joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47c070
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
xor ebp, ebp
push esi
cmp ebx, 1
push edi
jl 0x47c08b
cmp ebx, 8
jg 0x47c08b
mov eax, 1
jmp 0x47c08d
xor eax, eax
mov esi, dword [esp + 0x14]
push 0x4e32a0
push eax
push esi
call fcn.0047a8f0
mov eax, dword [esi + 0x6af70]
add esp, 0xc
cmp eax, ebp
mov dword [esi + 0x6af78], ebp
jne 0x47c0c4
mov dword [esi + 0x6af78], 1
mov dword [esi + 0x6af70], 0x10000
mov ecx, 0x7fff
xor eax, eax
lea edi, [esi + 0x4af70]
mov dword [esi + 0x6af6c], ebp
rep stosd dword es:[edi], eax
mov ax, word [ebx*8 + 0x4c1c32]
xor ecx, ecx
mov dword [esi + 0x6af98], eax
mov cx, word [ebx*8 + 0x4c1c30]
xor edx, edx
mov dword [esi + 0x6af9c], ecx
mov dx, word [ebx*8 + 0x4c1c34]
xor eax, eax
mov dword [esi + 0x6afa0], edx
mov ax, word [ebx*8 + 0x4c1c36]
cmp ebx, 2
mov dword [esi + 0x6af94], eax
jg 0x47c125
mov eax, dword [esp + 0x1c]
or byte [eax], 4
jmp 0x47c131
cmp ebx, 8
jl 0x47c131
mov eax, dword [esp + 0x1c]
or byte [eax], 2
lea edi, [esi + 0x1af70]
push 0x10000
push edi
push esi
mov dword [esi + 0x6af84], ebp
mov dword [esi + 0x6af74], ebp
call dword [esi + 0xc]
add esp, 0xc
cmp eax, ebp
mov dword [esi + 0x6af90], eax
je 0x47c1aa
cmp eax, 0xffffffff
je 0x47c1aa
cmp eax, 0x106
mov dword [esi + 0x6af8c], ebp
jae 0x47c175
push esi
call fcn.0047c3c0
add esp, 4
mov dword [esi + 0x6af7c], ebp
xor eax, eax
mov edx, dword [esi + 0x6af7c]
xor ecx, ecx
mov cl, byte [edi + eax]
and edx, 0x3ff
and ecx, 0x7fff
shl edx, 5
xor ecx, edx
inc eax
cmp eax, 2
mov dword [esi + 0x6af7c], ecx
jb 0x47c17d
pop edi
pop esi
pop ebp
pop ebx
ret
mov dword [esi + 0x6af8c], 1
mov dword [esi + 0x6af90], ebp
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x47c510
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
xor ebp, ebp
xor edi, edi
mov eax, dword [esi + 0x6af90]
mov dword [esi + 0x6af80], 2
test eax, eax
je 0x47c754
push ebx
cmp eax, 3
jb 0x47c58b
mov ecx, dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af7c]
xor eax, eax
and edx, 0x3ff
mov al, byte [ecx + esi + 0x1af72]
and eax, 0x7fff
shl edx, 5
xor eax, edx
and ecx, 0x7fff
mov dword [esi + 0x6af7c], eax
mov ebp, dword [esi + eax*4 + 0x4af70]
mov dword [esi + ecx*4 + 0x2af70], ebp
mov eax, dword [esi + 0x6af7c]
mov ecx, dword [esi + 0x6af84]
mov dword [esi + eax*4 + 0x4af70], ecx
test ebp, ebp
je 0x47c5cd
mov edx, dword [esi + 0x6af84]
sub edx, ebp
cmp edx, 0x7efa
ja 0x47c5cd
mov eax, dword [esi + 0x6af90]
mov ecx, dword [esi + 0x6afa0]
cmp ecx, eax
jbe 0x47c5b5
mov dword [esi + 0x6afa0], eax
push ebp
push esi
call fcn.0047c1c0
mov edi, eax
mov eax, dword [esi + 0x6af90]
add esp, 8
cmp edi, eax
jbe 0x47c5cd
mov edi, eax
cmp edi, 3
jb 0x47c6c6
mov ecx, dword [esi + 0x6af84]
mov ebx, dword [esi + 0x6af88]
lea eax, [edi - 3]
sub ecx, ebx
push eax
push ecx
push esi
call fcn.0047b8c0
mov edx, dword [esi + 0x6af90]
mov ecx, dword [esi + 0x6af98]
add esp, 0xc
sub edx, edi
mov ebx, eax
cmp edi, ecx
mov dword [esi + 0x6af90], edx
mov eax, edx
ja 0x47c674
cmp eax, 3
jb 0x47c674
dec edi
mov ebp, dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af7c]
inc ebp
xor eax, eax
mov ecx, ebp
mov dword [esi + 0x6af84], ebp
and edx, 0x3ff
mov al, byte [esi + ecx + 0x1af72]
and ecx, 0x7fff
and eax, 0x7fff
shl edx, 5
xor eax, edx
dec edi
mov dword [esi + 0x6af7c], eax
mov ebp, dword [esi + eax*4 + 0x4af70]
mov dword [esi + ecx*4 + 0x2af70], ebp
mov eax, dword [esi + 0x6af7c]
mov ecx, dword [esi + 0x6af84]
mov dword [esi + eax*4 + 0x4af70], ecx
jne 0x47c614
jmp 0x47c6f0
mov edx, dword [esi + 0x6af84]
xor eax, eax
add edx, edi
push 0x4e32fc
mov dword [esi + 0x6af84], edx
push 1
mov al, byte [edx + esi + 0x1af70]
lea ecx, [edx + esi]
xor edx, edx
mov dword [esi + 0x6af7c], eax
mov dl, byte [ecx + 0x1af71]
and eax, 0x3ff
and edx, 0x7fff
push esi
shl eax, 5
xor edx, eax
xor edi, edi
mov dword [esi + 0x6af7c], edx
call fcn.0047a8f0
add esp, 0xc
jmp 0x47c6f6
mov eax, dword [esi + 0x6af84]
xor ecx, ecx
mov cl, byte [eax + esi + 0x1af70]
push ecx
push 0
push esi
call fcn.0047b8c0
mov ecx, dword [esi + 0x6af90]
add esp, 0xc
dec ecx
mov ebx, eax
mov dword [esi + 0x6af90], ecx
inc dword [esi + 0x6af84]
test ebx, ebx
je 0x47c730
mov eax, dword [esi + 0x6af74]
test eax, eax
jl 0x47c70d
lea ecx, [eax + esi + 0x1af70]
jmp 0x47c70f
xor ecx, ecx
mov edx, dword [esi + 0x6af84]
push 0
sub edx, eax
push edx
push ecx
push esi
call fcn.0047b680
mov eax, dword [esi + 0x6af84]
add esp, 0x10
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0x47c745
push esi
call fcn.0047c3c0
add esp, 4
mov eax, dword [esi + 0x6af90]
test eax, eax
jne 0x47c534
pop ebx
mov eax, dword [esi + 0x6af74]
test eax, eax
jl 0x47c767
lea ecx, [eax + esi + 0x1af70]
jmp 0x47c769
xor ecx, ecx
mov edx, dword [esi + 0x6af84]
push 1
sub edx, eax
push edx
push ecx
push esi
call fcn.0047b680
add esp, 0x10
pop edi
pop esi
pop ebp
ret
Function at 0x47d730
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x50
push esi
mov esi, dword [esp + 0x58]
push esi
call dword [0x4b81a8]
cmp eax, 1
je 0x47d74e
mov eax, 0x1000000
pop esi
add esp, 0x50
ret
lea eax, [esp + 0x20]
push eax
push esi
call dword [0x4b81ac]
test eax, eax
jne 0x47d768
mov eax, 0x200
pop esi
add esp, 0x50
ret
mov eax, dword [esp + 0x20]
push ebp
mov edx, eax
xor ebp, ebp
and edx, 1
push edi
je 0x47d77c
mov ebp, 1
test al, 2
je 0x47d783
or ebp, 2
test al, 4
je 0x47d78a
or ebp, 4
mov ecx, eax
and ecx, 0x10
je 0x47d794
or ebp, 0x10
test al, 0x20
je 0x47d79b
or ebp, 0x20
test ecx, ecx
je 0x47d7a7
or ebp, 0x40000000
jmp 0x47d7ad
or ebp, 0x80000000
or ebp, 0x1000000
test edx, edx
jne 0x47d7bd
or ebp, 0x800000
push ebx
push 0
push esi
call dword [0x4b81b0]
cmp eax, 0x28
mov dword [esp + 0x14], eax
jbe 0x47d86b
mov edi, dword [0x4b81b4]
push 0
push 0
push 0
push esi
call edi
mov ebx, dword [0x4b81f8]
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x6c]
push 2
push edx
push esi
call ebx
push 0
push 0
push 0x24
push esi
call edi
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x24]
push 4
push ecx
push esi
call ebx
cmp word [esp + 0x64], 0x54ad
jne 0x47d86b
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
lea edx, [eax + 0x34]
cmp ecx, edx
jbe 0x47d86b
push 0
push 0
push eax
push esi
call edi
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x2c]
push 4
push ecx
push esi
call ebx
mov eax, dword [esp + 0x24]
cmp eax, 0x5a4d
je 0x47d865
cmp eax, 0x454e
je 0x47d865
cmp eax, 0x454c
je 0x47d865
cmp eax, 0x4550
jne 0x47d86b
or ebp, 0x400000
mov eax, dword [esp + 0x68]
pop ebx
test eax, eax
je 0x47d876
mov dword [eax], ebp
mov eax, dword [esp + 0x68]
test eax, eax
je 0x47d884
mov edx, dword [esp + 0x10]
mov dword [eax], edx
mov esi, dword [esp + 0x6c]
mov edi, dword [0x4b81b8]
test esi, esi
je 0x47d8ee
lea eax, [esp + 0x20]
lea ecx, [esp + 0x34]
push eax
push ecx
call edi
lea edx, [esp + 0x18]
lea eax, [esp + 0x3c]
push edx
push eax
call edi
lea ecx, [esp + 0x10]
lea edx, [esp + 0x2c]
push ecx
push edx
call edi
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push eax
push ecx
call fcn.0047d670
mov edx, dword [esp + 0x24]
mov dword [esi], eax
mov eax, dword [esp + 0x20]
push edx
push eax
call fcn.0047d670
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push ecx
push edx
mov dword [esi + 4], eax
call fcn.0047d670
add esp, 0x18
mov dword [esi + 8], eax
mov esi, dword [esp + 0x70]
test esi, esi
je 0x47d931
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x3c]
push eax
push ecx
call edi
lea edx, [esp + 0x64]
lea eax, [esp + 0x60]
push edx
lea ecx, [esp + 0x40]
push eax
push ecx
call dword [0x4b81bc]
mov edx, dword [esp + 0x60]
mov eax, dword [esp + 0x64]
and edx, 0xffff
and eax, 0xffff
shl edx, 0x10
or edx, eax
mov dword [esi], edx
pop edi
pop ebp
xor eax, eax
pop esi
add esp, 0x50
ret
Function at 0x480c60
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x480c6b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x480d6e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x4c3454]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4c3454]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4c3454]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4c3454]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4c3454]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4c3454]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4c3454]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4c3454]
xor eax, edx
inc ecx
dec edi
jne 0x480c86
pop edi
test esi, esi
je 0x480d90
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4c3454]
xor eax, edx
inc ecx
dec esi
jne 0x480d72
pop esi
pop ebx
not eax
ret
Function at 0x401100
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push eax
push dword [esp + 4]
call fcn.004014c0
add esp, 8
test eax, eax
jne 0x4012be
mov eax, dword [0x408470]
test eax, eax
jne 0x401145
mov ecx, dword [0x4084dc]
mov edx, 0x405aa0
call fcn.00402a60
mov dword [0x408470], eax
push ebx
push esi
push edi
push 0x405444
call eax
mov esi, eax
add esp, 4
test esi, esi
je 0x401210
mov eax, dword [0x408494]
test eax, eax
jne 0x40117a
mov ecx, dword [0x4084dc]
mov edx, 0x405c18
call fcn.00402a60
mov dword [0x408494], eax
push 0
push 0
push 0x408018
call eax
mov ebx, dword [str._MessageBox]
mov edi, eax
mov eax, dword [0x408508]
add esp, 0xc
test eax, eax
jne 0x4011ae
mov ecx, dword [0x4084dc]
mov edx, 0x405c00
call fcn.00402a60
mov dword [0x408508], eax
push edi
push ebx
push esi
call eax
mov eax, dword [0x408494]
add esp, 0xc
test eax, eax
jne 0x4011d4
mov ecx, dword [0x4084dc]
mov edx, 0x405c18
call fcn.00402a60
mov dword [0x408494], eax
push 0
push 0
push 0x408028
call eax
mov ebx, dword [str._SHGetSpecialFolderPath]
mov edi, eax
mov eax, dword [0x408508]
add esp, 0xc
test eax, eax
jne 0x401208
mov ecx, dword [0x4084dc]
mov edx, 0x405c00
call fcn.00402a60
mov dword [0x408508], eax
push edi
push ebx
push esi
call eax
add esp, 0xc
call fcn.00401310
push 0x4052a8
mov edi, eax
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
test eax, eax
je 0x401299
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push 0
call esi
mov ebx, eax
add esp, 4
mov eax, dword [0x4084b4]
test eax, eax
jne 0x401256
mov ecx, dword [0x4084dc]
mov edx, 0x4057a0
call fcn.00402a60
mov dword [0x4084b4], eax
push 0x4052b8
push ebx
call eax
add esp, 8
test eax, eax
je 0x401299
push 0
call esi
mov esi, eax
add esp, 4
mov eax, dword [0x408550]
test eax, eax
jne 0x40128c
mov ecx, dword [0x4084dc]
mov edx, 0x4057b4
call fcn.00402a60
mov dword [0x408550], eax
push 0
push 0x4052b8
push esi
call eax
add esp, 0xc
mov eax, dword [0x408454]
test eax, eax
jne 0x4012b7
mov ecx, dword [0x4084dc]
mov edx, 0x405828
call fcn.00402a60
mov dword [0x408454], eax
call eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret 0x10
Function at 0x406427
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test edx, edx
jle 0x406449
push esi
not eax
push edi
movzx esi, byte [ecx]
movzx edi, al
xor esi, edi
shr eax, 8
xor eax, dword [esi*4 + 0x46ca98]
inc ecx
dec edx
jne 0x40642f
pop edi
not eax
pop esi
ret

Function at 0x40644a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test edx, edx
not eax
je 0x406471
mov cl, byte [edx]
test cl, cl
je 0x406471
push esi
movzx esi, al
movzx ecx, cl
xor ecx, esi
shr eax, 8
xor eax, dword [ecx*4 + 0x46ca98]
inc edx
mov cl, byte [edx]
test cl, cl
jne 0x406457
pop esi
not eax
ret

Function at 0x40d86c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
push dword [ebp + 0x10]
call fcn.0040d8b0
mov ecx, 0x9e370001
mul ecx
push edx
push eax
call fcn.0040d763
add esp, 0xc
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
push ecx
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push ecx
xor byte [edi], al
inc edi
shld eax, edx, 1
rcl edx, 1
dec ecx
jne 0x40d89f
pop eax
pop ecx
pop edi
leave
ret
Function at 0x414ac6
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
test eax, eax
jne 0x414ad2
ret
mov eax, dword [esi]
push ebx
push edi
mov ecx, esi
call dword [eax + 0x10]
mov edi, eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
mov ebx, eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
test ebx, ebx
jle 0x414b0d
mov edx, edi
shl edx, 2
xor ecx, ecx
test edi, edi
jle 0x414b08
xor dword [eax + ecx*4], 0xff000000
inc ecx
cmp ecx, edi
jl 0x414afc
add eax, edx
dec ebx
jne 0x414af6
xor eax, eax
pop edi
inc eax
pop ebx
ret

Function at 0x42e4eb
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 8
lea eax, [ebp - 8]
push eax
call dword [0x457324]
push 1
call dword [0x457320]
mov ebx, dword [0x45731c]
rdtsc
push 0x64
call dword [0x4571ec]
rdtsc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
call ebx
mov esi, eax
add esi, 0x1f3
call ebx
cmp esi, eax
ja 0x42e52a
rdtsc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov edi, dword [ebp - 0x14]
cmp edi, dword [ebp - 0xc]
jl 0x42e50e
mov esi, dword [ebp - 0x18]
jg 0x42e54a
cmp esi, dword [ebp - 0x10]
jb 0x42e50e
push dword [ebp - 8]
call dword [0x457318]
sub esi, dword [ebp - 0x10]
push 0
sbb edi, dword [ebp - 0xc]
push 0x1388
push edi
push esi
call fcn.004340c0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43046d
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [0x4846bc]
mov eax, 0x4846c4
mov ecx, esi
xor edx, edx
push edi
sub ecx, eax
mov edi, dword [ecx + eax]
and edi, dword [eax]
add eax, 4
xor edx, edi
cmp eax, 0x4846d4
jl 0x430480
push 0x10
pop ecx
mov eax, edx
sar eax, cl
sar ecx, 1
xor edx, eax
test ecx, ecx
jg 0x430494
test dl, 1
jne 0x4304cc
xor eax, eax
mov edx, dword [eax*4 + 0x4846c4]
xor ecx, ecx
inc ecx
xor edi, edi
test ecx, edx
jne 0x4304c7
shl ecx, 1
inc edi
cmp edi, 0x20
jl 0x4304b3
inc eax
cmp eax, 4
jl 0x4304a7
jmp 0x4304cc
lea eax, [esi + eax*4]
xor dword [eax], ecx
pop edi
pop esi
ret

Function at 0x4304f4
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [0x4846bc]
mov dword [eax], ecx
xor ecx, ecx
inc ecx
push ebx
mov edx, dword [eax]
mov ebx, edx
shr ebx, 0x1e
xor ebx, edx
imul ebx, ebx, 0x6c078965
add ebx, ecx
mov dword [eax + 4], ebx
inc ecx
add eax, 4
cmp ecx, 0x270
jl 0x4304ff
mov dword [0x484c38], 0x270
call fcn.0043046d
mov dword [0x4888c4], 1
pop ebx
ret
Function at 0x432d17
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x4574d8
call fcn.00433eac
mov edi, 0x94
mov eax, edi
call fcn.00439800
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [0x457198]
mov ecx, dword [esi + 0x10]
mov dword [0x4849a8], ecx
mov eax, dword [esi + 4]
mov dword [0x4849b4], eax
mov edx, dword [esi + 8]
mov dword [0x4849b8], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x4849ac], esi
cmp ecx, 2
je 0x432d77
or esi, 0x8000
mov dword [0x4849ac], esi
shl eax, 8
add eax, edx
mov dword [0x4849b0], eax
xor esi, esi
push esi
mov edi, dword [0x4571a0]
call edi
cmp word [eax], 0x5a4d
jne 0x432db2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x432db2
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x432dca
cmp eax, 0x20b
je 0x432db7
mov dword [ebp - 0x1c], esi
jmp 0x432dde
cmp dword [ecx + 0x84], 0xe
jbe 0x432db2
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x432dd8
cmp dword [ecx + 0x74], 0xe
jbe 0x432db2
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.004397a2
pop ecx
test eax, eax
jne 0x432df2
push 0x1c
call fcn.00432cf3
pop ecx
call fcn.00434442
test eax, eax
jne 0x432e03
push 0x10
call fcn.00432cf3
pop ecx
call fcn.00439700
mov dword [ebp - 4], esi
call fcn.00436570
test eax, eax
jge 0x432e1c
push 0x1b
call fcn.00432cce
pop ecx
call dword [0x457134]
mov dword [0x489d0c], eax
call fcn.004395de
mov dword [0x484768], eax
call fcn.0043953c
test eax, eax
jge 0x432e42
push 8
call fcn.00432cce
pop ecx
call fcn.00439309
test eax, eax
jge 0x432e53
push 9
call fcn.00432cce
pop ecx
push 1
call fcn.00437554
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x432e69
push eax
call fcn.00432cce
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [0x457138]
call fcn.004392ac
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x432e8a
movzx eax, word [ebp - 0x40]
jmp 0x432e8d
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00407048
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x432eab
push edi
call fcn.00437681
call fcn.004376a3
jmp 0x432edd
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00433ee7
ret
Function at 0x43ae6d
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x43ae9b
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x43aea2
cmp ebx, dword [eax + 4]
jae 0x43aea2
xor eax, eax
jmp 0x43b092
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x43aeb3
xor eax, eax
inc eax
jmp 0x43b091
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x43aec9
cmp ecx, edx
jae 0x43b00e
cmp dword [eax + 4], 0
je 0x43aed2
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x43aeba
cmp dword [ebp + 8], 0
je 0x43aef4
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x43b00e
cmp eax, esi
jae 0x43b00e
mov eax, dword [0x484b30]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x43af19
cmp dword [esi*4 + 0x484b38], edi
je 0x43b012
inc esi
cmp esi, eax
jl 0x43af07
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x4570bc]
test eax, eax
je 0x43b08e
cmp dword [ebp - 8], 0x1000000
jne 0x43b08e
test byte [ebp - 0xc], 0xcc
je 0x43af97
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x43b08e
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x43b08e
cmp word [eax + 0x18], 0x10b
jne 0x43b08e
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x43b08e
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x43af97
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x43af97
test byte [ecx + 0x27], 0x80
jne 0x43b00e
push 1
push 0x484b78
call dword [0x4570c0]
test eax, eax
jne 0x43aeab
mov ecx, dword [0x484b30]
test ecx, ecx
mov edx, ecx
jle 0x43afcb
lea eax, [ecx*4 + 0x484b34]
cmp dword [eax], edi
je 0x43afcb
dec edx
sub eax, 4
test edx, edx
jg 0x43afbf
test edx, edx
jne 0x43affc
push 0xf
pop ebx
cmp ecx, ebx
jg 0x43afd8
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x43aff0
lea eax, [edx*4 + 0x484b38]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x43afde
cmp ecx, 0x10
jge 0x43affc
inc ecx
mov dword [0x484b30], ecx
push 0
push 0x484b78
call dword [0x4570c0]
jmp 0x43aeab
xor eax, eax
jmp 0x43b091
test esi, esi
jle 0x43aeab
mov ebx, dword [0x4570c0]
push 1
push 0x484b78
call ebx
test eax, eax
jne 0x43aeab
cmp dword [esi*4 + 0x484b38], edi
je 0x43b068
mov eax, dword [0x484b30]
lea esi, [eax - 1]
test esi, esi
jl 0x43b056
cmp dword [esi*4 + 0x484b38], edi
je 0x43b052
dec esi
jns 0x43b046
test esi, esi
jge 0x43b066
cmp eax, 0x10
jge 0x43b061
inc eax
mov dword [0x484b30], eax
lea esi, [eax - 1]
jmp 0x43b068
je 0x43b080
xor ecx, ecx
test esi, esi
jl 0x43b080
lea eax, [ecx*4 + 0x484b38]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x43b06e
push 0
push 0x484b78
call ebx
jmp 0x43aeab
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4413f2
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
cmp eax, ecx
je 0x441485
mov edx, dword [eax]
mov byte [edx + 0x16], cl
mov edx, dword [eax]
mov byte [edx + 0x17], cl
mov edx, dword [eax]
mov byte [edx + 0x18], cl
mov edx, dword [eax]
push ebx
push esi
mov byte [edx + 0x19], cl
mov esi, dword [eax + 4]
xor edx, edx
cmp esi, ecx
push edi
jle 0x44143c
mov edi, dword [eax]
movzx edi, byte [edi + edx]
mov ebx, ecx
shr ebx, 0x18
xor edi, ebx
shl ecx, 8
xor ecx, dword [edi*4 + 0x45cb38]
inc edx
cmp edx, esi
jl 0x441420
xor edx, edx
cmp dword [eax + 0xc], edx
jle 0x441461
mov esi, dword [eax + 8]
movzx edi, byte [esi + edx]
mov ebx, ecx
shr ebx, 0x18
xor edi, ebx
shl ecx, 8
xor ecx, dword [edi*4 + 0x45cb38]
inc edx
cmp edx, dword [eax + 0xc]
jl 0x441446
mov edx, dword [eax]
mov byte [edx + 0x16], cl
mov esi, dword [eax]
mov edx, ecx
shr edx, 8
mov byte [esi + 0x17], dl
mov esi, dword [eax]
mov edx, ecx
shr edx, 0x10
mov byte [esi + 0x18], dl
mov eax, dword [eax]
pop edi
shr ecx, 0x18
pop esi
mov byte [eax + 0x19], cl
pop ebx
ret
Function at 0x402f9c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x46a020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403034
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403014
xor eax, eax
push ebp
push 0x40300d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403050
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403014
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x46a020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x46a020], ax
mov esp, ebp
pop ebp
ret

Function at 0x403cf8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x46c048], 0
je 0x403d59
cmp word [0x46c21c], 0xd7b2
jne 0x403d21
cmp dword [0x46c224], 0
jbe 0x403d21
mov eax, 0x46c218
call dword [0x46c234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x46a06c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403d80
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x46a030], 0
jne 0x403d75
push 0
push 0x46a064
push 0x46a06c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x403eac
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.004026e4
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x46c049], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x403e74
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc