joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100202d0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100834b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
mov dword [ebp - 8], ebx
push edi
mov edi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
je 0x100203bd
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x10020314
cmp dword [esi + 0x40], ebx
jae 0x10020314
push eax
call fcn.1002518b
add esp, 4
mov dword [esi + 0x3c], 0
cmp dword [esi + 0x3c], 0
jne 0x1002032c
lea eax, [ebx + ebx]
push eax
call fcn.10025155
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ebx
push ebx
push edi
push dword [esi + 0x3c]
call fcn.10037500
xor edx, edx
add esp, 0xc
mov dword [ebp - 0xc], edx
test ebx, ebx
je 0x100203ba
mov eax, dword [esi + 0x3c]
mov ecx, dword [esi + 0x30]
mov bl, byte [edx + eax]
mov edx, dword [esi + 0x38]
mov edi, edx
movsx eax, bl
and edi, 0xfffd
xor eax, ecx
or edi, 2
and eax, 0xff
shr ecx, 8
mov eax, dword [eax*4 + 0x10076b40]
xor eax, ecx
mov ecx, edi
mov dword [esi + 0x30], eax
xor ecx, 1
movzx eax, al
add eax, dword [esi + 0x34]
imul eax, eax, 0x8088405
imul ecx, edi
inc eax
mov dword [esi + 0x34], eax
shr eax, 0x18
xor eax, edx
shr ecx, 8
and eax, 0xff
shr edx, 8
xor cl, bl
mov ebx, dword [ebp - 8]
xor edx, dword [eax*4 + 0x10076b40]
mov dword [esi + 0x38], edx
mov edx, dword [ebp - 0xc]
mov eax, dword [esi + 0x3c]
mov byte [edx + eax], cl
inc edx
mov dword [ebp - 0xc], edx
cmp edx, ebx
jb 0x10020342
mov edi, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x100203fd
mov edx, dword [esi + 0x24]
lea eax, [edx + ebx]
cmp eax, dword [esi + 0x28]
jb 0x100203d8
mov dword [esi + 0x14], 0x30000
jmp 0x10020430
push ebx
add ecx, edx
push edi
push ecx
call fcn.10037500
add esp, 0xc
mov eax, ebx
add dword [esi + 0x24], ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10030010
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 4]
test eax, eax
je 0x10020429
push 0
lea ecx, [ebp - 8]
push ecx
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10030010
mov esp, ebp
pop ebp
ret 8
mov dword [esi + 0x14], 0x1000000
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10030010
mov esp, ebp
pop ebp
ret 8
Function at 0x10021760
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10066ba3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x100834b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x1009183c
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [ebp - 4], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ecx], 0x1009183c
mov byte [ebp - 4], 1
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x100742db
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.10024cc0
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x2d816a23
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x2d8e1ef1
call fcn.2d805e23
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x30]
push eax
push str.SoftwareMicrosoftInternet_Explorer
xor ebx, ebx
push 0x80000002
mov dword [ebp - 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x2d816a56
xor al, al
jmp 0x2d816b1e
push ebx
mov byte [ebp - 0x2c], bl
lea ecx, [ebp - 0x28]
push dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], ebx
je 0x2d816a73
add byte [eax], al
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.2d8cdf5c
inc ebp
fsubr st(0)
loop 0x2d816aec
or eax, dword [eax]
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x38]
xor edi, edi
mov dword [ebp - 0x38], eax
inc edi
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], edi
push eax
push ebx
push str.Version
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete bl
test eax, eax
jne 0x2d816acf
lea eax, [ebp - 0x28]
cmp esi, eax
je 0x2d816acf
cmp dword [ebp - 0x14], 8
mov ecx, esi
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.2d801b44
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x2d816b1c
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
add byte [eax], al
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], edi
cmp eax, 0x1000
jb 0x2d816b13
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.2d8cdf5c
mov eax, dword [ebp - 0x34]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.2d8cdf5c
pop ecx
pop ecx
mov al, bl
call fcn.2d8076ce
ret
Function at 0x2d834fff
Capabilities:
Get disk information

Disassembly:
push 0x3c
mov eax, 0x2d8e471e
call fcn.2d805e23
mov esi, dword [ebp + 8]
xor ebx, ebx
push esi
call fcn.2d8cdf5c
pop ecx
test al, al
je 0x2d835159
lea eax, [ebp - 0x44]
push eax
push ebx
push esi
call fcn.2d834ce5
add esp, 0xc
test eax, eax
jne 0x2d835161
push dword [ebp - 0x44]
push 1
call fcn.2d8cdf5c
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x2d835161
lea eax, [ebp - 0x44]
push eax
push edi
push esi
call fcn.2d834ce5
add esp, 0xc
test eax, eax
jne 0x2d835161
mov byte [edi + 3], bl
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
push edi
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], bl
call fcn.2d82bc14
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.2d8359fe
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], bl
pop ecx
pop ecx
cmp eax, 0x10
jb 0x2d8350df
mov ecx, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov byte [ebp - 4], 2
cmp eax, 0x1000
jb 0x2d8350d3
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.2d8cdf5c
mov eax, dword [ebp - 0x44]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.2d8cdf5c
pop ecx
pop ecx
mov byte [ebp - 4], bl
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.kernel32.dll_GetDriveTypeW]
cmp eax, 2
je 0x2d8350fb
cmp eax, 5
jne 0x2d8350fd
mov bl, 1
mov eax, dword [0x2d966aec]
push edi
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x2d8f7384]
call esi
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
pop ecx
cmp eax, 8
jb 0x2d835159
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], 3
cmp eax, 0x1000
jb 0x2d835150
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.2d8cdf5c
mov eax, dword [ebp - 0x48]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x44]
push eax
push ecx
call fcn.2d8cdf5c
pop ecx
pop ecx
mov al, bl
call fcn.2d8076ce
ret
xor al, al
jmp 0x2d83515b
Function at 0x2d8cdf5c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x2d8cdf6b
pop dword [ebp - 0x38]
mov eax, 0x6f62beb0
add eax, 0xbe2a20bb
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xd659c5a
add dword [ebp - 0x48], 0x40eca8f1
mov dword [ebp - 0x44], 0x69b7dcb5
add dword [ebp - 0x44], 0xc87b6f90
mov dword [ebp - 0x40], 0x162eb279
sub dword [ebp - 0x40], 0xc9e26e4b
mov dword [ebp - 0x3c], 0xe016588c
sub dword [ebp - 0x3c], 0xe016588c
lea eax, [ebp - 0x48]
push eax
mov eax, 0x6971add7
sub eax, 0x3be23d4f
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x9b6b3eb1
sub dword [ebp - 0x48], 0x26f8d55b
mov dword [ebp - 0x44], 0xa04a5a0
add dword [ebp - 0x44], 0x3767bbd5
mov dword [ebp - 0x40], 0x259ba62a
sub dword [ebp - 0x40], 0xc22c39be
mov dword [ebp - 0x3c], 0xe14b4824
add dword [ebp - 0x3c], 0x1eb4b7dc
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x5275e324
add eax, 0xdb198d6c
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x6b3c5
push 0
call eax
mov ecx, 0xc7844227
add ecx, 0x387c06a0
xor edx, edx
add edx, eax
mov esi, 0x34adf1df
add esi, 0xf8ecae21
add esi, dword [ebp - 0x38]
mov ebx, 0xaa02393
add ebx, 0x1558a42e
xor dword [ebp - 0x2c], esi
mov edi, dword [esi]
xor dword [ebp - 0x18], esi
add edi, ebx
xor dword [ebp - 0x2c], edx
mov dword [edx], edi
sub dword [ebp - 0x14], edx
add edx, 0xdc7d5c37
add edx, 0x2382a3cd
add esi, 4
loop 0x2d8ce08f
add eax, 0x115ef
mov ebx, eax
add eax, 0x58103e9b
sub eax, 0x58103e96
mov ecx, 0x2d800000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x10008463
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100084a2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100084a2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100084a2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100084a2
cmp dword [ecx + 0x74], 0xe
jbe 0x100084a2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1000b11f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000b1bc
push ebx
push esi
call fcn.1000b0e8
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000b07c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000b169
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000b1bb
push edi
push eax
call fcn.1000c0da
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1000b189
call fcn.10009bc4
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000b1ba
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000b07c
add esp, 0x20
test eax, eax
jne 0x1000b1a8
push edi
call fcn.10009bc4
jmp 0x1000b1b0
push ebx
call fcn.10009bc4
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1000b429
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10012678
push 0x10012670
push str.FlsAlloc
push 0x1f
call fcn.1000b345
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000b45d
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001114c]
call esi
jmp 0x1000b463
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1000b4a7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10012688
push 0x10012680
push str.FlsGetValue
push 0x21
call fcn.1000b345
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000b4de
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001114c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1000b4e6
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10012690
push 0x10012688
push str.FlsSetValue
push 0x22
call fcn.1000b345
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000b520
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1001114c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10010ba0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10010bcd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10010bcd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x426200
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x21000]
push edi
jmp 0x42621a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x426221
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x426210
mov eax, 1
add ebx, ebx
jne 0x426233
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x426228
jne 0x426244
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x426228
xor ecx, ecx
sub eax, 3
jb 0x426258
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4262ca
mov ebp, eax
add ebx, ebx
jne 0x426263
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x426270
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x426294
inc ecx
add ebx, ebx
jne 0x426280
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x426275
jne 0x426291
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x426275
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4262b4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4262a5
jmp 0x426216
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4262b4
add edi, ecx
jmp 0x426216
pop esi
lea edi, [esi + 0x24000]
mov eax, dword [edi]
or eax, eax
je 0x42631c
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3a9dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3aa18]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4262d1
mov ecx, edi
jns 0x426300
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3aa20]
or eax, eax
je 0x426316
mov dword [ebx], eax
add ebx, 4
jmp 0x4262ee
call dword [esi + 0x3aa1c]
mov ebp, dword [esi + 0x3aa24]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x426350
sub esp, 0xffffff80
jmp 0x40155c
Function at 0x40c838
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419428]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00407077
mov dword [ebp - 0x14], eax
cmp dword [0x8143d4], esi
jne 0x40c92b
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40c8b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40ca0b
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40ca0b
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40ca0b
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x8143d4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x8143d8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x8143dc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x8143e4], eax
test eax, eax
je 0x40c928
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x8143e0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40c950
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40c943
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40c965
push 4
pop eax
jmp 0x40ca0d
cmp dword [ebp - 0x14], esi
je 0x40c965
push dword [0x8143d4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40c94a
mov eax, dword [0x8143e0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40c9c3
cmp dword [0x8143e4], edi
je 0x40c9c3
push eax
call ebx
push dword [0x8143e4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40c9c3
test eax, eax
je 0x40c9c3
call ecx
test eax, eax
je 0x40c9b8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40c9b8
test byte [ebp - 8], 1
jne 0x40c9c3
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40c9f3
mov eax, dword [0x8143d8]
cmp eax, edi
je 0x40c9f0
push eax
call ebx
test eax, eax
je 0x40c9f0
call eax
mov esi, eax
test esi, esi
je 0x40c9f0
mov eax, dword [0x8143dc]
cmp eax, edi
je 0x40c9f0
push eax
call ebx
test eax, eax
je 0x40c9f0
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x8143d4]
call ebx
test eax, eax
je 0x40ca0b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40ca0d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403f8b
mov esp, ebp
pop ebp
ret
Function at 0x40a769
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40e190
cmp edx, dword [eax]
je 0x40a78b
add eax, 8
inc ecx
cmp eax, 0x40e220
jl 0x40a77c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40e190]
jne 0x40a8b9
mov eax, dword [0x40ebb0]
cmp eax, 1
je 0x40a893
test eax, eax
jne 0x40a7bc
cmp dword [0x40e0e4], 1
je 0x40a893
cmp edx, 0xfc
je 0x40a8b9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40a7f3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0040b670
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0040b490
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40a836
lea eax, [ebp - 0x1a4]
push eax
call fcn.0040b490
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40d45c
push edi
call fcn.0040bf00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0040b670
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0040b680
lea eax, [ebp - 0xa0]
push 0x40d43c
push eax
call fcn.0040b680
push dword [esi + 0x40e194]
lea eax, [ebp - 0xa0]
push eax
call fcn.0040b680
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040be75
add esp, 0x2c
pop edi
jmp 0x40a8b9
lea eax, [ebp + 8]
lea esi, [esi + 0x40e194]
push 0
push eax
push dword [esi]
call fcn.0040b490
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x431001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x66e45d5f
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
mov ecx, 0x6cfb0eec
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..idata
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x37444a16
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
mov ecx, 0x38ce2bac
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x42b224
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x438e80]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0042b1b9
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.004162c0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x42b273
cmp dword [ebp - 0x1c], 5
jb 0x42b28b
jmp 0x42b287
cmp dword [ebp - 0x10], 1
jne 0x42b28b
cmp dword [ebp - 0x1c], 4
ja 0x42b287
jne 0x42b28b
cmp dword [ebp - 0x18], 0
jbe 0x42b28b
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4327a4
call fcn.0042b08d
test eax, eax
jge 0x42b2ac
mov byte [0x43a368], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00416063
add ebp, 0x78
leave
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219