joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4037e0
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40381f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40381f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40381f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40381f
cmp dword [ecx + 0x74], 0xe
jbe 0x40381f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x408ee3
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x408f2e
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.00409082
test al, al
jne 0x408f28
sub edx, 2
cmp edx, edi
jne 0x408f0e
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x408f50
lea eax, [edi + 2]
cmp edx, eax
je 0x408f50
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.00408e2f
add esp, 0x10
jmp 0x40904a
push esi
lea ecx, [ebp - 0x255]
call fcn.00409082
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x408f93
push dword [ebp - 0x25c]
jmp 0x408f40
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x408fd0
cmp word [ebp - 0x226], 0
je 0x408ff1
cmp word [ebp - 0x226], ax
jne 0x408fd0
cmp word [ebp - 0x224], 0
je 0x408ff1
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.00408e2f
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x40903d
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x408faa
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x409025
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x40904a
push 0x408c5f
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.0040bb20
add esp, 0x10
jmp 0x40901a
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402f2c
leave
ret

Function at 0x40aae1
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4121e4
push 0x4121dc
push str.FlsAlloc
push 0x1e
call fcn.0040aa1e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40ab15
push dword [ebp + 8]
mov ecx, esi
call dword [0x410160]
call esi
jmp 0x40ab1b
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x40ab5f
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4121f4
push 0x4121ec
push str.FlsGetValue
push 0x20
call fcn.0040aa1e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40ab96
push dword [ebp + 8]
mov ecx, esi
call dword [0x410160]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x40f820
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40f84d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40f84d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x401e10
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x4042d8
call fcn.00401f7c
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x405478
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x401bd1
cmp eax, esi
jne 0x401bc4
xor esi, esi
inc esi
mov ebx, esi
jmp 0x401bd4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401bab
xor esi, esi
inc esi
mov eax, dword [0x405474]
cmp eax, esi
jne 0x401be7
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x401c16
mov eax, dword [0x405474]
test eax, eax
jne 0x401c10
mov dword [0x405474], esi
push 0x4030e4
push 0x4030d8
call fcn.00401b1a
pop ecx
pop ecx
test eax, eax
je 0x401c16
jmp 0x401d3e
mov dword [0x40513c], esi
mov eax, dword [0x405474]
cmp eax, esi
jne 0x401c3a
push 0x4030d4
push 0x4030cc
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x405474], 2
test ebx, ebx
jne 0x401c46
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x40547c], 0
je 0x401c6a
push 0x40547c
call fcn.00401f04
pop ecx
test eax, eax
je 0x401c6a
push 0
push 2
push 0
call dword [0x40547c]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x401cc6
test al, al
je 0x401c84
cmp dword [ebp - 0x1c], 0
jne 0x401cc6
mov al, byte [esi]
test al, al
je 0x401c94
cmp al, 0x20
ja 0x401c94
inc esi
mov dword [ebp - 0x20], esi
jmp 0x401c84
test byte [ebp - 0x3c], 1
je 0x401ca0
movzx eax, word [ebp - 0x38]
jmp 0x401ca3
push 0xa
pop eax
push eax
push esi
push 0
push 0x400000
call main
mov dword [0x405138], eax
cmp dword [0x40512c], 0
jne 0x401d1a
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x401cd5
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x401ce8
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x401c71
cmp dword [0x40513c], 0
jne 0x401d29
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x405138]
jmp 0x401d4a
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.00401fc1
ret
call fcn.004020ab
jmp 0x401b71
Function at 0x417963
Capabilities:
Encode data using xor

Disassembly:
cmp al, 2
jb 0x417827
cmpsd dword [esi], dword es:[edi]
mov bl, 1
rcl al, 1
xchg edx, eax
test eax, 0xb1851565
das
sbb al, 0x7f
loopne 0x417890
push ebx
sbb bl, byte [esp + esi*2 - 0x1ef4f818]
pop es
or esp, ecx
jle 0x417870
int1
outsd dx, dword [esi]
and eax, 0x6510369
or byte [ebp + 0x1c], dl
jb 0x4178b3
pop esi
mov cl, 0x57
push 0xffffffffffffffbd
cmp byte [edi + 0x7e], dl
push es
test dword [esi + 0x2a], ebx
add edx, dword [esi - 0x847e135]
xor edi, dword [ebp + 0x39e9bba3]
sub esp, ebx
xor al, 0xc8
inc edx
push cs
dec esp
jne 0x417886
arpl word [edi + 0x15b32be5], dx
cmp dword [ebx], 0x6c
arpl word [eax + 0x70], si
jo 0x4178d7
aaa
ja 0x41780e
mov esp, 0x698ea990
int1
push edi
sub dword [eax], 0xf
je 0x417865
out 0x65, al
push esi
loop 0x4178f1
add byte [edi - 8], dh
invalid
int3
xor eax, 0xcc72d655
hlt
sti
xchg dword [esi - 0x2fb54e03], ebp
nop
jae 0x417886
imul eax, dword [edx - 0x49], 0x28
mov eax, 0xc8d81f9a
scasb al, byte es:[edi]
xchg ebp, eax
sbb ecx, dword es:[edx - 0x52289ce3]
pop ss
ret
pop ds
imul edx, dword [ecx], 0xffffff9a
add dword [edi + 0x73], eax
push ebx
xor ebp, dword [ebp - 0x6de29ef5]
or al, 0xc4
push esi
scasd eax, dword es:[edi]
xor cl, dl
add cl, byte [esi]
arpl word [eax - 0x4b], cx
int 0xef
out dx, eax
mov al, byte [0x70ad]
pop ss
inc edx
inc eax
sar dl, 1
lodsd eax, dword [esi]
test dh, ah
in al, dx
mov esi, 0x446bcf53
rcr byte [ebx - 0x61], 1
mov eax, dword [0xf1f96531]
sub bh, ch
push ebp
imul esi, dword [edx - 0x3c], 0x3ef7f117
xchg dword [ebx - 0x578b3ec5], edx
fisttp word [ebp + 0x294964ed]
mov esp, 0x1cd61c7f
mov edx, 0xfc1221f0
mov dl, byte [ebp - 0x69]
mov cl, 0xb4
xor dword [eax + 0x59], ecx
push cs
rcr dword [ecx + 0x2127de1b], 1
xchg ebx, eax
push ds
mov esi, 0x7f1ebc01
sbb byte [edi], 0xe8
push es
mov esi, 0x283b4271
or al, 0x68
dec ebx
xor ecx, dword [eax + 7]
mov al, byte [0x2310027c]
mov dh, 0x36
outsb dx, byte [esi]
into
daa
int1
add byte [ebx], cl
dec ebp
mov dword [edx + 0xa], eax
or dl, dl
xchg ebp, eax
mov eax, dword [0x83e070ae]
in eax, 0x69
mov ch, 0x8e
loope 0x4179b7
cwde
insb byte es:[edi], dx
insw word es:[edi], dx
push esi
and al, 0x70
pushal
daa
sbb eax, 0xcdc0d8d3
mov esp, 0x55f37fdb
inc ebp
int3

Function at 0x42e9f3
Capabilities:
Encode data using xor

Disassembly:
cmp dword [ebx - 0x24c5858d], eax
mov ebp, 0xeb0e3a0
popal
inc eax
stc
dec esi
bound esi, qword [ebx - 0x2891de91]
and dword [esi - 0x29], ebp
sbb al, ch
movsd dword es:[edi], dword [esi]
mov esp, dword [esp + ebx*8 - 0x1da1de09]
loop 0x42ea5c
cmp al, 0xc4
in al, dx
pop ebx
push esp
dec esi
xor byte [eax], ch
rcr edx, cl
outsd dx, dword [esi]
mov ecx, 0xf4920a33
push edx
jge 0x42e9d4
int3
push edi
loopne 0x42e9e7
sbb eax, 0x890e1e2
dec ebx
into
cmovnp ebx, dword [esi - 0x1fe1e0d0]
jno 0x42ea71
mul bl
ljmp 0xe5dd
invalid
Function at 0x4378ba
Capabilities:
Encode data using xor

Disassembly:
sub eax, 0x50b8caca
cli
mov bl, 0x73
xor dword [edx + 0x26892a8d], ecx
test byte [edx - 0xc], bl
sti
les eax, [ebp - 0x37]
cmp bl, ch
in eax, 0x2e
out 0xf3, eax
pop ds
push cs
and eax, 0x1109cd80
push edx
lodsb al, byte [esi]
pop ecx
mov dword [0x753126a0], eax
shl edx, 1
jo 0x43791a
in eax, dx
adc eax, 0xeae5c974
loopne 0x437946
add eax, 0x9b54017a
ret
into
cmpsd dword [esi], dword es:[edi]
pop edi
dec ebp
cdq
mov ecx, edi
leave
cmp eax, 0x379cb154
pop ds
sahf
mov es, word [ebx - 0x26]
mov eax, 0x4c991030
je 0x4379ab
adc al, 0xbd
cmp eax, 0x8bb80b3f
das
lcall 0xfae8, 0xed787e4e
neg dword [eax - 0x34902b4d]
pop edi
rcr byte [edx + 0x10], 0xb5
add al, 0x2a
mov cl, 0x6a
pushal
jle 0x437912
inc ebp
invalid
inc esi
stosd dword es:[edi], eax
mov ch, 5
mov ecx, 0x7e152b8a
sbb eax, 0xdcb039a4
invalid

Function at 0x453bb0
Capabilities:
Encode data using xor

Disassembly:
pop edx
push 0x8895178f
sahf
and al, 0x75
pop esi
push ss
mov edi, 0x4d40742f
mov bl, 0xde
fmulp st(5)
test al, 0xb0
push eax
xor bl, 0x7f
pop eax
call 0x1ae54a4a
push ebp
outsd dx, dword [esi]
adc eax, 0xad43997e
cmpsd dword [esi], dword es:[edi]
xchg ebp, eax
cmp dword [ecx - 0x49a1131f], esi
leave
and al, cl
xor ebx, edx
aad 0x4a
cmp eax, 0xb1fc9098
mov eax, 0xf7fd98fd
adc eax, 0x6fbd3140
mov ebp, 0xcc421066
xchg ecx, eax
mov cl, byte [edx - 0x29]
sbb al, 0xb5
fisttp word [edx + 0xed7a9bf]
xlatb
push cs
sub dword [esp + edi*8 - 0x770faf99], eax
xor dh, byte [eax]
test al, 0xcd
in eax, dx
dec ebp
lcall 0xcaf3, 0xa76bd10
inc edi
jo 0x453c06
cmc
pop eax
push 0xffffffffffffffb8
into
mov ebp, 0xa3f04b16
cmp byte [ebp + 0x32], dh
fimul dword [edx - 0x64]
cmp eax, 0xc82d4133
insb byte es:[edi], dx
and al, 0xfc
retf

Function at 0x45a66c
Capabilities:
Encode data using xor

Disassembly:
inc edi
or ecx, 0x50d4dd5
inc ebx
dec esi
adc dword [esi + 0x3c], 2
xor bh, byte [ebp - 0x3af9a320]
jns 0x45a6ec
xchg ebx, eax
add eax, 0xe7e972ee
xchg esi, eax
movsd dword es:[edi], dword [esi]
popal
dec ebx
aam 0xe6
dec edi
pop esp
stosd dword es:[edi], eax
cwde
inc ecx
sbb ah, byte [edi + 0x612a6346]
ud0
ficom word [eax + 0x3418e2ce]
sal dword [eax + 0x4c], cl
mov bl, 0x10
mov eax, dword [0xeafb37bb]
rcl dh, 1
fidiv dword [edx + eax*2 + 0x14]
mov bl, 0xca
dec edi
aaa
mov bh, 0xa6
invalid

Function at 0x45c162
Capabilities:
Encode data using xor

Disassembly:
xchg edx, eax
push esi
xor byte [edi], dl
cld
rol dword [ebp + 0x5b], 1
pushfd
mov dword [0x662f4a5b], eax
jecxz 0x45c13f
inc edi
adc dh, byte [edx]
insb byte es:[edi], dx
jns 0x45c18a
inc edi
sub dword [ecx - 0x5e], 0x3aa6aab3
mov esp, 0x97d16ad0
jno 0x45c129
jae 0x45c1a7
inc edx
push ebx
lodsb al, byte [esi]
sub bh, byte [0xa0cdaaf3]
dec edx
cld
mov dword [esi + edx*8], ebp
salc
salc
push eax
xchg dword [ecx + 0x52], ebp
mov ecx, 0x303236f9
daa
sub dl, byte [edx - 0x75925943]
jmp 0x45c10b
invalid
sti
jecxz 0x45c1b8
dec esp
rcl byte [ecx], 0xf1
pushal
or byte [esi + 0x66805909], 0x95
xlatb
fld qword ss:[edi - 0x40]
fld qword [edi - 0x40]
mov dl, 3
adc byte [eax], 0x18
sub eax, 0x77fe9d26
invalid
Function at 0x4645fa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x532cd8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x581a60]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0x743d0000], eax
ja 0x46460b
inc edi
wait
push edi
out 7, eax
xchg edi, eax
pop ss
stosb byte es:[edi], al
pop es
push edx
adc eax, 0xa977e787
jg fcn.004645fa
outsb dx, byte [esi]
xlatb
adc byte [esi - 0x34ac5f7b], al
adc dword [edi - 0x3e], edx
test dword gs:[eax + 0x18], edi
dec eax
xlatb
pop esp
dec edi
movsd dword es:[edi], dword [esi]
xlatb
invalid

Function at 0x46a5b2
Capabilities:
Encode data using xor

Disassembly:
test eax, 0xd334f131
std
mov al, 0x60
pop eax
jecxz 0x46a5f6
adc dword [edx - 0x3576694a], esp
popfd
push ss
ror byte [ebx - 0x29dfee91], 1
sti
pop es
add dl, dl
xor esp, ebx
and eax, 0x51067b03
call 0x1487568e
adc byte [ecx + 0x700151ca], bl
sub eax, 0xa17af244
jne 0x46a58b
salc
dec ebx
Function at 0x48a21b
Capabilities:
Encode data using xor

Disassembly:
cwde
cmp byte [0x95dbfda5], al
xchg ebp, eax
sbb dh, 0x15
dec edx
inc dword [ebx]
dec edi
dec edi
xor dword [ebx + 0x18], eax
xor dh, byte [eax + 0xf9579ff]
sbb bl, byte [edx]
mov byte [edx + 0x35], al
in eax, 0xab
or byte [esi + 0x6e55edce], dl
mov word [esi - 0x6635807a], fs
cmp ecx, dword [eax]
push edx
js 0x48a1af
retf 0x3b99
mov byte [ebx], bl
xchg dword [ecx], esp
xchg esi, eax
js 0x48a25a
jp 0x48a20a
sub dword [eax - 0x395321eb], ebx
xor al, 0x4a
cwde
adc eax, 0x67c6acde
xor al, 0x4a
cmpsd dword [esi], dword es:[edi]
push eax
loop 0x48a1d2
push ss
inc ecx
out 0xd0, al
stosb byte es:[edi], al
imul esi, ebx, 0xffffff91
sbb cl, bl
xchg esi, eax
xchg ebp, eax
mov byte [0xd49a32f6], al
rcl esp, cl
fucomp st(0)
or eax, 0xf9e684d1
mov esp, esi
mov ecx, 0x63c21e4a
wait
xor dword [esi - 0x6e], esp
lcall 0x92f3, 0xd935c44f
hlt
js 0x48a1a9
clc
and eax, 0x9ddab2bb
movsb byte es:[edi], byte [esi]
cmp dword [edx + 0x7802dd8f], ecx
lodsd eax, dword [esi]
int 0xc
xchg dword [edi + 0x23], ebp
bound esp, qword [ebx - 0x2e]
jbe 0x48a1df
mov ebx, 0x5bdfe336
adc byte [0xc48c55f], cl
salc
cwde
cmc
xor eax, 0x22665638
ljmp 0x5cd2
mov ecx, esi
dec ebp
inc esp
scasd eax, dword es:[edi]
invalid

Function at 0x4b6a44
Capabilities:
Encode data using xor

Disassembly:
fisttp qword [eax + 0x3e5d44f3]
mov ch, 0x78
pop ebp
mov ch, 0x78
sub edx, dword [edi]
lcall 0xc2b0, 0x7850c248
dec ebx
sub dword [eax + 0x3769b9cc], esi
invalid
add al, 0xd3
or ch, byte [ebp - 0x1b91558c]
xchg esp, eax
je 0x4b69f4
outsb dx, byte [esi]
in al, 0x94
push 0xf7eac479
adc al, 0x6f
sub dword [edx], esi
std
mov ecx, edi
loopne 0x4b69f8
inc edi
jle 0x4b6a48
invalid
Function at 0x4b93f5
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf600
push 0x4b9290
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov dl, ah
mov dword [0x4c6dc0], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x4c6dbc], ecx
shl ecx, 8
add ecx, edx
mov dword [0x4c6db8], ecx
shr eax, 0x10
mov dword [0x4c6db4], eax
push 1
call fcn.004ba47f
pop ecx
test eax, eax
jne 0x4b93d3
push 0x1c
call fcn.004b9495
pop ecx
call fcn.004ba23c
test eax, eax
jne 0x4b93e4
push 0x10
call fcn.004b9495
pop ecx
xor esi, esi
mov dword [ebp - 4], esi
call fcn.004ba080
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4c7474], eax
je 0x4b946b
dec esp
add al, ch
push eax
or eax, dword [eax]
add byte [ebx + 0x4c6da4], ah
call fcn.004b9d01
call fcn.004b9c48
call fcn.004b9958
mov dword [ebp - 0x30], esi
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.004b9bf0
mov dword [ebp - 0x64], eax
test byte [ebp - 0x30], 1
je 0x4b9433
movzx eax, word [ebp - 0x2c]
jmp 0x4b9436
push 0xa
pop eax
push eax
push dword [ebp - 0x64]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x60], eax
push eax
call fcn.004b9985
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x68], ecx
push eax
push ecx
call fcn.004b9a78
pop ecx
pop ecx
ret
Function at 0x4ba515
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c2420
cmp edx, dword [eax]
je 0x4ba537
add eax, 8
inc ecx
cmp eax, 0x4c24b0
jl 0x4ba528
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c2420]
jne 0x4ba665
mov eax, dword [0x4c6dac]
cmp eax, 1
je 0x4ba63f
test eax, eax
jne 0x4ba568
cmp dword [0x4c2348], 1
je 0x4ba63f
cmp edx, 0xfc
je 0x4ba665
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba59f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004baf00
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb390
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba5e2
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb390
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bf964
push edi
call fcn.004bd260
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004baf00
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004baf10
lea eax, [ebp - 0xa0]
push 0x4bf944
push eax
call fcn.004baf10
push dword [esi + 0x4c2424]
lea eax, [ebp - 0xa0]
push eax
call fcn.004baf10
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bd1d4
add esp, 0x2c
pop edi
jmp 0x4ba665
lea eax, [ebp + 8]
lea esi, [esi + 0x4c2424]
push 0
push eax
push dword [esi]
call fcn.004bb390
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..rsrc
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
je 0x432072
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x4ee13ed3
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x432060
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4320d2
mov ebx, 0x42f314
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x55242704
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x45beeb
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x45bf19
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x45bf37
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0045be55
jmp 0x45bf37
mov eax, dword [esi + 0x14]
test eax, eax
je 0x45bf37
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0045be55
test edi, edi
mov eax, edi
jne 0x45bf21
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x4941b8]
test ecx, ecx
je 0x45bfea
jmp 0x45beea
ret 8
Function at 0x1000e130
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
test esi, esi
je 0x1000e16f
push edi
mov edi, dword [esp + 0xc]
mov ecx, eax
lea edi, [edi + 1]
shr ecx, 8
shl eax, 8
movzx edx, byte [ecx + 0x100013c0]
movzx ecx, byte [edi - 1]
add ecx, eax
mov eax, edx
shl eax, 0xd
xor ecx, edx
xor eax, edx
shl eax, 2
xor eax, ecx
and eax, 0xffff
dec esi
jne 0x1000e140
pop edi
pop esi
ret 8

Function at 0x10017450
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x60
mov eax, dword [0x10052500]
xor eax, esp
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x68]
push ebx
mov ebx, dword [esp + 0x70]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
mov edi, dword [esp + 0x74]
mov esi, ecx
mov dword [esp + 0x14], eax
call ebp
mov dword [esp + 0x10], eax
mov dword [esi + 0x6c], 1
jmp 0x10017490
push dword [esi + 0x6c]
mov ecx, edi
mov dword [esp + 0x1c], 1
call fcn.1001b980
cmp eax, 0x100
jb 0x100175a6
mov ecx, dword [esi + 0x40]
lea eax, [esp + 0x18]
push eax
mov eax, dword [esi + 0x6c]
push 1
add eax, 0x10000000
push eax
call fcn.10021de0
mov eax, dword [esp + 0x18]
test al, 1
jne 0x100174db
cmp dword [esp + 0x1c], 0xfffffbff
je 0x100175aa
test eax, 0xfffffffe
je 0x100174eb
lea ecx, [esp + 0x18]
call fcn.1001c3d0
cmp dword [esi + 0x6c], 0x100
jb 0x10017525
call ebp
mov ecx, dword [esp + 0x10]
sub ecx, eax
add ecx, 0x1388
cmp ecx, 0x80000000
jb 0x10017480
cmp dword [esi + 0x6c], 0x100
jb 0x10017525
push 1
push 0xfffffbdd
mov ecx, ebx
call fcn.1001c550
test byte [ebx], 8
jne 0x100175dd
push 0x40
lea eax, [esp + 0x30]
push 0x20
push eax
call fcn.100454f0
add esp, 0xc
lea eax, [esp + 0x2c]
mov ecx, 0x10053c48
push ebx
push 0x20
push eax
call fcn.100398e0
test byte [ebx], 8
jne 0x100175dd
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x20
push eax
lea eax, [esp + 0x50]
push eax
push dword [esp + 0x1c]
call fcn.10043fc0
test eax, eax
js 0x100175cf
mov ecx, dword [esi + 0x40]
lea eax, [esp + 0x2c]
push ebx
push 0x40
push eax
mov eax, dword [esi + 0x6c]
dec eax
shl eax, 6
push eax
call fcn.10022500
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.10045580
add esp, 0x60
ret 0xc
mov eax, dword [esp + 0x18]
test eax, 0xfffffffe
je 0x100175ba
lea ecx, [esp + 0x18]
call fcn.1001c3d0
inc dword [esi + 0x6c]
cmp dword [esi + 0x6c], 0x100
jb 0x10017490
jmp 0x100174eb
push 1
push 0xfffffc15
mov ecx, ebx
call fcn.1001c550
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10045580
add esp, 0x60
ret 0xc
Function at 0x100189a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x18
push esi
mov esi, ecx
cmp dword [esi + 0x40], 0
je 0x10018ac9
mov eax, dword [esi + 0x3c]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x10], 1
push edi
mov edi, dword [eax + 0x38]
mov eax, dword [eax + 0x5c]
mov dword [esp + 0x10], eax
call ebp
mov ebx, eax
mov ecx, esi
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x34]
push dword [esp + 0x34]
call fcn.100187a0
mov ecx, dword [esp + 0x14]
test cl, 8
je 0x10018a39
nop
mov eax, edi
dec edi
test eax, eax
je 0x10018a39
lea ecx, [esp + 0x14]
call fcn.1001c490
call ebp
sub ebx, eax
mov eax, dword [esp + 0x10]
add eax, ebx
cmp eax, 0x80000000
jae 0x10018a18
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
call ebp
mov ebx, eax
mov ecx, esi
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x34]
push dword [esp + 0x34]
call fcn.100187a0
mov ecx, dword [esp + 0x14]
test cl, 8
jne 0x100189f0
pop edi
pop ebp
pop ebx
test cl, 1
jne 0x10018aa8
mov eax, dword [esp + 0xc]
cmp eax, 0xfffffbae
jl 0x10018aa8
cmp eax, 0xfffffbaf
jle 0x10018a5a
cmp eax, 0xfffffbb2
jne 0x10018aa8
push dword [esp + 0x24]
mov ecx, esi
push dword [esp + 0x24]
call fcn.100192e0
mov ecx, dword [esp + 0x28]
test ecx, ecx
jne 0x10018a82
test byte [esp + 8], 1
mov edx, 0
mov ecx, dword [esp + 0xc]
cmovne ecx, edx
test eax, eax
je 0x10018a9a
cmp eax, dword [esi + 0x6c]
je 0x10018a9a
push dword [esp + 0x2c]
push eax
push ecx
mov ecx, esi
call fcn.10019ac0
jmp 0x10018ab6
push 1
push ecx
mov ecx, dword [esp + 0x34]
call fcn.1001c550
jmp 0x10018ab6
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 8]
push eax
call fcn.1001c300
test dword [esp + 8], 0xfffffffe
je 0x10018ac9
lea ecx, [esp + 8]
call fcn.1001c3d0
pop esi
add esp, 0x18
ret 0x10