joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b63b4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00406494
xor eax, eax
push ebp
push 0x4b58c0
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
movzx eax, word [esi + 4]
mov word [ebx + 6], ax
movzx eax, word [esi + 6]
mov word [ebx + 8], ax
movzx eax, word [esi + 8]
mov word [ebx + 0x64], ax
mov eax, dword [esi + 0xa]
call fcn.004b5a78
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
movzx eax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
cmp dword [ebp - 4], 0
je 0x4b6483
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004b41d4
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004b7004
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004b4178
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004b7080
jmp 0x4b6495
xor edx, edx
mov eax, ebx
call fcn.004b7004
xor edx, edx
mov eax, ebx
call fcn.004b7080
lea eax, [ebx + 0x50]
call fcn.00405bd0
mov byte [ebx + 0x54], 0
mov byte [ebx + 0x56], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b58c7
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004064a4
ret

Function at 0x4c3a3c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x170]
mov edx, ebx
mov eax, edi
call fcn.004c3cd8
mov esi, eax
mov dword [edi + 0x170], esi
and esi, 0xff
add dword [edi + 0x174], esi
imul esi, dword [edi + 0x174], 0x8088405
inc esi
mov dword [edi + 0x174], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x178]
mov eax, edi
call fcn.004c3cd8
mov dword [edi + 0x178], eax
pop edi
pop esi
pop ebx
ret

Function at 0x4c3ab0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [esi + 0x110]
cmp byte [eax + 0x4c], 0
jne 0x4c3ae4
mov edi, ecx
dec edi
test edi, edi
jl 0x4c3af5
inc edi
mov eax, esi
call fcn.004c3a94
xor byte [ebx], al
movzx edx, byte [ebx]
mov eax, esi
call fcn.004c3a3c
inc ebx
dec edi
jne 0x4c3acb
jmp 0x4c3af5
lea eax, [esi + 0x3bc]
push eax
push ecx
push ebx
call fcn.004b06b8
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4c3bcc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.0040601c
xor eax, eax
push ebp
push 0x4c3042
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.004c3afc
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.004c3a94
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.004c3a3c
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x4c3c0c
movzx ebx, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c3049
lea eax, [ebp - 4]
call fcn.00405bd0
ret
Function at 0x4c4aa4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c4095
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x4c4c51
mov eax, dword [ebp - 4]
call fcn.004c63fc
cmp ebx, eax
jge 0x4c4c51
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov edx, ebx
call fcn.004b3a84
mov edx, dword [fcn.004b50ac]
call fcn.00404b7c
mov esi, eax
mov eax, esi
call fcn.004b6f64
test al, al
je 0x4c4c47
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov eax, dword [esi + 0x50]
test eax, eax
je 0x4c4b26
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4c4c3a
xor eax, eax
push ebp
push 0x4c4033
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004c5048
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call fcn.00424108
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, esi
call fcn.004060ac
mov eax, dword [ebp - 8]
call fcn.004060a4
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx eax, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004c4e24
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx edx, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c407f
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x4c4c32
mov eax, dword [ebp - 4]
call fcn.004c50cc
ret
mov eax, dword [ebp - 8]
mov edx, dword [esi + 0x50]
call fcn.00405c24
jmp 0x4c4c7f
mov eax, dword [ebp - 8]
call fcn.00405bd0
jmp 0x4c4c7f
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.0040d15c
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x41dd88]
call fcn.00411aa8
call fcn.004053ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c409c
lea eax, [ebp - 0x54]
call fcn.0040649c
ret
Function at 0x40a020
Capabilities:
Get common file path
Move file

Disassembly:
sub esp, 0x200
lea eax, [esp]
push 0xff
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x40a0cb
push ebx
push esi
lea ecx, [esp + 8]
push edi
push ecx
lea edx, [esp + 0x110]
push 0x40e394
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov edi, 0x40e38c
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x210]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
test eax, eax
pop ebx
je 0x40a0b5
lea eax, [esp + 0x100]
lea ecx, [esp]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_rename]
add esp, 8
add esp, 0x200
ret
lea edx, [esp]
lea eax, [esp + 0x100]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_rename]
add esp, 8
add esp, 0x200
ret

Function at 0x4238a0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
cmp dword [0x42b444], 0
jne 0x4238c4
push 0x1019
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x4238c4
xor eax, eax
jmp 0x4238f9
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp eax, 0xfffffffe
je 0x4238d3
xor eax, eax
jmp 0x4238f9
push 0x11
call dword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, 0x1f4
jle 0x4238f1
mov eax, section..text
sub eax, 0x51615
mov dword [0x42b448], eax
mov eax, dword [0x42b448]
add eax, 4
mov esp, ebp
pop ebp
ret

Function at 0x423a60
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
jmp 0x423a78
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jae 0x423b1c
mov edx, dword [ebp - 4]
sub edx, 0x231d
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx + eax*2 + 0x463a]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
shr eax, 0xc
cmp eax, 3
jne 0x423b17
mov ecx, dword [ebp - 8]
push ecx
call fcn.00423f80
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
jne 0x423ad6
push 0x154b
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x423ad6
xor eax, eax
jmp 0x423b1c
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax - 0x4c3f8]
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx]
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + edx]
add ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
mov edx, dword [ebp + 0x10]
mov dword [edx + eax], ecx
mov eax, dword [ebp - 8]
sub eax, 0x4c3f8
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx]
sub edx, eax
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
jmp 0x423a6f
mov esp, ebp
pop ebp
ret
Function at 0x405240
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push edi
xor edi, edi
test ebx, ebx
je 0x40538b
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegDisablePredefinedCacheEx]
nop dword [eax]
call esi
add byte [edi + ebp], 6
call esi
add byte [edi + ebp], 0x58
call esi
xor byte [edi + ebp], 0x71
call esi
add byte [edi + ebp], 0x9e
call esi
add byte [edi + ebp], 0xf6
call esi
add byte [edi + ebp], 8
call esi
add byte [edi + ebp], 0xd9
call esi
xor byte [edi + ebp], 0x4f
call esi
add byte [edi + ebp], 0x31
call esi
add byte [edi + ebp], 0x8e
call esi
xor byte [edi + ebp], 0x54
call esi
add byte [edi + ebp], 0x8a
call esi
add byte [edi + ebp], 0x19
call esi
inc byte [edi + ebp]
call esi
add byte [edi + ebp], 0xcf
call esi
add byte [edi + ebp], 0xc7
call esi
xor byte [edi + ebp], 0x5b
call esi
add byte [edi + ebp], 0xea
call esi
add byte [edi + ebp], 0x7c
call esi
add byte [edi + ebp], 0x92
call esi
add byte [edi + ebp], 0xf6
call esi
call esi
add byte [edi + ebp], 0xd2
call esi
dec byte [edi + ebp]
call esi
add byte [edi + ebp], 0x8a
call esi
xor byte [edi + ebp], 0xe1
call esi
add byte [edi + ebp], 0x9b
call esi
add byte [edi + ebp], 8
call esi
add byte [edi + ebp], 0xce
call esi
add byte [edi + ebp], 0x6e
call esi
add byte [edi + ebp], 0xcb
call esi
xor byte [edi + ebp], 0x98
call esi
xor byte [edi + ebp], 0xcc
call esi
xor byte [edi + ebp], 0xa1
call esi
add byte [edi + ebp], 0x3f
call esi
add byte [edi + ebp], 0x4d
call esi
xor byte [edi + ebp], 0x63
call esi
add byte [edi + ebp], 0xc
call esi
add byte [edi + ebp], 0x3f
call esi
xor byte [edi + ebp], 0x5f
call esi
add byte [edi + ebp], 0x73
call esi
xor byte [edi + ebp], 0xcb
call esi
add byte [edi + ebp], 0x93
call esi
xor byte [edi + ebp], 0xa6
call esi
add byte [edi + ebp], 0x13
call esi
xor byte [edi + ebp], 0xce
call esi
add byte [edi + ebp], 0xa8
call esi
add byte [edi + ebp], 0x2f
call esi
add byte [edi + ebp], 0xb8
inc edi
cmp edi, ebx
jb 0x405260
pop esi
pop ebp
pop edi
pop ebx
ret
Function at 0x4061c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov eax, 0x1a1
cmp eax, 0x24
ja 0x4061d2
call 0x1875ed39
jo 0x406219
mov esi, dword [sym.imp.KERNEL32.dll_FreeConsole]
call esi
add bh, bh
salc
push 1
call dword [sym.imp.USER32.dll_GetClipCursor]
call esi
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x46f0c0], eax
sub eax, eax
je 0x406203
call 0x7640ca96
add eax, dword [eax]
push 0x37600
push section..data
call fcn.00405240
push str.warning_is_the_identify
call fcn.004062c0
push 0xb0
mov dword [ebp - 4], 0x403330
call fcn.0040977c
add esp, 0x10
test eax, eax
je 0x406243
add byte [eax], al
add byte [eax - 0x50], ch
add byte [eax], al
add bh, al
inc ebp
cld
xor byte [ebx], dh
inc eax
add al, ch
dec edi
xor eax, 0xc4830000
adc byte [ebp - 0x72f08b40], al
dec ebp
cld
lea ecx, [ebp - 4]
push ecx
mov ecx, eax
call fcn.004014c0
mov esi, eax
jmp 0x406245
xor esi, esi
test esi, esi
je 0x4062b7
lea ecx, [esi + 4]
lock inc dword [ecx]
or edi, 0xffffffff
mov eax, edi
lock xadd dword [ecx], eax
jne 0x40626e
mov ecx, dword [esi + 0x78]
test ecx, ecx
je 0x406266
mov eax, dword [ecx]
push esi
jmp 0x40626c
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
test esi, esi
je 0x40627c
cmp byte [esi + 0x6c], 0
jne 0x40627c
mov al, 1
jmp 0x40627e
xor al, al
test al, al
je 0x4062b7
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 8]
lock xadd dword [esi + 4], edi
dec edi
jne 0x4062af
mov ecx, dword [esi + 0x78]
test ecx, ecx
je 0x4062a7
mov eax, dword [ecx]
push esi
call dword [eax]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push 4
call fcn.00404db0
int3

Function at 0x40a3d3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40a412
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40a412
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40a412
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40a412
cmp dword [ecx + 0x74], 0xe
jbe 0x40a412
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x416f6c
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42b428
push 0x42b420
push str.FlsAlloc
push 0x1e
call fcn.00416dd9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x416fa0
push dword [ebp + 8]
mov ecx, esi
call dword [0x427198]
call esi
jmp 0x416fa6
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x416fea
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42b438
push 0x42b430
push str.FlsGetValue
push 0x20
call fcn.00416dd9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x417021
push dword [ebp + 8]
mov ecx, esi
call dword [0x427198]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x419b08
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004197aa

Function at 0x419b13
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00419939
Function at 0x41ad4d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0040a830
mov eax, dword [0x46d700]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00418501
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x41ad8f
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x41aeeb
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00425f90
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x46fdb8]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.0041b173
mov ecx, dword [esi*4 + 0x46fdb8]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x41aee4
cmp eax, dword [edi + ecx + 0x24]
jne 0x41aee4
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41aee4
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041b173
add esp, 0x14
test edx, edx
jl 0x41aee4
jg 0x41ae5a
test eax, eax
jb 0x41aee4
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x41aee4
jl 0x41ae74
cmp dword [ebp - 0x1008], eax
ja 0x41aee4
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x41ae92
test ebx, ebx
je 0x41aecb
cmp ecx, edi
jae 0x41aecb
mov al, byte [ecx]
cmp al, 0xd
jne 0x41aeac
lea eax, [edi - 1]
cmp ecx, eax
jae 0x41aeb8
cmp byte [ecx + 1], 0xa
jne 0x41aeb8
inc ecx
jmp 0x41aeb8
movzx eax, al
movsx eax, byte [eax + 0x46e040]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x41ae92
cmp edx, ebx
jne 0x41ae92
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x41aee9
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00409bf0
leave
ret
Function at 0x41e351
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x41e3ee
push ebx
push esi
call fcn.0041e31a
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0041d0fb
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x41e39b
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41e3ed
push edi
push eax
call fcn.0041759f
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x41e3bb
call fcn.0041679b
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41e3ec
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0041d0fb
add esp, 0x20
test eax, eax
jne 0x41e3da
push edi
call fcn.0041679b
jmp 0x41e3e2
push ebx
call fcn.0041679b
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x423096
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x46fdb8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4230d6
cmp byte [ebx], 0xa
jne 0x4230d6
or byte [eax + edi + 0x28], 4
jmp 0x4230db
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x4231d9
mov al, byte [edx]
cmp al, 0x1a
je 0x4231bb
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x42310a
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x42312f
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x423139
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x4230ec
jmp 0x4231d9
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4231b6
cmp dword [ebp - 0xc], 0
je 0x4231b6
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x46fdb8]
test byte [eax + edi + 0x28], 0x48
je 0x423190
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x42317b
mov byte [esi], dl
jmp 0x42318c
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x46fdb8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x4231d9
cmp byte [ebp - 1], 0xa
jne 0x42319f
cmp esi, ebx
jne 0x42319f
mov byte [esi], 0xa
jmp 0x4231d8
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0041b191
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4231d9
mov byte [esi], 0xd
jmp 0x4231d8
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x46fdb8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4231d5
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4231d9
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4231e2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x46fdb8]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x423225
cmp word [esi], dx
jne 0x423225
or byte [edi + eax + 0x28], 4
jmp 0x42322a
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x42337d
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x42335d
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x42326c
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4232a2
cmp eax, edx
jae 0x4232ae
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x423244
jmp 0x42337d
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x423359
cmp dword [ebp - 0x14], 0
je 0x423359
mov eax, dword [ebx*4 + 0x46fdb8]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x423331
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x4232fa
mov word [esi], cx
jmp 0x42332d
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x46fdb8]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x46fdb8]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x46fdb8]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x42337d
pop ebx
cmp word [ebp - 4], bx
jne 0x423342
cmp esi, dword [ebp + 0xc]
jne 0x423342
mov word [esi], bx
jmp 0x42337a
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041b191
add esp, 0x10
cmp word [ebp - 4], bx
je 0x42337d
push 0xd
jmp 0x423376
mov ecx, dword [ebx*4 + 0x46fdb8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x423374
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x42337d
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x425d90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x425dbd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x425dbd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
jmp 0x431219