joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d0f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x26c]
push ebx
push esi
mov dword [ebp - 4], eax
mov byte [ebp - 8], dl
mov bl, cl
mov edx, 0x443a88
lea eax, [ebp - 0x268]
call fcn.0040a530
xor eax, eax
push fcn.0041d0d0
push ebp
push 0x410010
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test eax, eax
jne 0x41d133
mov eax, 0x44a300
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
jne 0x41d17b
call sub.kernel32.dll_GetLastError
cmp eax, 0xa1
jbe 0x41d14f
clc
jmp 0x41d156
bt dword [0x443140], eax
jb 0x41d16f
mov eax, ebp
call fcn.0041d220
test al, al
je 0x41d16f
mov byte [ebp - 0x26c], 1
jmp 0x41d200
mov byte [ebp - 0x26c], 0
jmp 0x41d200
mov eax, esi
and eax, 0x10
movzx edx, byte [ebp - 8]
cmp eax, dword [edx*4 + 0x436370]
sete byte [ebp - 0x26c]
mov al, bl
and al, byte [ebp - 0x26c]
je 0x41d200
and esi, 0x400
je 0x41d200
lea ebx, [ebp - 0x268]
mov edx, 0x443a88
mov eax, ebx
call fcn.0040a5f0
mov edx, ebx
mov eax, dword [ebp - 4]
xor cl, cl
call fcn.0041cd90
test eax, eax
je 0x41d1d4
sub eax, 1
je 0x41d1ec
jmp 0x41d1f8
mov dl, byte [ebp - 8]
mov eax, dword [ebp - 0x268]
xor cl, cl
call fcn.0041d0f0
mov byte [ebp - 0x26c], al
jmp 0x41d200
mov byte [ebp - 0x26c], 1
jmp 0x41d200
mov byte [ebp - 0x26c], 0
nop
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0041d0d0
mov al, byte [ebp - 0x26c]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41d2d0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
push edi
mov edi, eax
mov esi, edx
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
xor eax, eax
push fcn.0041d2c0
push ebp
push 0x410010
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
test ebx, ebx
jle 0x41d340
lea edx, [ebx - 1]
lea eax, [ebp - 4]
call fcn.00408030
cmp ebx, 1
jle 0x41d330
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
xor dx, dx
call fcn.00407a20
jmp 0x41d34b
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00405da0
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.0041d2c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41d4e0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.0041d4d0
push ebp
push 0x410010
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea esi, [esi]
add ebx, 1
lea eax, [ebx*4 + 0x44badc]
xor edx, edx
call fcn.00405da0
mov dword [ebx*4 + 0x44bafc], 0xffffffff
cmp ebx, 7
jl 0x41d508
call sub.kernel32.dll_GetThreadLocale
mov esi, eax
push 0xb
lea eax, [ebp - 0xc]
push eax
push 0x100b
push esi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x41d594
lea esi, [esi]
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
xor cx, cx
mov edx, 0xa
call fcn.00406790
mov eax, dword [ebp - 0x10]
mov edx, 1
call fcn.00417100
mov ebx, eax
sub eax, 3
cmp eax, 3
jae 0x41d594
push 4
push ebx
push esi
mov eax, 0x41d3b0
push eax
call sub.kernel32.dll_EnumCalendarInfoA
push 3
push ebx
push esi
mov eax, 0x41d440
push eax
call sub.kernel32.dll_EnumCalendarInfoA
nop
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0041d4d0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41dbd0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x94]
mov dword [0x44bb40], 0
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
mov eax, dword [ebp - 0x84]
mov dword [0x44b9a0], eax
mov eax, dword [ebp - 0x90]
mov dword [0x44b9b0], eax
mov eax, dword [ebp - 0x8c]
mov dword [0x44b9c0], eax
mov eax, dword [ebp - 0x88]
mov dword [0x44b9d0], eax
mov edx, 0x44b9e1
lea eax, [ebp - 0x80]
mov ecx, pe_nt_image_headers32
call fcn.00402230
lea eax, [ebp - 0x80]
call fcn.00402ee0
mov byte [0x44b9e0], al
mov eax, str.kernel32
push eax
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x44bb50], eax
test eax, eax
je 0x41dc70
mov eax, str.GetDiskFreeSpaceExA
push eax
push dword [0x44bb50]
call sub.kernel32.dll_GetProcAddress
mov dword [0x44bb40], eax
nop
cmp dword [0x44b9b0], 6
jae 0x41dc84
mov dword [0x435c40], 0
nop
cmp dword [0x44b9b0], 6
jb 0x41dca0
cmp dword [0x44b9c0], 1
jb 0x41dca0
mov dword [0x435c50], 2
mov esp, ebp
pop ebp
ret
Function at 0x41fae0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x118]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 0x118], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x114], eax
mov al, byte [ebp + 8]
mov byte [ebp - 0x110], al
mov dword [ebp - 0xc], 0
xor eax, eax
push fcn.0041fad0
push ebp
push 0x410010
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0x114]
push dword [ebp - 0x118]
push edi
call sub.kernel32.dll_FindResourceA
mov dword [esi + 0x10], eax
test eax, eax
jne 0x41fbf0
mov al, byte [ebp - 0x110]
test al, al
je 0x41fbb9
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00403450
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.00406620
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.004071a0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x444070
call fcn.0041c0c0
mov edx, 0x41fb4a
mov ecx, ebp
call fcn.0040fed0
jmp 0x41fbf0
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x444070
call fcn.0041c0c0
mov edx, 0x41fbb9
mov ecx, ebp
call fcn.0040fed0
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_LoadResource
mov dword [esi + 0x14], eax
test eax, eax
jne 0x41fcb4
mov al, byte [ebp - 0x110]
test al, al
je 0x41fc7d
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00403450
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.00406620
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.004071a0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x444070
call fcn.0041c0c0
mov edx, 0x41fc0e
mov ecx, ebp
call fcn.0040fed0
jmp 0x41fcb4
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x444070
call fcn.0041c0c0
mov edx, 0x41fc7d
mov ecx, ebp
call fcn.0040fed0
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push dword [esi + 0x14]
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, esi
mov ecx, ebx
call fcn.0041f2b0
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0041fad0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42d390
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
mov byte [ebp - 4], al
cmp al, 7
jb 0x42d3f0
sub al, 7
je 0x42d450
sub al, 1
je 0x42d3d0
sub al, 2
je 0x42d3b4
sub al, 3
je 0x42d3c0
jmp 0x42d3f0
add dword [0x44be00], 1
jmp 0x42d450
mov eax, dword [0x44bd20]
mov dword [0x44bdf0], eax
jmp 0x42d450
mov eax, dword [0x44bdf0]
cmp eax, dword [0x44bd20]
jbe 0x42d450
sub dword [0x44bdf0], 1
jmp 0x42d450
mov eax, dword [0x44bdf0]
sub eax, 1
mov word [ebp - 8], ax
mov eax, dword [0x44be00]
sub eax, 1
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 1
lea eax, [ebp - 4]
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteConsoleOutputCharacterA
movzx ax, byte [0x436410]
mov word [ebp - 0x10], ax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 1
lea eax, [ebp - 0x10]
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteConsoleOutputAttribute
add dword [0x44bdf0], 1
nop
mov eax, dword [0x44bdf0]
cmp eax, dword [0x44bd30]
jbe 0x42d489
mov eax, dword [0x44bd20]
mov dword [0x44bdf0], eax
add dword [0x44be00], 1
mov esi, esi
jmp 0x42d489
mov eax, 1
call fcn.0042d1b0
sub dword [0x44be00], 1
mov eax, dword [0x44be00]
cmp eax, dword [0x44bd50]
ja 0x42d478
mov esp, ebp
pop ebp
ret

Function at 0x42d4a0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
push edi
mov edi, eax
mov eax, dword [0x44bdf0]
sub eax, 2
mov word [ebp - 4], ax
mov eax, dword [0x44be00]
sub eax, 1
mov word [ebp - 2], ax
movzx ax, byte [0x436410]
mov word [ebp - 0xc], ax
movzx ax, byte [edi]
mov si, ax
cmp si, 1
jl 0x42d594
xor bx, bx
lea esi, [esi]
add bx, 1
add word [ebp - 4], 1
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 1
movzx eax, bl
add eax, edi
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteConsoleOutputCharacterA
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 1
lea eax, [ebp - 0xc]
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteConsoleOutputAttribute
add dword [0x44bdf0], 1
mov eax, dword [0x44bdf0]
cmp eax, dword [0x44bd30]
jbe 0x42d588
mov eax, dword [0x44bd20]
mov dword [0x44bdf0], eax
add dword [0x44be00], 1
jmp 0x42d561
mov eax, 1
call fcn.0042d1b0
sub dword [0x44be00], 1
mov eax, dword [0x44be00]
cmp eax, dword [0x44bd50]
ja 0x42d550
mov eax, dword [0x44bdf0]
sub eax, 2
mov word [ebp - 4], ax
mov eax, dword [0x44be00]
sub eax, 1
mov word [ebp - 2], ax
mov esi, esi
cmp si, bx
jg 0x42d4e8
lea esi, [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42f780
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x518]
mov dword [ebp - 0x518], 0
xor eax, eax
push fcn.0042f770
push ebp
push 0x410010
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x514], 0
mov dword [ebp - 0x510], 0
mov dword [ebp - 0x508], 0
lea eax, [ebp - 0x50c]
call fcn.00433920
lea edx, [ebp - 0x50c]
mov eax, dword [0x436520]
call fcn.00433900
lea eax, [ebp - 0x514]
push eax
push 0
push 0
lea eax, [ebp - 0x50c]
push eax
push 0
call sub.wsock32.dll_select
cmp eax, 0
setg byte [ebp - 4]
cmp byte [ebp - 4], 0
jne 0x42f80b
jmp 0x42f874
push 0
lea edx, [ebp - 0x408]
mov eax, dword [0x436520]
mov ecx, 0x400
call fcn.00433950
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x42f82d
jmp 0x42f836
mov byte [0x436510], 0
jmp 0x42f873
cmp dword [ebp - 8], 0
je 0x42f83e
jmp 0x42f847
mov byte [0x436510], 0
jmp 0x42f873
push 0
push 0x436500
lea eax, [ebp - 0x408]
mov cx, 0
mov edx, 0x3ff
call fcn.00406790
mov edx, dword [ebp - 8]
mov eax, 0x436500
mov cx, 0
call fcn.004069f0
nop
mov eax, dword [0x436500]
test eax, eax
je 0x42f880
mov eax, dword [eax - 4]
cmp eax, 0
jg 0x42f88a
jmp 0x42f914
push 1
lea eax, [ebp - 0x518]
push eax
mov eax, dword [0x436500]
mov ecx, 0x44690c
mov edx, 0x44691c
call fcn.00419940
mov edx, dword [ebp - 0x518]
mov eax, 0x436500
call fcn.00405da0
push 1
lea eax, [ebp - 0x518]
push eax
mov eax, dword [0x436500]
mov ecx, 0x44690c
mov edx, 0x44692c
call fcn.00419940
mov edx, dword [ebp - 0x518]
mov eax, 0x436500
call fcn.00405da0
push 1
lea eax, [ebp - 0x518]
push eax
mov eax, dword [0x436500]
mov ecx, 0x44690c
mov edx, 0x44693c
call fcn.00419940
mov edx, dword [ebp - 0x518]
mov eax, 0x436500
call fcn.00405da0
lea esi, [esi]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0042f770
mov esp, ebp
pop ebp
ret
Function at 0x431440
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x424]
push ebx
mov dword [ebp - 4], eax
mov byte [ebp - 8], dl
mov byte [ebp - 0xc], cl
mov eax, dword [ebp - 4]
call fcn.00405d70
mov dword [ebp - 0x424], 0
xor eax, eax
push fcn.00431420
push ebp
push 0x410010
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 8], 1
jb 0x431499
jmp 0x431481
cmp byte [ebp - 8], 0x50
ja 0x431499
jmp 0x431489
cmp byte [ebp - 0xc], 1
jb 0x431499
jmp 0x431491
cmp byte [ebp - 0xc], 0x19
ja 0x431499
jmp 0x4314a0
jmp 0x4315f2
movzx edx, byte [ebp - 8]
mov eax, 0x50
sub eax, edx
lea eax, [eax + 1]
mov edx, dword [ebp - 4]
test edx, edx
je 0x4314b8
mov edx, dword [edx - 4]
cmp eax, edx
jl 0x4314be
jmp 0x4314f0
lea eax, [ebp - 0x424]
push eax
movzx eax, byte [ebp - 8]
mov edx, 0x50
sub edx, eax
lea ecx, [edx + 1]
mov eax, dword [ebp - 4]
mov edx, 1
call fcn.00406b70
mov edx, dword [ebp - 0x424]
lea eax, [ebp - 4]
call fcn.00405da0
mov esi, esi
mov eax, dword [ebp - 4]
test eax, eax
je 0x4314fa
mov eax, dword [eax - 4]
sub eax, 1
cmp eax, 0
jge 0x431504
jmp 0x43155c
mov dword [ebp - 0x418], 0xffffffff
mov esi, esi
mov edx, dword [ebp - 0x418]
lea edx, [edx + 1]
mov dword [ebp - 0x418], edx
mov edx, dword [ebp - 0x418]
movzx cx, byte [ebp + 8]
mov word [ebp + edx*4 - 0x40a], cx
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x418]
lea edx, [edx + 1]
mov ebx, dword [ebp - 0x418]
mov dl, byte [ecx + edx - 1]
mov byte [ebp + ebx*4 - 0x40c], dl
cmp eax, dword [ebp - 0x418]
jle 0x431559
jmp 0x431510
lea esi, [esi]
mov eax, dword [ebp - 4]
test eax, eax
je 0x431566
mov eax, dword [eax - 4]
mov word [ebp - 0x414], ax
mov word [ebp - 0x412], 1
mov word [ebp - 0x410], 0
mov word [ebp - 0x40e], 0
movzx eax, byte [ebp - 8]
sub eax, 1
mov word [ebp - 0x420], ax
movzx eax, byte [ebp - 0xc]
sub eax, 1
mov word [ebp - 0x41e], ax
movzx edx, byte [ebp - 8]
mov eax, dword [ebp - 4]
test eax, eax
je 0x4315b2
mov eax, dword [eax - 4]
lea eax, [edx + eax]
sub eax, 2
mov word [ebp - 0x41c], ax
movzx eax, byte [ebp - 0xc]
sub eax, 1
mov word [ebp - 0x41a], ax
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x410]
push dword [ebp - 0x414]
lea eax, [ebp - 0x40c]
push eax
push dword [0x44be60]
call sub.kernel32.dll_WriteConsoleOutputA
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00431420
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x407c70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x407c7f
pop dword [ebp - 8]
mov eax, 0x407c7f
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x3e44a
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0x49e5
mov edi, eax
mov esi, 0x494deabb
add esi, 0xb6f56945
add esi, dword [ebp - 8]
mov ebx, 0xd8cb945c
xor dword [ebp - 4], edi
mov edx, dword [esi]
mov dword [ebp - 4], 0xf086cdd9
xor edx, ebx
sub dword [ebp - 4], 0x4784a998
mov dword [edi], edx
xor dword [ebp - 4], ebx
add edi, 0x7371bcb1
sub edi, 0x7371bcad
add esi, 4
loop 0x407cc8
add eax, 0x13058f80
sub eax, 0x13047519
xor ebx, ebx
add ebx, eax
add eax, 0xa6560ebd
add eax, 0x59a9f148
mov ecx, 0x75780e37
sub ecx, 0x75380e37
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x403e59
pop dword [ebp - 0xc]
mov eax, 0xcaa71746
add eax, 0x35992713
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x79871b56
sub dword [ebp - 0x1c], 0x2b34d60b
mov dword [ebp - 0x18], 0x9cb682bf
sub dword [ebp - 0x18], 0x6a83367a
mov dword [ebp - 0x14], 0xd95ac6a7
sub dword [ebp - 0x14], 0x8d0e8279
mov dword [ebp - 0x10], 0x2530cfda
add dword [ebp - 0x10], 0xdacf3026
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xdc961a47
add eax, 0x23aa6645
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xb2f19dd1
add dword [ebp - 0x1c], 0xc180cb85
mov dword [ebp - 0x18], 0x3f54c010
sub dword [ebp - 0x18], 0xfde85e9b
mov dword [ebp - 0x14], 0x7e99afa4
add dword [ebp - 0x14], 0xe4d5bcc8
mov dword [ebp - 0x10], 0x237b6fc9
add dword [ebp - 0x10], 0xdc849037
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x35b29
push 0
call eax
mov ecx, 0x43cd
mov edi, eax
mov edx, 0x3a216fea
sub edx, 0x39e05fea
add edx, dword [ebp - 0xc]
mov esi, 0x8ed75a13
sub esi, 0x98575022
xor dword [ebp - 8], edi
mov ebx, dword [edx]
mov dword [ebp - 4], 0xfe65fe9a
sub ebx, esi
xor dword [ebp - 8], 0x9236b5a7
mov dword [edi], ebx
sub dword [ebp - 4], ebx
add edi, 4
add edx, 0x42e2c67f
sub edx, 0x42e2c67b
loop 0x403f70
add eax, 0x10207
xor ebx, ebx
add ebx, eax
add eax, 0xe4a420fb
sub eax, 0xe4a420f6
mov ecx, 0x8ad4b947
add ecx, 0x756b46b9
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x3cb67c
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x3f31fc]
test eax, eax
je 0x3cb6bb
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x3cb6bb
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x3cb6bb
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x3cb6bb
cmp dword [ecx + 0x74], 0xe
jbe 0x3cb6bb
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x3f0980
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x3f09ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x3f09ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40cbc7
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
mov eax, 0x41a2f8
call fcn.00413724
push ecx
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], 8
mov dword [esi], 0x41b69c
mov dword [ebp - 4], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], 1
mov dword [esi + 0x14], 0x41b754
push 4
mov ebx, 0x41b68c
pop eax
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x3c]
push eax
mov byte [ebp - 4], 2
call fcn.00403291
mov dword [esi + 0x3c], 0x41b804
push 4
mov dword [esi + 0x54], edi
pop eax
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], eax
mov dword [esi + 0x50], ebx
lea edi, [esi + 0x64]
push eax
mov ecx, edi
mov byte [ebp - 4], al
call fcn.00403291
mov dword [edi], 0x41b80c
lea edi, [esi + 0x78]
mov byte [ebp - 4], 5
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b761
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 6
call fcn.0040c1be
lea edi, [esi + 0xa0]
mov byte [ebp - 4], 7
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b761
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 8
call fcn.0040c1be
lea edi, [esi + 0xc8]
mov byte [ebp - 4], 9
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b761
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 0xa
call fcn.0040c1be
mov byte [ebp - 4], 0xb
lea edi, [esi + 0xf0]
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b761
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 0xc
call fcn.0040c1be
lea ecx, [esi + 0x118]
mov byte [ebp - 4], 0xd
call fcn.0040c1be
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x412ff0
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call fcn.0041468e
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x413018
xor eax, eax
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x413027
mov eax, 1
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40610d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x40611c
pop dword [ebp - 0x24]
mov eax, 0x40611c
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xe1c7367e
add dword [ebp - 0x34], 0x6c8b0ecd
mov dword [ebp - 0x30], 0xc6b7ea1a
sub dword [ebp - 0x30], 0x94849dd5
mov dword [ebp - 0x2c], 0x4e4b8f00
add dword [ebp - 0x2c], 0xfe00b52e
mov dword [ebp - 0x28], 0x1a4bacf0
sub dword [ebp - 0x28], 0x1a4bacf0
lea eax, [ebp - 0x34]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x39a3ef3a
sub dword [ebp - 0x34], 0xc53185e4
mov dword [ebp - 0x30], 0xce83b552
sub dword [ebp - 0x30], 0x8d1753dd
mov dword [ebp - 0x2c], 0xec98b831
sub dword [ebp - 0x2c], 0x89294bc5
mov dword [ebp - 0x28], 0xfd34ba2d
add dword [ebp - 0x28], 0x2cb45d3
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0xb4f39696
add eax, 0x4b4cda6a
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3b3fb
push 0
call eax
mov ecx, 0x87a15882
add ecx, 0x785f020e
xor esi, esi
add esi, eax
mov edi, 0x5723b3bd
add edi, 0xa91d4c43
add edi, dword [ebp - 0x24]
mov edx, 0x8a8b8683
add edx, 0x8f238aed
mov dword [ebp - 0x18], 0xc45cc989
mov ebx, dword [edi]
xor ebx, edx
sub dword [ebp - 4], ecx
mov dword [esi], ebx
sub dword [ebp - 0x20], esi
add esi, 0xfc6a3b28
add esi, 0x395c4dc
add edi, 4
loop 0x406236
add eax, 0x15d13
mov ebx, eax
add eax, 0xfd461104
add eax, 0x2b9ef01
mov ecx, 0x400000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..wixburn
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x432072
nop
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x757120ad
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x432060
nop
nop
nop
nop
nop
mov eax, section..pdata
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4320d2
nop
mov ebx, 0x42f314
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x76be02f0
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x616c35b1
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e3d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x2afe0f7b
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
jmp 0x401219