joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101357c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x10194820]
xor eax, ebp
mov dword [ebp - 4], eax
cvtss2sd xmm0, dword [ebp + 0x10]
sub esp, 8
movsd qword [esp], xmm0
push 0x1017f46c
lea eax, [ebp - 0x104]
push eax
call fcn.100565e0
add esp, 0x10
mov ecx, dword [ebp + 0x14]
push ecx
push 0xff
lea edx, [ebp - 0x204]
push edx
lea eax, [ebp - 0x104]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x204]
push eax
call fcn.1005866c
add esp, 4
fstp dword [ebp - 0x208]
fld dword [ebp - 0x208]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10055090
mov esp, ebp
pop ebp
ret

Function at 0x10135850
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
push 4
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [edx], eax
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 4]
push edx
push 4
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret

Function at 0x10135900
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
push 0x40
push 5
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movzx edx, byte [ebp + 8]
cmp edx, 0xff
je 0x1013592c
mov eax, dword [ebp + 0xc]
mov cl, byte [ebp + 8]
mov byte [eax], cl
lea edx, [ebp + 0x10]
mov dword [ebp - 8], edx
mov eax, dword [ebp + 0xc]
add eax, 5
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
sub edx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax + 1], edx
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 4]
push edx
push 5
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret
Function at 0x101376e0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x18], 0
mov eax, 0x861110
call eax
mov edx, 0x861260
mov ecx, eax
call edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], 0
jmp 0x1013771c
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xcc
jge 0x10137848
mov ecx, dword [ebp - 8]
push ecx
mov edx, 0x83c3c0
mov ecx, dword [ebp - 0xc]
call edx
mov dword [ebp - 0x1c], eax
mov eax, 0x83cbe0
mov ecx, dword [ebp - 0xc]
call eax
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 0x20]
jne 0x10137754
jmp 0x10137848
mov edx, dword [ebp - 0x1c]
push edx
mov eax, 0x835720
mov ecx, dword [ebp - 0xc]
call eax
mov dword [ebp - 0x28], eax
push 0x40
mov ecx, dword [ebp - 8]
push ecx
mov edx, 0x83c4b0
mov ecx, dword [ebp - 0xc]
call edx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
push eax
mov edx, 0x7da660
mov ecx, dword [ebp - 0x28]
call edx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x10137843
mov eax, dword [ebp - 0x10]
movzx ecx, word [eax]
mov edx, dword [ebp + 8]
movsx eax, word [edx]
cmp ecx, eax
jne 0x10137843
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov ecx, dword [edx + 2]
cmp ecx, dword [eax + 2]
je 0x101377c0
jmp 0x10137713
mov edx, dword [ebp - 4]
movsx eax, byte [edx + 0x17]
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + 0x17]
cmp eax, edx
je 0x101377d7
jmp 0x10137713
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + 0x18]
mov edx, dword [ebp + 8]
movsx eax, byte [edx + 0x18]
cmp ecx, eax
je 0x101377ee
jmp 0x10137713
movzx ecx, byte [ebp + 0xc]
test ecx, ecx
je 0x10137817
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x16]
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 0x16]
cmp eax, edx
jl 0x10137815
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x16]
add ecx, dword [ebp - 0x14]
mov dword [ebp - 0x14], ecx
jmp 0x1013783a
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 0x16]
cmp eax, 0xffffffff
je 0x1013783a
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 0x16]
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0x16]
cmp edx, ecx
je 0x1013783a
jmp 0x10137713
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
jmp 0x10137713
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10137855
mov eax, dword [ebp - 0x14]
jmp 0x10137858
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 8
Function at 0x1013df10
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 4]
sub eax, dword [ecx + 0x40]
cmp eax, 0x3e8
jae 0x1013df31
jmp 0x1013dffb
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x1c]
cmp dword [eax + 0x14], 0
je 0x1013df67
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x1c]
mov eax, dword [edx + 0x14]
cmp dword [eax + 0x40], 0
jle 0x1013df67
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x1c]
mov eax, dword [edx + 0x14]
mov ecx, dword [eax + 0x40]
sub ecx, 1
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x1c]
mov edx, dword [eax + 0x14]
mov dword [edx + 0x40], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x1c]
add ecx, 4
mov dword [ebp - 0x10], ecx
lea edx, [ebp - 0xc]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.10009b90
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.10009bc0
jmp 0x1013df95
lea ecx, [ebp - 0xc]
call fcn.10014930
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0xc]
call fcn.100024e0
movzx edx, al
test edx, edx
je 0x1013dfef
lea ecx, [ebp - 0xc]
call fcn.1000a1a0
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x1c]
cmp dword [edx + 0x14], 0
je 0x1013dfd5
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x1c]
mov edx, dword [ecx + 0x14]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
cmp ecx, dword [edx]
jne 0x1013dfd5
jmp 0x1013df8d
mov edx, dword [ebp - 8]
cmp dword [edx + 0x40], 0
jle 0x1013dfed
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x40]
sub ecx, 1
mov edx, dword [ebp - 8]
mov dword [edx + 0x40], ecx
jmp 0x1013df8d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x40], eax
mov esp, ebp
pop ebp
ret
Function at 0x10140ec0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x10194820]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x60], ecx
mov eax, dword [ebp - 0x60]
cmp dword [eax + 0x50], 0
je 0x10140eef
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x60]
sub eax, dword [ecx + 0x50]
cmp eax, 0x1388
jae 0x10140ef4
jmp 0x10140fb3
push 0x55
push 0x50
push 0xf2
lea ecx, [ebp - 0x5c]
call fcn.1000f9b0
push 0xa
mov edx, dword [ebp - 0x60]
add edx, 4
push edx
lea eax, [ebp - 0x58]
push eax
call fcn.101353a0
add esp, 0xc
push 0xa
mov ecx, dword [ebp - 0x60]
add ecx, 0xf
push ecx
lea edx, [ebp - 0x4e]
push edx
call fcn.101353a0
add esp, 0xc
mov eax, dword [0x101a0748]
mov ecx, dword [eax]
mov dword [ebp - 0x3a], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x36], edx
mov ax, word [eax + 8]
mov word [ebp - 0x32], ax
push 0x23
push 0x1019e120
lea ecx, [ebp - 0x2c]
push ecx
call fcn.101353a0
add esp, 0xc
mov ecx, 0x104c44c9
call fcn.100a8e70
mov byte [ebp - 8], al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x30], eax
movzx edx, byte [ebp - 0x5b]
push edx
lea eax, [ebp - 0x5c]
push eax
call fcn.1012dfa0
add esp, 8
mov ecx, dword [ebp - 0x60]
mov dword [ecx + 0x50], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 0x60]
mov dword [edx + 0x24], eax
movss xmm0, dword [0x10182880]
movss dword [0x1019e6c4], xmm0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x60]
mov dword [ecx + 0x28], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10055090
mov esp, ebp
pop ebp
ret

Function at 0x10140fd0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 4]
sub eax, dword [ecx + 0x24]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x80]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + ecx*4 + 0x58]
imul ecx, ecx, 0x3e8
cmp eax, ecx
jae 0x10141002
jmp 0x101410ad
mov edx, dword [ebp - 4]
movzx eax, word [edx + 0x3c]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x2c
push ecx
call fcn.101418b0
add esp, 8
test eax, eax
je 0x10141051
mov dword [0x8793704], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 4]
mov dword [edx + 0x50], eax
movss xmm0, dword [0x10182880]
movss dword [0x1019e6c4], xmm0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x28], eax
jmp 0x101410ad
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x80]
add eax, 1
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x80], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x80], 0xa
jne 0x1014107b
mov eax, dword [ebp - 4]
mov byte [eax + 0x55], 1
jmp 0x101410ad
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x50], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 4]
mov dword [edx + 0x24], eax
movss xmm0, dword [0x10182880]
movss dword [0x1019e6c4], xmm0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x28], eax
mov esp, ebp
pop ebp
ret
Function at 0x101421c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x55]
test ecx, ecx
jne 0x101421d4
jmp 0x10142235
push 0
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x98]
call fcn.10080a30
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x98]
call fcn.10080ad0
movzx ecx, al
test ecx, ecx
je 0x1014220d
push 0x19
mov ecx, 0x104c6534
call fcn.100e72c0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0xd
mov edx, 0x791050
call edx
add esp, 4
test eax, eax
jne 0x1014222d
push 0x1b
mov eax, 0x791050
call eax
add esp, 4
test eax, eax
je 0x10142235
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret
Function at 0x101440e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [0xe61f84]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_send]
pop ebp
ret
Function at 0x10151fd0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
cmp dword [ebp + 0x10], 4
jb 0x101520a3
mov edx, dword [ebp - 4]
shr edx, 8
mov eax, 1
imul eax, eax, 0
mov ecx, dword [ebp - 8]
movzx eax, byte [ecx + eax]
xor eax, dword [ebp - 4]
and eax, 0xff
xor edx, dword [eax*4 + 0x10182480]
mov dword [ebp - 4], edx
mov ecx, dword [ebp - 4]
shr ecx, 8
mov edx, 1
shl edx, 0
mov eax, dword [ebp - 8]
movzx edx, byte [eax + edx]
xor edx, dword [ebp - 4]
and edx, 0xff
xor ecx, dword [edx*4 + 0x10182480]
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
shr eax, 8
mov ecx, 1
shl ecx, 1
mov edx, dword [ebp - 8]
movzx ecx, byte [edx + ecx]
xor ecx, dword [ebp - 4]
and ecx, 0xff
xor eax, dword [ecx*4 + 0x10182480]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
shr edx, 8
mov eax, 1
imul eax, eax, 3
mov ecx, dword [ebp - 8]
movzx eax, byte [ecx + eax]
xor eax, dword [ebp - 4]
and eax, 0xff
xor edx, dword [eax*4 + 0x10182480]
mov dword [ebp - 4], edx
mov ecx, dword [ebp - 8]
add ecx, 4
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0x10]
sub edx, 4
mov dword [ebp + 0x10], edx
jmp 0x10151fe5
cmp dword [ebp + 0x10], 0
je 0x101520e5
mov eax, dword [ebp - 4]
shr eax, 8
mov ecx, 1
imul ecx, ecx, 0
mov edx, dword [ebp - 8]
movzx ecx, byte [edx + ecx]
xor ecx, dword [ebp - 4]
and ecx, 0xff
xor eax, dword [ecx*4 + 0x10182480]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp + 0x10]
sub eax, 1
mov dword [ebp + 0x10], eax
jmp 0x101520a3
mov eax, dword [ebp - 4]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x401200
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
add esi, 0xb1
and eax, 0xc2
not edi
ror esi, 0x15
bswap edx
rcr edi, 0x9b
mov eax, 0
bswap esi
dec ebx
dec edi
bswap ebx
mov eax, 0x6d
and ebx, 0xb5
sbb edx, 0x41
rol eax, 0xf4
dec edx
sbb esi, 0xc8
rcr ebx, 0x4d
sub edi, 0x64
neg esi
add edx, 0xd8
imul eax
or edx, 0x29
add ebx, 0x43
rol edi, 0xad
imul esi
inc edx
mov edi, 0xb4
or eax, 0xfc
mov eax, 6
rol edx, 0x43
imul edi
rcl edx, 0x35
neg edi
mov edi, 0x88
rol esi, 0xf9
sub edx, 0x56
not edi
rcr eax, 0x23
rcl edx, 0x5e
bswap eax
sbb edx, 0xce
add edx, 0x20
sub edx, 0xa9
mov eax, 0x68
bswap edx
not esi
imul edi
add edi, 0xd9
sub eax, 0xbb
xor ecx, ecx
xor edi, edi
imul edi
imul esi
bswap esi
dec eax
imul edx
sbb esi, 0x1b
sbb edi, 0x6f
dec edx
and ebx, 0x56
rcl eax, 0x6e
bswap esi
neg eax
bswap eax
ror eax, 0xdd
rcr eax, 0x5a
not ebx
sbb ebx, 0xf2
rcl edx, 0xe3
rol esi, 0xe1
rcr edx, 0xa4
imul ebx
sub eax, 0xbc
dec esi
bswap edx
mov edi, 0x26
rcl eax, 0x9e
add eax, 0xb6
sub ebx, 0xe3
rol eax, 0xd3
rcl edx, 0x21
inc esi
mov eax, 0x2d
inc eax
imul esi
imul ebx
mov esi, 0xf
sbb eax, 0x8e
and edi, 0x93
ror edi, 0x67
and esi, 0x8d
sub ebx, 0xe3
bswap esi
inc eax
neg esi
rol eax, 0xf7
inc esi
bswap edi
imul ebx
imul eax
add edx, 0x29
mov ecx, dword [ebp + 0xc]
imul esi
rol ebx, 0x3d
ror eax, 0x73
sbb esi, 0x11
inc esi
not esi
rcr edi, 0x59
and edx, 0xcd
sbb ebx, 0xe3
ror edi, 0x5e
imul eax
sbb esi, 0x97
imul eax
sub ebx, 0x1c
dec edx
mov edi, 0x1f
neg edi
not edi
imul edi
sub ebx, 0xef
bswap edi
imul esi
inc esi
and ebx, 0x4c
neg ebx
imul edx
rcl edx, 0x80
inc edi
rcr edi, 0x50
and edi, 0x1b
sbb edi, 0x48
imul eax
rcl eax, 0x46
rcr ebx, 0x8b
imul esi
rcl esi, 0xc
ror edx, 0xe0
dec esi
inc edi
add ebx, 0x31
sbb ebx, 3
not eax
dec esi
inc ebx
inc ebx
add ebx, 0x15
neg edx
imul edx
rcr ebx, 0x56
ror edx, 0xde
mov edi, dword [ebp + 8]
mov esi, ebx
xor ebx, ebx
xor ebx, ebx
not byte [edi]
xor eax, eax
xor esi, eax
mov eax, esi
add byte [edi], 0x56
xor eax, ebx
mov esi, ebx
mov ebx, esi
sub byte [edi], 0x34
xor ebx, esi
mov ebx, esi
mov eax, esi
imul byte [edi]
inc edi
loop 0x4013d1
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x405cd3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404bc2
and dword [ebp - 4], 0
cmp dword [0x40e268], 0
mov ebx, eax
jne 0x405d84
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x405e35
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x405e35
push eax
call fcn.00404b50
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40e268], eax
call esi
push eax
call fcn.00404b50
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40e26c], eax
call esi
push eax
call fcn.00404b50
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40e270], eax
call esi
push eax
call fcn.00404b50
pop ecx
mov dword [0x40e278], eax
test eax, eax
je 0x405d84
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404b50
pop ecx
mov dword [0x40e274], eax
mov eax, dword [0x40e274]
cmp eax, ebx
je 0x405ddc
cmp dword [0x40e278], ebx
je 0x405ddc
push eax
call fcn.00404bcb
push dword [0x40e278]
mov esi, eax
call fcn.00404bcb
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x405ddc
test edi, edi
je 0x405ddc
call esi
test eax, eax
je 0x405dd3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x405dd3
test byte [ebp - 0xc], 1
jne 0x405ddc
or dword [ebp + 0x10], 0x200000
jmp 0x405e15
mov eax, dword [0x40e26c]
cmp eax, ebx
je 0x405e15
push eax
call fcn.00404bcb
pop ecx
test eax, eax
je 0x405e15
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405e15
mov eax, dword [0x40e270]
cmp eax, ebx
je 0x405e15
push eax
call fcn.00404bcb
pop ecx
test eax, eax
je 0x405e15
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40e268]
call fcn.00404bcb
pop ecx
test eax, eax
je 0x405e35
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x405e37
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4077d9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40da08]
jne 0x4077e3
repz ret
jmp fcn.00408cd5
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0x6d16658a
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x407e0535
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x404e3b
Capabilities:
Delete directory
Get common file path
Get file attributes
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4c
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 4]
xor esi, esi
cmp dword [0xd53cb8], 0x594
mov dword [ebp - 0xc], eax
jne 0x404e87
push 0x4048a8
push 0x4048c8
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
push 0x4048d4
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
mov eax, dword [0x80f548]
push ebx
mov ebx, dword [0x80f54c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
mov dword [ebp - 0x30], 0x9e3779b9
call fcn.00404e34
mov eax, dword [0x80f550]
add dword [ebp - 8], 0x23f
mov dword [ebp - 0x2c], eax
mov eax, dword [0x80f554]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0x20
mov dword [ebp - 0x14], 2
add dword [ebp - 0x14], 3
mov eax, dword [ebp - 0x10]
mov ecx, eax
shl ecx, 4
cmp dword [0xd53cb8], 0xc
mov dword [ebp - 4], ecx
jne 0x404f31
push esi
lea eax, [ebp - 0xc4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor eax, eax
mov word [ebp - 0x1c], ax
lea edi, [ebp - 0x1a]
stosw word es:[edi], ax
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0x44c]
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
lea eax, [ebp - 0x38]
push eax
push esi
lea eax, [ebp - 0x4c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp + 8]
mov ecx, dword [ebp - 0x2c]
add dword [ebp - 4], ecx
mov ecx, dword [0xd53cb8]
cmp ecx, 0xfa9
jne 0x404f4f
mov dword [0xd53254], 0xedeb2e40
cmp ecx, 0x3eb
jne 0x404f5d
mov dword [0xd52c08], esi
mov ecx, dword [ebp - 8]
add ecx, eax
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x14]
shr eax, cl
mov dword [0xd53250], 0xf4ea3dee
add eax, dword [ebp - 0x24]
mov ecx, eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 4], eax
xor ecx, dword [ebp - 4]
cmp dword [0xd53cb8], 0x213
mov dword [ebp - 0x18], ecx
jne 0x404f9c
push 0x4048e8
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov eax, dword [ebp - 0x18]
add dword [ebp - 0xc], 0x64
sub dword [ebp - 0xc], eax
sub dword [ebp - 0xc], 0x64
mov eax, dword [ebp - 0xc]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax]
mov ecx, dword [ebp - 0x14]
shr eax, cl
add eax, ebx
xor eax, edx
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x30]
sub dword [ebp - 8], eax
dec dword [ebp - 0x20]
jne 0x404ec6
cmp dword [0xd53cb8], 0xa6d
mov eax, dword [ebp - 0x10]
mov dword [edi], eax
pop ebx
jne 0x404ffd
push esi
push esi
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
mov eax, dword [ebp - 0xc]
mov dword [edi + 4], eax
pop edi
pop esi
leave
ret 4
Function at 0x40540d
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x424
push ebx
push esi
xor esi, esi
cmp dword [0xd53cb8], 0x400
push edi
jne 0x405476
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll__hwrite]
push esi
push esi
call fcn.00405894
push esi
push esi
call fcn.00405894
push esi
call fcn.00405af5
add esp, 0x14
push esi
push esi
push esi
call fcn.004068d5
pop ecx
mov dword [esp + 4], esi
mov dword [esp], esi
call fcn.00404d98
fstp st(0)
push esi
call fcn.0040695a
pop ecx
push esi
call fcn.004066ec
pop ecx
mov eax, dword [0x80fbd4]
mov dword [0xd53cb8], eax
mov eax, dword [0x80fbac]
mov dword [0xd53cbc], eax
call fcn.004050c7
mov dword [esp + 0x10], esi
mov ebx, 0x2b259d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, eax
mov dword [esp + 0x1c], esi
lea edi, [esp + 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push esi
lea eax, [esp + 0x3c]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp dword [esp + 0x10], ebx
jle 0x4054dd
cmp dword [esp + 0x18], 0x785074d5
jne 0x4054eb
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x1c1b
jl 0x405498
xor edi, edi
push esi
lea eax, [esp + 0x34]
push eax
push esi
push 0x404b90
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
push 0x404bdc
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
cmp edi, ebx
jle 0x40551a
cmp dword [esp + 0x18], 0x785074d5
jne 0x405523
inc edi
cmp edi, 0x11915
jl 0x4054ed
mov eax, dword [0xd52c0c]
mov dword [0xd5324c], eax
call eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x406f70
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x80e768]
jne 0x406f7a
repz ret
jmp fcn.0040e1dc