joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40281c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40a004]
jne 0x402826
repz ret
jmp fcn.00402a2b

Function at 0x40488b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40a004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004037d3
and dword [ebp - 0x14], 0
cmp dword [0x44b84c], 0
mov dword [ebp - 0x18], eax
jne 0x40493e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4049e6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4049e6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x44b84c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x44b850], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x44b854], eax
call edi
push eax
call esi
mov dword [0x44b85c], eax
test eax, eax
je 0x40493e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x44b858], eax
mov eax, dword [0x44b858]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x404997
cmp dword [0x44b85c], ecx
je 0x404997
push eax
call esi
push dword [0x44b85c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404997
test ebx, ebx
je 0x404997
call edi
test eax, eax
je 0x40498e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40498e
test byte [ebp - 8], 1
jne 0x404997
or dword [ebp + 0x10], 0x200000
jmp 0x4049ca
mov eax, dword [0x44b850]
cmp eax, dword [ebp - 0x18]
je 0x4049ca
push eax
call esi
test eax, eax
je 0x4049ca
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4049ca
mov eax, dword [0x44b854]
cmp eax, dword [ebp - 0x18]
je 0x4049ca
push eax
call esi
test eax, eax
je 0x4049ca
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x44b84c]
call esi
test eax, eax
je 0x4049e6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4049e8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040281c
leave
ret

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x47a860
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x4b000]
push edi
or ebp, 0xffffffff
jmp 0x47a882
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x47a889
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47a878
mov eax, 1
add ebx, ebx
jne 0x47a89b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x47a8ac
jne 0x47a8cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47a8cb
dec eax
add ebx, ebx
jne 0x47a8b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x47a890
add ebx, ebx
jne 0x47a8c7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x47a91d
xor ecx, ecx
sub eax, 3
jb 0x47a8e3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x47a952
sar eax, 1
mov ebp, eax
jmp 0x47a8ee
add ebx, ebx
jne 0x47a8ee
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47a8bc
inc ecx
add ebx, ebx
jne 0x47a8fc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47a8bc
add ebx, ebx
jne 0x47a909
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x47a8fe
jne 0x47a91a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x47a8fe
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x47a93c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x47a92e
jmp 0x47a87e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x47a93c
add edi, ecx
jmp 0x47a87e
pop esi
mov edi, esi
mov ecx, 0x27d5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x47a95a
cmp byte [edi], 0x2d
jne 0x47a95a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x47a95f
lea edi, [esi + 0x77000]
mov eax, dword [edi]
or eax, eax
je 0x47a9d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x7bb68]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7bc80]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x47a98c
mov ecx, edi
jns 0x47a9bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x7bc84]
or eax, eax
je 0x47a9d1
mov dword [ebx], eax
add ebx, 4
jmp 0x47a9a9
call dword [esi + 0x7bc8c]
mov ebp, dword [esi + 0x7bc88]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x47aa0b
sub esp, 0xffffff80
jmp 0x448e60
Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x5e256965
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x1a58000b
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x402720
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x402806
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x4027f5
jg 0x402760
test edx, edx
je 0x4027f5
nop dword [eax]
call fcn.00403a20
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x4027b4
jg 0x402777
test esi, esi
je 0x4027b4
cmp ebx, eax
jg 0x402787
jl 0x402781
cmp edi, esi
jae 0x402787
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.00407110
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x4027d9
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
movzx eax, byte [eax]
push eax
call dword [edx + 0xc]
cmp eax, 0xffffffff
je 0x4027ef
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x402760
jl 0x4027ef
test edi, edi
jne 0x402760
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x402828
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x40282a
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x4028a8
jg 0x40283d
test esi, esi
je 0x4028a8
test eax, eax
jl 0x40288c
jg 0x402847
test ebx, ebx
je 0x40288c
cmp edi, eax
jg 0x402857
jl 0x402851
cmp esi, ebx
jae 0x402857
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.00407110
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [esp + 0x14]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x4028a8
jg 0x40288f
test esi, esi
je 0x4028a8
jmp 0x40288f
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x4028a8
push eax
push esi
push 1
push edx
call fcn.0040aeef
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4028c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x4028f2
jl 0x4028e5
test ecx, ecx
jne 0x4028f2
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x4029b2
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.00403a40
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x40295e
jg 0x40291d
test esi, esi
je 0x40295e
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x402935
mov eax, dword [esp + 0x10]
jl 0x40292f
cmp eax, esi
jae 0x402935
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.00407110
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x40297f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x40299b
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x402904
jl 0x40299b
test ecx, ecx
jne 0x402904
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x4029f1
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x4029f1
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.00407110
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
cmp dword [ebx + 0x4c], 0
mov ecx, edi
je 0x402a60
mov esi, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [esi], eax
jne 0x402a17
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
mov ecx, edi
cmp edi, 0xfff
jbe 0x402a49
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.0040b546
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x402a74
cmp edi, eax
ja 0x402a25
test ecx, ecx
je 0x402a60
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.0040b546
mov ecx, edi
add esp, 0x10
sub ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, ecx
sbb edx, 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x402de0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x435008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x402e10
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404e42
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x402e4c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x402e4c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404e42
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x402f34
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x402e74
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x402ea7
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.00409de2
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404e42
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
sub eax, 0
je 0x402f07
sub eax, 1
je 0x402f07
sub eax, 2
jne 0x402f34
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.00409de2
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404e42
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x402f24
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0040aeef
add esp, 0x10
cmp edi, eax
jne 0x402f34
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x402e37
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404e42
mov esp, ebp
pop ebp
ret 4
Function at 0x403750
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x435008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x40380a
cmp byte [esi + 0x3d], 0
je 0x40380a
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x4037f8
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x4037c0
sub eax, 1
je 0x4037c4
sub eax, 2
jne 0x4037f8
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404e42
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4037e1
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0040aeef
add esp, 0x10
cmp edi, eax
jne 0x4037f8
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404e42
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404e42
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00404e42
mov esp, ebp
pop ebp
ret

Function at 0x403d70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x426850
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x435008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00405052
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00405dd4
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x417e63
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00417cd9

Function at 0x41cbeb
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041c73e
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x40300d
Capabilities:
Terminate process

Disassembly:
mov dword [0x402020], eax
call dword [sym.imp.kernel32.dll_GetTickCount]
call dword [sym.imp.kernel32.dll_GetVersion]
mov edx, eax
xor edi, edi
xor esi, esi
push dword [0x4035d8]
call dword [sym.imp.winmm.dll_waveInClose]
add eax, 6
test eax, 0xb
jne 0x403046
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
mov edx, eax
ret
Function at 0x4016b9
Capabilities:
Get file system object information

Disassembly:
mov dword [0x4061db], 0
mov eax, dword [0x4061db]
mov ecx, 0
push ecx
xor ecx, ecx
push ecx
call dword [sym.imp.USER32.DLL_LoadMenuW]
mov dword [0x40600d], 0
mov eax, dword [0x40600d]
mov dword [0x406039], 0
mov ecx, dword [0x406039]
push ecx
push 0
pop ecx
push ecx
call dword [sym.imp.USER32.DLL_LoadMenuW]
mov edx, 0
mov eax, edx
mov dword [0x406168], eax
push 0xf78
pop ebx
sub ebx, edi
cmp ebx, 0xbce
jbe 0x401723
rol ebx, 6
shr ebx, 1
add ebx, dword [0x40607d]
sub ebx, 0x5ae
add ebx, 0xf65
add ebx, esi
mov ecx, ebx
add ecx, ebx
add ecx, 0xd7
ja 0x401753
sub ecx, 0x19c
je 0x401753
add ecx, dword [0x40606f]
mov dword [0x4060a8], ecx
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
push 0x406109
push 0x21405e
pop edx
shl edx, 1
call dword [edx]
push 0
push 0
push 0
push 0
push 0x406109
mov edx, dword [sym.imp.shell32.dll_SHGetFileInfoA]
call edx
push 0
push 0
push 0
push 0
push 0x406109
mov edx, 0x2140ec
shl edx, 1
call dword [edx]
mov ecx, 0
inc ecx
sub ecx, ecx
sub ecx, 0xbb6
cmp ecx, 0x3e
jb 0x4017bc
dec ecx
rol ecx, 8
sub ecx, 0xa67
jbe 0x4017cd
sub ecx, dword [0x406024]
add ecx, 0x858
inc ecx
ror ecx, 1
sub ecx, dword [0x40609f]
add dword [0x4060c2], ecx
sub eax, 0x13479e5
mov ebx, 0x182
shr ebx, 7
mov ecx, ebx
sub ecx, ecx
ror ecx, 1
sub ecx, dword [0x40616d]
add ecx, eax
sub ecx, 0xb9b
rol ecx, 1
sub ecx, dword [0x406015]
add ecx, ecx
mov dword [0x4061f8], ecx
sub eax, 0xfe8b6d2b
mov dword [0x4061b9], eax
lea ecx, [ecx + 0x406054]
add ecx, 0x82b
rol ecx, 3
dec ecx
sub ecx, esi
sub dword [0x40601f], ecx
add ecx, dword [0x406138]
shl ecx, 1
inc ecx
shl ecx, 1
add dword [0x406232], ecx
push dword [0x4061b9]
lea ecx, [eax + 0x406171]
shl ecx, 1
sub ecx, 0xa5
mov dword [0x406196], ecx
shr ecx, 1
add ecx, dword [0x406141]
dec ecx
sub ecx, 0x882
sub ecx, ebx
mov eax, ecx
sub eax, 0x643
jne 0x401880
add eax, dword [0x406228]
add dword [0x4060c7], eax
ret

Function at 0x5d8e4b
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x5d8b64
sub eax, eax
push 0x70d3331e
pop eax
call fcn.005d8e85
sub edi, edi
xor dword [ebx], esi
or eax, edi
add ebx, 2
dec eax
cmp ebx, edx
jl fcn.005d8e4b
sub edi, 0x36a2a953
mov eax, eax
ret
Function at 0x424690
Capabilities:
Extract resource via kernel32 functions

Disassembly:
invalid
jno 0x424613
add edi, dword [ebx + 0x56708ddc]
int3
je 0x424948
jne 0x424948
or dword [edi], 0x800000
push 0xbe4234
mov eax, dword [0x699a3fa0]
push dword [ebp - 0x90]
mov dword [esi + 0x18], 0x11153e70
call dword [fcn.0044a3a8]
jnp 0x424687
mov ch, 0x25
or bl, bh
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4247da
pop edi
je 0x424b49
jne 0x424b49
push 0xab3d0c
push 0xa90c94
mov eax, dword [eax + 0xd]
adc ah, byte [ebp + 0xade31a4]
arpl word [edi + 0x53], bp
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x424af3
ret
push esi
jmp 0x4249f8
push ebp
mov ebp, esp
push 0x4246f6
ret
mov esi, eax
push 0x4248da
ret
push eax
je 0x424b6c
jne 0x424b6c
push 0xadff9c
push 0x10180274
cmp edi, 0x42d320
mov esi, dword [0x44a388]
mov edx, dword [0x100040f0]
push 0x1153d3f8
lea eax, [ecx - 1]
lea eax, [esi + 0x3a4]
imul eax, dword [esi + 0x1c]
aas
sbb al, 0x67
adc al, 0x5e
pop edi
pop ebx
pop ebp
ret
pop ebp
ret
pop ebx
je 0x424ab1
jne 0x424ab1
mov eax, dword [0x11540688]
push 0xbc830c
mov eax, 0x548a68
adc byte [esi], dl
arpl bp, cx
dec ebx
xchg ebx, eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_LockResource]
je 0x42496f
jne 0x42496f
mov eax, dword [0xf54b38]
mov eax, 0x10007ae0
mov dword [0x1129e9ac], edx
mov eax, 0x103698e4
mov dword [0x112aca4c], eax
mov byte [esi + 0x300], 0
push 0x10247cb0
adc dword [ecx + 0x63], ecx
mov byte [esi + ecx + 0xde], bl
jmp dword [0x106df55c]

Function at 0x4546bb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x51481c]
jne 0x4546c5
repz ret
jmp fcn.00457d54