joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
nop
pushal
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x433072
mov ebx, 0x40de38
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x60e81ab7
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433003
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x7f247c27
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x100303ee
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1003e05c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
cmp eax, 1
push esi
push edi
jne 0x100304ef
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x10030433
xor eax, eax
jmp 0x1003058a
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x88]
and eax, 0x7fff
cmp ecx, 2
je 0x1003044e
or eax, 0x8000
mov edx, dword [ebp - 0x90]
mov dword [0x1003f438], ecx
mov ecx, dword [ebp - 0x94]
mov esi, ecx
shl esi, 8
add esi, edx
push 1
mov dword [0x1003f440], esi
mov dword [0x1003f444], ecx
mov dword [0x1003f448], edx
mov dword [0x1003f43c], eax
call fcn.10033af3
test eax, eax
pop ecx
je 0x1003042c
call fcn.10031960
test eax, eax
jne 0x1003049a
call fcn.10033b53
jmp 0x1003042c
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x10040d04], eax
call fcn.1003395f
mov dword [0x1003f0e8], eax
call fcn.10033334
test eax, eax
jge 0x100304bf
call fcn.10031620
jmp 0x10030493
call fcn.100338a4
test eax, eax
jl 0x100304e8
call fcn.100335bc
test eax, eax
jl 0x100304e8
push 0
call fcn.10033027
test eax, eax
pop ecx
jne 0x100304e8
inc dword [0x1003f0e4]
jmp 0x10030587
call fcn.1003356e
jmp 0x100304b8
xor edi, edi
cmp eax, edi
jne 0x1003052a
cmp dword [0x1003f0e4], edi
jle 0x1003042c
dec dword [0x1003f0e4]
cmp dword [0x1003f474], edi
jne 0x10030514
call fcn.10033184
cmp dword [ebp + 0x10], edi
jne 0x10030587
call fcn.1003356e
call fcn.10031620
call fcn.10033b53
jmp 0x10030587
cmp eax, 2
jne 0x1003057b
call fcn.100315f6
push 0x214
push 1
call fcn.100332f3
mov esi, eax
cmp esi, edi
pop ecx
pop ecx
je 0x1003042c
push esi
push dword [0x1003e0ac]
push dword [0x1003f100]
call fcn.10031587
pop ecx
call eax
test eax, eax
je 0x1003056f
push edi
push esi
call fcn.1003165d
pop ecx
jmp 0x10030586
push esi
call fcn.10031cae
pop ecx
jmp 0x1003042c
cmp eax, 3
jne 0x10030587
push edi
call fcn.100318f2
pop ecx
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10030129
leave
ret 0xc
Function at 0x100365d0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x100365e3
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x100365df
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x10036600
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x1003663f
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x10036635
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x10036641
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x10036625
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10037288
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], esi
cmp edi, dword [esi*8 + 0x1003ecb0]
je 0x100372ae
inc esi
cmp esi, 0x17
mov dword [ebp - 4], esi
jb 0x1003729c
cmp esi, 0x17
jae 0x10037408
push 3
call fcn.1003969e
cmp eax, 1
pop ecx
je 0x100373d2
push 3
call fcn.1003969e
test eax, eax
pop ecx
jne 0x100372e1
cmp dword [0x1003f0f4], 1
je 0x100373d2
cmp edi, 0xfc
je 0x10037408
push str.Runtime_Error__n_nProgram:
mov edi, 0x314
push edi
mov esi, 0x1003f770
push esi
call fcn.10033e01
add esp, 0xc
test eax, eax
je 0x10037317
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.100320d5
add esp, 0x14
mov byte [0x1003f88d], bl
push 0x104
mov ebx, 0x1003f789
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1003735a
push str._program_name_unknown_
push 0x2fb
push ebx
call fcn.10033e01
add esp, 0xc
test eax, eax
je 0x1003735a
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.100320d5
add esp, 0x14
push ebx
push edi
push esi
call fcn.10037f6e
add esp, 0xc
xor ebx, ebx
test eax, eax
je 0x10037378
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.100320d5
add esp, 0x14
push 0x1003c120
push edi
push esi
call fcn.10037f6e
add esp, 0xc
test eax, eax
je 0x10037398
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.100320d5
add esp, 0x14
mov eax, dword [ebp - 4]
push dword [eax*8 + 0x1003ecb4]
push edi
push esi
call fcn.10037f6e
add esp, 0xc
test eax, eax
je 0x100373bd
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.100320d5
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push esi
call fcn.100394fe
add esp, 0xc
jmp 0x10037408
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edi, eax
cmp edi, ebx
je 0x10037408
cmp edi, 0xffffffff
je 0x10037408
mov edx, dword [esi*8 + 0x1003ecb4]
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100373f1
push ebx
lea eax, [ebp - 8]
push eax
sub ecx, esi
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10038b61
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor ebx, ebx
push 1
push ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
call fcn.10038adc
mov dword [ebp - 0x18], eax
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
mov dword [ebp - 0x14], edx
je 0x10038be9
push 2
push ebx
push ebx
push dword [ebp + 8]
call fcn.10038adc
mov ecx, eax
and ecx, edx
add esp, 0x10
cmp ecx, 0xffffffff
je 0x10038be9
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
sub esi, eax
sbb edi, edx
js 0x10038c7e
jg 0x10038bc2
cmp esi, ebx
jbe 0x10038c7e
mov ebx, 0x1000
push ebx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
mov dword [ebp - 4], eax
jne 0x10038bf5
call fcn.100321c8
mov dword [eax], 0xc
call fcn.100321c8
mov eax, dword [eax]
pop edi
pop esi
pop ebx
leave
ret
push 0x8000
push dword [ebp + 8]
call fcn.10039336
pop ecx
pop ecx
mov dword [ebp - 8], eax
test edi, edi
jl 0x10038c15
jg 0x10038c11
cmp esi, ebx
jb 0x10038c15
mov eax, ebx
jmp 0x10038c17
mov eax, esi
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.10035c95
add esp, 0xc
cmp eax, 0xffffffff
je 0x10038c61
cdq
sub esi, eax
sbb edi, edx
js 0x10038c38
jg 0x10038c07
test esi, esi
ja 0x10038c07
mov esi, dword [ebp - 0x10]
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.10039336
pop ecx
pop ecx
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
jmp 0x10038ce7
call fcn.100321db
cmp dword [eax], 5
jne 0x10038c76
call fcn.100321c8
mov dword [eax], 0xd
or esi, 0xffffffff
mov dword [ebp - 0xc], esi
jmp 0x10038c3b
cmp edi, ebx
jg 0x10038cf3
jl 0x10038c88
cmp esi, ebx
jae 0x10038cf3
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10038adc
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x10038be9
push dword [ebp + 8]
call fcn.10035997
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb eax, eax
neg eax
dec eax
cdq
mov dword [ebp - 0x10], eax
and eax, edx
cmp eax, 0xffffffff
mov dword [ebp - 0xc], edx
jne 0x10038cf3
call fcn.100321c8
mov dword [eax], 0xd
call fcn.100321db
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov esi, dword [ebp - 0x10]
and esi, dword [ebp - 0xc]
cmp esi, 0xffffffff
je 0x10038be9
push ebx
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp + 8]
call fcn.10038adc
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x10038be9
xor eax, eax
jmp 0x10038bf0
Function at 0x100394fe
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.1003157e
xor ebx, ebx
cmp dword [0x1003faac], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x100395d5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x10039540
xor eax, eax
jmp 0x10039699
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x10039539
push eax
call fcn.10031518
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1003faac], eax
call esi
push eax
call fcn.10031518
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1003fab0], eax
call esi
push eax
call fcn.10031518
mov dword [0x1003fab4], eax
lea eax, [ebp - 8]
push eax
call fcn.10032faa
test eax, eax
pop ecx
pop ecx
je 0x100395a3
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.100320d5
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x100395d5
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.10031518
cmp eax, ebx
pop ecx
mov dword [0x1003fabc], eax
je 0x100395d5
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10031518
pop ecx
mov dword [0x1003fab8], eax
mov eax, dword [0x1003fab8]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x1003964e
cmp dword [0x1003fabc], esi
je 0x1003964e
push eax
call fcn.10031587
pop ecx
call eax
cmp eax, ebx
je 0x1003961b
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x1003fabc]
call fcn.10031587
pop ecx
call eax
test eax, eax
je 0x1003961b
test byte [ebp - 0x18], 1
jne 0x1003964e
lea eax, [ebp - 0xc]
push eax
call fcn.10032fe6
test eax, eax
pop ecx
je 0x10039636
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.100320d5
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x10039645
or dword [ebp + 0x10], 0x200000
jmp 0x1003967f
or dword [ebp + 0x10], 0x40000
jmp 0x1003967f
mov eax, dword [0x1003fab0]
cmp eax, esi
je 0x1003967f
push eax
call fcn.10031587
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1003967f
mov eax, dword [0x1003fab4]
cmp eax, esi
je 0x1003967f
push dword [ebp - 4]
push eax
call fcn.10031587
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x1003faac]
call fcn.10031587
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10039c06
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x1003e05c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
xor edi, edi
push eax
mov dword [ebp - 0xc], edi
call fcn.10032faa
test eax, eax
pop ecx
je 0x10039c3b
push edi
push edi
push edi
push edi
push edi
call fcn.100320d5
add esp, 0x14
push 4
pop eax
call fcn.10039fe0
mov dword [ebp - 0x14], esp
push 0x1c
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10039d49
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x58]
dec esi
neg esi
sbb esi, esi
and esi, 0x103
inc esi
cmp dword [ebp - 0xc], 2
mov dword [ebp - 8], edi
jne 0x10039cc2
push str.kernel32.dll
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, edi
je 0x10039cc2
push str.SetThreadStackGuarantee
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x10039cc2
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 0x10], edi
call eax
cmp eax, 1
jne 0x10039cc2
mov eax, dword [ebp - 0x10]
cmp eax, edi
jbe 0x10039cc2
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea edi, [ebx - 1]
push edi
push dword [ebp - 8]
call fcn.10039bdf
add esp, 0xc
test eax, eax
jl 0x10039d49
not edi
and dword [ebp - 8], edi
je 0x10039cf4
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp - 8]
call fcn.10039bdf
add esp, 0xc
test eax, eax
jl 0x10039d49
lea eax, [ebx + ebx]
cmp dword [ebp - 8], eax
jae 0x10039cff
mov dword [ebp - 8], eax
lea edi, [ebx - 1]
not edi
and edi, dword [ebp - 0x14]
sub edi, dword [ebp - 8]
cmp dword [ebp - 0xc], 1
jne 0x10039d13
push 0x11
pop ebx
mov eax, dword [ebp - 0x18]
add ebx, eax
cmp edi, ebx
jb 0x10039d49
push 4
push 0x1000
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x10039d49
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10039d49
xor eax, eax
inc eax
jmp 0x10039d4b
xor eax, eax
lea esp, [ebp - 0x68]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10030129
leave
ret

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40301c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x403028
push 0x403024
push 0x403020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x403028]
push dword [0x403024]
push dword [0x403020]
mov dword [0x403014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret
Function at 0x40d8e3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x40d8f2
pop dword [ebp - 0x40]
mov eax, 0x809273de
add eax, 0x7fae6514
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xe5a28a9b
add dword [ebp - 0x50], 0x68afbab0
mov dword [ebp - 0x4c], 0xfe778adf
sub dword [ebp - 0x4c], 0xcc443e9a
mov dword [ebp - 0x48], 0x4811ebe
add dword [ebp - 0x48], 0x47cb2570
mov dword [ebp - 0x44], 0xca1411fd
add dword [ebp - 0x44], 0x35ebee03
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x2b93a725
sub dword [ebp - 0x50], 0xb7213dcf
mov dword [ebp - 0x4c], 0x50582b87
sub dword [ebp - 0x4c], 0xeebca12
mov dword [ebp - 0x48], 0x4842dee7
sub dword [ebp - 0x48], 0xe4d3727b
mov dword [ebp - 0x44], 0x668bf368
add dword [ebp - 0x44], 0x99740c98
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x4fd6b
push 0
call eax
mov ecx, 0xbfbb2f41
sub ecx, 0xbfbadd2e
mov edx, eax
mov edi, 0x4df2a558
add edi, 0xb254baa8
add edi, dword [ebp - 0x40]
mov esi, 0x77cb3ff6
sub esi, 0x25704e09
xor dword [ebp - 0x24], edx
mov ebx, dword [edi]
xor dword [ebp - 4], ebx
xor ebx, esi
sub dword [ebp - 0x38], edx
mov dword [edx], ebx
add dword [ebp - 0x3c], 0x481c7e35
add edx, 4
add edi, 4
loop 0x40da0a
add eax, 0x1f988b8
add eax, 0xfe07b267
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x419760
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40f015
lea edi, [esi - 0xe015]
push edi
or ebp, 0xffffffff
jmp 0x419782
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419789
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419778
mov eax, 1
add ebx, ebx
jne 0x41979b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419790
jne 0x4197ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419790
xor ecx, ecx
sub eax, 3
jb 0x4197c0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419832
mov ebp, eax
add ebx, ebx
jne 0x4197cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4197d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4197fc
inc ecx
add ebx, ebx
jne 0x4197e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4197dd
jne 0x4197f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4197dd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41981c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41980d
jmp 0x41977e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41981c
add edi, ecx
jmp 0x41977e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41983a
cmp byte [edi], 5
jne 0x41983a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41983f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x4198b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41986c
mov ecx, edi
jns 0x41989b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x4198b1
mov dword [ebx], eax
add ebx, 4
jmp 0x419889
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4198eb
sub esp, 0xffffff80
jmp 0x404c20

Function at 0x40a340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov bh, 0xe4
jb 0x40a375
ror dword [edi - 0x71], cl
das
hlt

Function at 0x40a4ef
Capabilities:
Encode data using xor

Disassembly:
call fcn.0040a3d9
sub ecx, ecx
sub ecx, 0xffffff87
call 0x40a4ef
rcr byte [esi - 0x7f], 0x76
push cs
in al, 0xf4
inc ebx
and eax, 0xe2fcee83
hlt
Function at 0x414831
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44eca0]
jne 0x41483b
repz ret
jmp fcn.0041a6db

Function at 0x41d070
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x41d07f
pop dword [ebp - 0x34]
mov eax, 0x41d07f
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push LookupAccountSidW
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0x11b4f572
add ecx, 0xee4b4fe2
xor ebx, ebx
add ebx, eax
mov edx, 0x46b200
add edx, dword [ebp - 0x34]
mov edi, 0x1b1e10ff
add edi, 0x7ee972f3
add dword [ebp - 0x14], 0xaec3d492
mov esi, dword [edx]
mov dword [ebp - 0x24], 0x9afe6a0a
sub esi, edi
add dword [ebp - 0x1c], ebx
mov dword [ebx], esi
xor dword [ebp - 0xc], edi
add ebx, 0xa4272bb1
sub ebx, 0xa4272bad
add edx, 0x26dd056a
sub edx, 0x26dd0566
loop 0x41d0d0
add eax, 0xb4a8e0f5
add eax, 0x4b58272e
xor ebx, ebx
add ebx, eax
add eax, 0xb8dff990
sub eax, 0xb8dff98b
mov ecx, 0x27ec70b7
add ecx, 0xd8538f49
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x432860
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43a4f5
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x44eca0]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
push 0x11c
push 0
lea eax, [ebp - 0x13c]
push eax
call fcn.00414840
add esp, 0xc
mov dword [ebp - 0x13c], 0x11c
lea ecx, [ebp - 0x13c]
push ecx
call dword [sym.imp.kernel32.dll_GetVersionExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4328e2
mov dword [ebp - 0x13c], 0x114
lea edx, [ebp - 0x13c]
push edx
call dword [sym.imp.kernel32.dll_GetVersionExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4328f8
cmp dword [ebp - 0x138], 6
jb 0x4328f8
mov dword [ebp - 0x14], 1
movzx eax, byte [0x452cb1]
test eax, eax
jne 0x43298e
cmp dword [ebp - 0x14], 0
je 0x43294b
push str.Vista_or_later
lea ecx, [ebp - 0x140]
call main
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 0x140]
push ecx
push 2
call main
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x140]
call main
jmp 0x432987
push str.not_Vista_or_later
lea ecx, [ebp - 0x144]
call main
mov dword [ebp - 4], 1
push 0
lea edx, [ebp - 0x144]
push edx
push 2
call main
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x144]
call main
mov byte [0x452cb1], 1
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00414831
mov esp, ebp
pop ebp
ret
Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..pdata
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x32c920d9
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..pdata_1
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e3d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x13f671cd
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219