170f
leave
ret 8

Function at 0x4e20dd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x57b300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov ecx, dword [ebp + 8]
mov eax, ebx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x48], ecx
mov byte [ebp + eax - 0x44], bl
inc eax
cmp eax, 0x40
jb 0x4e20ff
cmp edi, 0x40
jbe 0x4e212d
push esi
call fcn.004e1cfd
push edi
push dword [ebp - 0x48]
push esi
call fcn.004e1d2f
lea eax, [ebp - 0x44]
push eax
push esi
call fcn.004e13e5
add esp, 0x18
jmp 0x4e213f
test edi, edi
je 0x4e213f
push edi
push ecx
lea eax, [ebp - 0x44]
push eax
call fcn.004ed400
add esp, 0xc
mov eax, ebx
xor byte [ebp + eax - 0x44], 0x36
inc eax
cmp eax, 0x40
jb 0x4e2141
push esi
call fcn.004e1cfd
push 0x40
lea eax, [ebp - 0x44]
push eax
push esi
call fcn.004e1d2f
add esp, 0x10
xor byte [ebp + ebx - 0x44], 0x6a
inc ebx
cmp ebx, 0x40
jb 0x4e2161
add esi, 0x60
push esi
call fcn.004e1cfd
push 0x40
lea eax, [ebp - 0x44]
push eax
push esi
call fcn.004e1d2f
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0046170f
leave
ret 8
Function at 0x4e2cd1
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, ecx
xor esi, esi
lea eax, [edi + 8]
cmp dword [eax], esi
jne 0x4e2ce9
push eax
call fcn.004d7bf7
pop ecx
test eax, eax
jne 0x4e2cfb
lea eax, [edi + 0xc]
cmp dword [eax], esi
jne 0x4e2cf9
push eax
call fcn.004d7bf7
pop ecx
mov esi, eax
mov eax, esi
pop edi
pop esi
ret

Function at 0x4e30d3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi + 0x18]
mov dword [esi + 8], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0xc], eax
xor eax, eax
mov word [esi], ax
cmp byte [edi + 1], al
je 0x4e3150
mov bl, byte [edi + 2]
lea eax, [edi + 0x20]
push eax
lea ecx, [esi + 0x24]
call fcn.004a0f4f
movzx eax, byte [edi + 4]
mov ecx, esi
push eax
push 0x800
call fcn.004e31b5
mov eax, dword [edi + 0x10]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x68], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x6c], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x70], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x74], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x78], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x7c], eax
mov al, byte [edi + 3]
mov byte [esi + 0x80], al
jmp 0x4e3159
mov ecx, esi
call fcn.004ce398
mov bl, al
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0x38]
mov dword [esi + 0x48], ecx
mov ecx, dword [edx + 0x3c]
mov dword [esi + 0x4c], ecx
xor ecx, ecx
mov dword [esi + 0x40], 0x3f
mov byte [esi + 5], cl
test bl, bl
jne 0x4e3184
mov eax, dword [ebp + 0xc]
mov byte [ebp + 0x14], 1
cmp byte [eax + 0x24], cl
jne 0x4e3187
mov byte [ebp + 0x14], cl
push dword [ebp + 0x14]
mov ecx, esi
push 1
call fcn.004e31b5
test bl, bl
je 0x4e31b0
xor eax, eax
mov byte [esi + 4], 0x14
mov word [esi + 2], ax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x1c], eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4e5f5b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi], 0
je 0x4e5f6e
xor eax, eax
jmp 0x4e5ff8
lea eax, [esi + 0x30]
push edi
push eax
call fcn.004d7c0b
pop ecx
test eax, eax
jne 0x4e5ff4
xor edi, edi
lea eax, [esi + 0x14]
inc edi
push eax
mov dword [esi + 0x28], edi
call fcn.004d7bf7
pop ecx
test eax, eax
jne 0x4e5ff4
lea eax, [esi + 0x18]
push eax
call fcn.004d7bf7
pop ecx
test eax, eax
jne 0x4e5ff4
lea eax, [esi + 0x1c]
push eax
call fcn.004d7bf7
pop ecx
test eax, eax
jne 0x4e5ff4
push dword [ebp + 0x14]
lea eax, [esi + 0x20]
push dword [ebp + 0x14]
push eax
call fcn.004d7d14
add esp, 0xc
test eax, eax
jne 0x4e5ff4
push dword [ebp + 0x14]
push eax
lea eax, [esi + 0x24]
push eax
call fcn.004d7d14
add esp, 0xc
test eax, eax
jne 0x4e5ff4
push dword [ebp + 0x10]
lea eax, [esi + 0x10]
mov dword [esi + 4], edi
push dword [ebp + 0xc]
push eax
call fcn.004d7d73
add esp, 0xc
test eax, eax
jne 0x4e5ff4
mov dword [esi], edi
jmp 0x4e5ff7
push 0xc
pop eax
pop edi
pop esi
pop ebp
ret
Function at 0x4e61a6
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 4]
cmp dword [ebx], 0
jne 0x4e61bd
push ebx
call fcn.004d7bf7
pop ecx
test eax, eax
jne 0x4e61ff
push edi
lea edi, [esi + 8]
cmp dword [edi], 0
jne 0x4e61d1
push edi
call fcn.004d7bf7
pop ecx
test eax, eax
jne 0x4e61fe
push ebx
call fcn.004d7c7f
push edi
call fcn.004d7c7f
lea eax, [esi + 0xc]
mov byte [esi + 0x10], 0
cmp dword [eax], 0
pop ecx
pop ecx
je 0x4e61ef
xor eax, eax
jmp 0x4e61fe
push esi
push 0x4e6168
push eax
call fcn.004d7d73
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4ebeea
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x57b300]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [edi]
and dword [edi + 4], 0
mov word [eax], cx
xor eax, eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x210]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
mov ecx, edi
lea eax, [ebp - 0x210]
push eax
call fcn.004a105d
lea eax, [esi - 1]
mov ecx, 0x103
cmp ecx, eax
mov ecx, dword [ebp - 4]
pop edi
sbb al, al
xor ecx, ebp
inc al
pop esi
call fcn.0046170f
leave
ret

Function at 0x4ebf77
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret

Function at 0x4ec5e7
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, eax
mov eax, ecx
pop ebp
ret
Function at 0x50dbbb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0050da31

Function at 0x51ccc3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x3df37b54
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x3eab3c20
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x40de38
mov ecx, 0x2a3a4340
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
mov eax, section..rdata
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x798543a6
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x406de0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
jmp fcn.00431219

Function at 0x4019c3
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov dword [0x4040d0], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x4019d6
push esp
mov dword [ebp - 0x24], 0x4016fe
mov eax, dword [0x4040d0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.solienty
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4040d0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.absent
push str.solienty
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4040d8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401a75
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401a56
pop ebp
ret 0x10

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x4819473b
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x2fc602be
nop
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x42e004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x508a4162
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
mov ecx, 0x38431a7
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x431084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x4013da
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x850
mov edx, dword [0x84e86c]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x20], esi
push edi
mov edi, dword [esi]
mov eax, dword [esi + 4]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0xc], eax
cmp edx, 0x594
jne 0x40141b
push ebx
lea eax, [ebp - 0x850]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, dword [0x84e86c]
mov eax, dword [0x41b2f8]
lea ecx, [ebp - 8]
mov dword [ebp - 0x24], eax
mov eax, dword [0x41b2fc]
mov dword [ebp - 8], ebx
mov dword [ebp - 0x30], 0x9e3779b9
mov dword [ebp - 0x1c], eax
call fcn.004013ce
add dword [ebp - 8], 0x23f
cmp edx, 0x14
jne 0x401458
push ebx
lea eax, [ebp - 0x450]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextVolumeA]
mov ecx, dword [0x41b300]
mov ebx, dword [0x41b304]
mov esi, dword [ebp - 0xc]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x18], 0x20
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, edi
mov edx, 0xedeb2e40
shl eax, 4
add eax, ecx
cmp dword [0x84e86c], 0xfa9
mov dword [ebp - 4], eax
mov eax, dword [0x84e868]
cmove eax, edx
xor edx, edx
cmp dword [0x84e86c], 0x3eb
mov dword [0x84e868], eax
mov eax, dword [0x84e7c0]
cmove eax, edx
mov edx, dword [ebp - 8]
mov dword [0x84e7c0], eax
lea edx, [edx + edi]
mov eax, dword [ebp - 0x14]
shr eax, 5
mov dword [ebp - 0x10], eax
add dword [ebp - 0x10], ebx
mov ecx, dword [ebp - 4]
mov dword [0x84e864], 0xf4ea3dee
call fcn.004013ab
mov ecx, dword [ebp - 0x10]
xor ecx, eax
mov dword [ebp - 4], eax
cmp dword [0x84e86c], 0x213
mov dword [ebp - 0x10], ecx
jne 0x401531
lea eax, [ebp - 0x3c]
xor ebx, ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
lea eax, [ebp - 0x450]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x34]
push eax
push ebx
lea eax, [ebp - 0x50]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
mov ecx, dword [ebp - 0x10]
sub esi, ecx
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov ebx, esi
mov ecx, dword [ebp - 0xc]
add eax, esi
mov edx, dword [ebp - 4]
shr ebx, cl
xor edx, eax
add ebx, dword [ebp - 0x1c]
cmp dword [0x84e86c], 0xb03
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], edx
jne 0x401573
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
mov edx, dword [ebp - 4]
mov ebx, dword [ebp - 0x10]
xor edx, ebx
mov ecx, edi
mov dword [ebp - 4], edx
call fcn.004013d5
mov edi, eax
mov dword [ebp - 0x14], edi
mov eax, dword [ebp - 0x30]
sub dword [ebp - 8], eax
dec dword [ebp - 0x18]
mov ecx, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x28]
jne 0x401474
mov dword [ebp - 0xc], esi
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
mov dword [esi], edi
pop edi
mov dword [esi + 4], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4015ae
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x84e86c]
sub esp, 0x400
push esi
mov esi, eax
shr esi, 3
push edi
mov edi, dword [0x84e7c4]
test esi, esi
je 0x4015fc
cmp eax, 0x959
jne 0x4015e8
push 0
lea eax, [ebp - 0x400]
push eax
push str.peturoj
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ecx, edi
call fcn.004013da
add edi, 8
dec esi
je 0x4015fc
mov eax, dword [0x84e86c]
jmp 0x4015cd
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4