joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54e5ab
Capabilities:
Encode data using xor

Disassembly:
sbb byte [edi - 0x733dc718], cl
push cs
pushal
shl byte [ebx - 0x2e856e9e], 0xe2
shl edx, 1
shl edx, 1
inc ecx
sti
add byte [edx - 0x6e], dh
push 0xffffffffffffffd8
mov ebx, 0xd4fa2efd
cmpsb byte [esi], byte es:[edi]
add dl, byte [0x7edb15dd]
sub al, 0xcc
mov bh, byte [edx - 0x993f79f]
jle 0x54e59e
dec eax
mov eax, 0x261c024
xchg edx, eax
lea ebp, [esi - 0x18]
in eax, dx
popal
add dl, byte [edx - 0x12179173]
mov al, byte cs:[0xb85964b3]
adc bl, 0xe1
adc ch, byte [eax]
pop es
mov bl, 0x64
pop ecx
mov eax, 0x12e1d382
sub byte [edi], al
cmp dword [edi + 0x5bb4cea4], ebx
adc edx, dword [0x5b8679b3]
pop edi
lodsd eax, dword [esi]
xor al, 0x51
std
out 0xe1, al
mov edi, 0xd3f2cada
cmc
movsb byte es:[edi], byte [esi]
mov eax, dword [0x3923120d]
lea edx, [esi + 0x5e8b9178]
fstp dword [ecx - 0x38]
popfd
cdq
loope 0x54e5d8
mov cl, 0xc1
dec esi
cld
jne 0x54e5cf
push cs
salc
push ecx
cmpsb byte [esi], byte es:[edi]
iretd

Function at 0x5bbe9b
Capabilities:
Encode data using xor

Disassembly:
dec ebp
add byte [eax], al
fbstp tbyte [esi + 0x142b2a3c]
daa
shr byte [ebx + 0x44ce003f], cl
add byte [eax], al
outsb dx, byte [esi]
jne 0x5bbef8
sbb byte [edx - 0x45], dh
add byte [edx - 0x5fc433fe], cl
inc edx
jmp 0x3f898b63
push edi
fnstenv [eax + 0x56]
add byte [eax], al
push ebx
or edx, esi
test dword [ebx], ecx
and bl, ch

Function at 0x401ae0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x40406c], eax
push str.Riched32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push str.mifedount
push str.Deltapo
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401b33
xor eax, eax
jmp 0x401b4e
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x40a830
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x8000]
push edi
jmp 0x40a84a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40a851
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40a840
mov eax, 1
add ebx, ebx
jne 0x40a863
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40a858
jne 0x40a874
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40a858
xor ecx, ecx
sub eax, 3
jb 0x40a888
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40a8fa
mov ebp, eax
add ebx, ebx
jne 0x40a893
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40a8a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40a8c4
inc ecx
add ebx, ebx
jne 0x40a8b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40a8a5
jne 0x40a8c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40a8a5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40a8e4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40a8d5
jmp 0x40a846
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40a8e4
add edi, ecx
jmp 0x40a846
pop esi
lea edi, [esi + 0x8000]
mov eax, dword [edi]
or eax, eax
je 0x40a943
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xcb14]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xcb9c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40a901
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xcba4]
or eax, eax
je 0x40a93d
mov dword [ebx], eax
add ebx, 4
jmp 0x40a91e
call dword [esi + 0xcba0]
mov ebp, dword [esi + 0xcba8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40a977
sub esp, 0xffffff80
jmp 0x401e00

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401aa1
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401ae0
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401ae0
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401ae0
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401ae0
cmp dword [ecx + 0x74], 0xe
jbe 0x401ae0
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40abc0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40abed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40abed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x426200
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x21000]
push edi
jmp 0x42621a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x426221
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x426210
mov eax, 1
add ebx, ebx
jne 0x426233
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x426228
jne 0x426244
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x426228
xor ecx, ecx
sub eax, 3
jb 0x426258
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4262ca
mov ebp, eax
add ebx, ebx
jne 0x426263
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x426270
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x426294
inc ecx
add ebx, ebx
jne 0x426280
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x426275
jne 0x426291
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x426275
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4262b4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4262a5
jmp 0x426216
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4262b4
add edi, ecx
jmp 0x426216
pop esi
lea edi, [esi + 0x24000]
mov eax, dword [edi]
or eax, eax
je 0x42631c
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3a9dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3aa18]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4262d1
mov ecx, edi
jns 0x426300
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3aa20]
or eax, eax
je 0x426316
mov dword [ebx], eax
add ebx, 4
jmp 0x4262ee
call dword [esi + 0x3aa1c]
mov ebp, dword [esi + 0x3aa24]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x426350
sub esp, 0xffffff80
jmp 0x40155c
Function at 0x43e733
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x43e742
pop dword [ebp - 0x40]
mov eax, 0x7adbf6a5
add eax, 0x8567f09d
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x510f5
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x5824524b
sub ecx, 0x58240697
mov edi, eax
mov ebx, 0xa48e0efa
sub ebx, 0xa446b0fa
add ebx, dword [ebp - 0x40]
mov edx, 0xa79bdc5b
xor dword [ebp - 8], 0xdc68b194
mov esi, dword [ebx]
add dword [ebp - 0x24], 0xaa93884a
sub esi, edx
sub dword [ebp - 0x20], ebx
mov dword [edi], esi
xor dword [ebp - 0x34], edi
add edi, 4
add ebx, 0x8d36192a
add ebx, 0x72c9e6da
loop 0x43e796
add eax, 0x121a3
xor ebx, ebx
add ebx, eax
add eax, 0x10481c46
sub eax, 0x10481c41
mov ecx, 0x400000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x41489e
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
push esi
mov ebx, dword [esp + 0x10]
mov eax, dword [0x449bc0]
sar eax, 3
sub dword [0x448174], eax
or dword [0x447f88], 0x698df8db
cmp dword [0x4562cc], 0
jne 0x414913
movsx eax, word [0x444368]
lea ecx, [eax + 1]
mov word [0x444368], cx
sub eax, dword [0x451e58]
add dword [0x451368], eax
call fcn.00423df4
mov dword [0x4562cc], eax
mov eax, dword [0x45228c]
inc eax
mov dword [0x45228c], eax
imul eax, eax, 0xbeb9c906
xor eax, 0x6e26
movzx ecx, word [0x443652]
or ecx, eax
mov word [0x443652], cx
or dword [0x4483d8], 0x46a0cc8b
push 3
push 0x1cb7
call fcn.004033fd
add esp, 8
mov edi, eax
mov dword [0x44b978], 0x84ad4b40
push edi
push ebx
call sub.msvcrt.dll_fopen
add esp, 8
mov esi, eax
or dword [0x447224], 0x18280040
push edi
push 3
call fcn.004065a6
add esp, 8
imul eax, dword [0x44d3fc], 0x969a728e
mov dword [0x44d3fc], eax
test esi, esi
je 0x41497b
xor dword [0x449c5c], 0xb3f67e78
jmp 0x414a48
movsx eax, word [0x4422e8]
sar eax, 1
mov ecx, dword [0x44ed7c]
not ecx
mov edx, dword [0x448540]
lea esi, [edx - 1]
mov dword [0x448540], esi
lea ecx, [edx + ecx - 1]
or ecx, eax
add dword [0x448d7c], ecx
push 0x3e8
call dword [0x43f198]
mov eax, dword [0x44c350]
mov ecx, dword [0x450720]
shl ecx, 5
and ecx, 0x16d0b420
or ecx, eax
and dword [0x44fdbc], ecx
push 3
push 0x1cb7
call fcn.004033fd
add esp, 8
mov edi, eax
and word [0x43f756], 0x9467
push edi
push ebx
call sub.msvcrt.dll_fopen
add esp, 8
mov esi, eax
mov eax, 0xe57e9405
sub eax, dword [0x447a4c]
xor eax, 0x38024866
imul eax, dword [0x4471f8]
mov dword [0x4471f8], eax
push edi
push 3
call fcn.004065a6
add esp, 8
mov eax, dword [0x44b490]
cmp eax, 0xc566d845
jg 0x414a3a
movzx eax, word [0x4408e8]
and eax, 0xdf86
sub word [0x442c6e], ax
xor dword [0x449c5c], 0xb3f67e78
test esi, esi
je 0x414aa5
xor dword [0x451930], 0x1b560e33
push esi
push 1
push 4
push 0x4562cc
call sub.msvcrt.dll_fwrite
add esp, 0x10
mov eax, dword [0x4537fc]
add dword [0x449b3c], eax
push esi
call sub.msvcrt.dll_fclose
add esp, 4
mov eax, dword [0x455784]
mov ecx, dword [0x44d364]
lea edx, [ecx + 1]
mov dword [0x44d364], edx
not ecx
lea eax, [eax + ecx + 0xbaf8]
movzx ecx, word [0x44247c]
or ecx, eax
mov word [0x44247c], cx
movsx eax, word [0x440dbe]
xor dword [0x4498c8], eax
pop esi
pop edi
pop ebx
ret
Function at 0x41f0c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov esi, ecx
add word [0x444bae], 0xcfcf
mov eax, dword [0x44bf9c]
lea eax, [eax*8 + 0x4d422682]
xor eax, 0xc3031b81
add dword [0x452ccc], eax
push esi
call dword [0x43f1b8]
and dword [0x4506d0], 0xf349b46d
mov bl, byte [esi + 0x1c]
mov eax, 0x62a0a0cd
sub eax, dword [0x454d14]
cmp eax, 0x7995b860
jg 0x41f115
xor dword [0x455630], 0x3fea6ffe
push esi
call dword [0x43f1bc]
xor dword [0x44efbc], 0x521ee9b1
test bl, bl
jne 0x41f1a4
movzx eax, word [0x43fbd2]
mov ecx, dword [0x447680]
movzx edx, word [0x4410e8]
sub ecx, eax
add ecx, edx
mov word [0x4410e8], cx
push 0x1f4
call dword [0x43f198]
mov eax, dword [0x44ddbc]
lea ecx, [eax + 1]
mov dword [0x44ddbc], ecx
add eax, 0x1a709450
xor dword [0x452ff4], eax
push esi
call dword [0x43f1b8]
and dword [0x44d788], 0x1464ae87
mov bl, byte [esi + 0x1c]
and dword [0x446e7c], 0x976fee63
push esi
call dword [0x43f1bc]
movsx eax, word [0x441448]
or dword [0x451d3c], eax
cmp bl, 0
je 0x41f12a
mov eax, dword [0x44b654]
dec eax
mov dword [0x44b654], eax
sub dword [0x44af9c], eax
and dword [0x447534], 0xfc5bdfb2
dec word [0x44340e]
push 0x1f4
call dword [0x43f198]
mov eax, dword [0x447134]
lea ecx, [eax + 1]
mov dword [0x447134], ecx
imul eax, dword [0x452ff0]
imul eax, eax, 0x160a0f14
cmp eax, 0xe6f9ed7c
je 0x41f1fd
xor dword [0x452f98], 0x8d1996cd
push esi
call dword [0x43f1b8]
or word [0x440c6a], 0x850
mov edi, dword [esi + 0x18]
add word [0x443b1e], 0x1a34
push esi
call dword [0x43f1bc]
imul eax, dword [0x450910], 0x4db836d2
cmp edi, 0
mov dword [0x450910], eax
jg 0x41f1bf
mov eax, dword [0x44894c]
shl eax, 2
xor eax, 0xabeb5103
add dword [0x44c6c8], eax
pop esi
pop edi
pop ebx
ret
Function at 0x423880
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [0x4516c8]
lea edx, [eax - 1]
mov dword [0x4516c8], edx
add eax, 0x5f503446
and eax, 0x711b9010
xor dword [0x44a924], eax
mov dword [ecx], 0
imul eax, dword [0x44779c], 0x66b05ce0
mov dword [0x44779c], eax
mov dword [ecx + 4], 0
mov eax, dword [0x44c3f0]
xor eax, dword [0x455724]
not eax
or eax, 0x3efd95a9
cmp eax, 0x4080fa81
jl 0x4238dd
and dword [0x45449c], 0x1de8a0c7
mov dword [ecx + 8], 0x67452301
mov eax, dword [0x4540a0]
lea edx, [eax - 1]
mov dword [0x4540a0], edx
or dword [0x4554e4], eax
mov dword [ecx + 0xc], 0xefcdab89
mov eax, dword [0x4507a0]
lea edx, [eax - 1]
mov dword [0x4507a0], edx
mov edx, 0xeff3a09d
sub edx, eax
add dword [0x44b070], edx
mov dword [ecx + 0x10], 0x98badcfe
mov word [0x440c3e], 0x1ade
mov dword [ecx + 0x14], 0x10325476
mov dword [0x450544], 0xb1420948
ret
Function at 0x436a30
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.00436a90

Function at 0x436a90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x3c
mov eax, dword [0x456660]
test eax, eax
jle 0x436b93
mov edx, dword [0x456664]
xor ebx, ebx
mov ecx, dword [edx + 4]
cmp ecx, esi
ja 0x436ac1
mov edi, dword [edx + 8]
add ecx, dword [edi + 8]
cmp esi, ecx
jb 0x436b36
add ebx, 1
add edx, 0xc
cmp ebx, eax
jne 0x436ab0
mov dword [esp], esi
call fcn.00437370
test eax, eax
mov edi, eax
je 0x436bba
lea esi, [ebx + ebx*2]
mov ebx, dword [0x456664]
shl esi, 2
add ebx, esi
mov dword [ebx + 8], eax
mov dword [ebx], 0
call fcn.00437460
add eax, dword [edi + 0xc]
mov dword [ebx + 4], eax
lea eax, [ebp - 0x34]
mov dword [esp + 4], eax
mov eax, dword [0x456664]
mov dword [esp + 8], 0x1c
mov eax, dword [eax + esi + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x436b9a
mov eax, dword [ebp - 0x20]
cmp eax, 0x40
jne 0x436b40
add dword [0x456660], 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 4
je 0x436b2f
cmp eax, 0x80
je 0x436b2f
cmp eax, 8
je 0x436b2f
mov eax, dword [ebp - 0x28]
add esi, dword [0x456664]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 0xc], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x436b2f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00436a30
xor ebx, ebx
jmp 0x436acb
mov eax, dword [0x456664]
mov eax, dword [eax + esi + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00436a30
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00436a30
lea esi, [esi]

Function at 0x437290
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x4372c8
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x4372be
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x4372ca
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x4372b0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x4074e4
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040a18c
test esi, esi
jne 0x40751a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040a324
jmp 0x407538
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00407428
mov edi, eax
test esi, esi
je 0x407538
cmp dword [ebx], 0
je 0x407538
dec esi
jmp 0x407521
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x408d44
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00409204
mov byte [esp], al
cmp byte [esp], 0
jne 0x408ecd
test edi, edi
je 0x408ecd
mov byte [esp + 1], 0
test ebp, ebp
jle 0x408e0d
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x408de8
cmp edi, 0xffffffff
je 0x408da9
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x408da9
mov byte [esp], 0
jmp 0x408ecd
cmp dword [esi], 1
jg 0x408de8
cmp dword [esi], 0
jne 0x408dda
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x408dda
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x408ecd
lea eax, [esp + 0xc]
call fcn.004089dc
dec ebp
test ebp, ebp
jg 0x408d8e
cmp edi, 0xffffffff
je 0x408e0d
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x408e0b
mov byte [esp], 0
jmp 0x408ecd
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x408d52
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408e0d
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00408f48
mov edx, eax
mov ebx, dword [0x4e68fc]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x408e71
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x408e6f
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x408e71
xor edi, edi
cmp byte [esp], 0
je 0x408e97
mov ebx, dword [esi]
test bl, 1
jne 0x408ead
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408e77
mov byte [esp + 1], 1
jmp 0x408ead
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408e97
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x408e24
cmp byte [esp], 0
je 0x408ecd
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x409b5c
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push esi
push edi
mov ebx, 0x4e8b9c
cmp dword [ebp + 0xc], 2
jl 0x409b70
mov ebx, 0x4e8bcc
mov esi, ebx
lea edi, [ebp - 0x40]
mov ecx, 0xc
rep movsd dword es:[edi], dword [esi]
pop dword [ebx + 0x20]
pop dword [ebx + 0x1c]
pop dword [ebx + 0x18]
mov dword [ebx + 0x14], ebp
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], edx
lea ecx, [ebp - 0x40]
mov dword [ebx], ecx
call sub.kernel32.dll_GetCurrentThreadId
mov dword [ebx + 0x2c], eax
mov eax, dword [ebx + 8]
xor ecx, ecx
cmp dword [ebp + 0xc], 0
jne 0x409ba8
mov ecx, dword [eax]
mov dword [ebx + 0xc], ecx
mov eax, 0x4051f8
mov dword [0x4e601c], eax
mov eax, 0x405200
mov dword [0x4e6020], eax
mov eax, ebx
call fcn.00409a40
mov eax, dword [ebp + 0xc]
inc eax
mov byte [ebx + 0x28], al
dec eax
pop ecx
mov edx, dword [ecx]
mov dword [ebx + 0x24], edx
je 0x409bdd
cmp al, 3
jge 0x409bdd
call dword [ecx + eax*4]
push ecx
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x409bee
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
call ecx
pop ecx
mov eax, dword [ebp + 0xc]
cmp al, 3
jl 0x409bf9
call dword [ecx + eax*4]
cmp dword [0x4e6040], 0
jne 0x409c0f
mov byte [0x4e6048], 1
fnstcw word [0x4e002c]
mov eax, dword [ebp + 0xc]
dec eax
jne fcn.00409ebc
call fcn.00409af0
ret 4

Function at 0x409e24
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4e6058], 0
je 0x409e8b
cmp word [0x4e6348], 0xd7b2
jne 0x409e4d
cmp dword [0x4e6350], 0
jbe 0x409e4d
mov eax, 0x4e6344
call dword [0x4e6360]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x409eb8
call fcn.0040a9ec
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4e0036], 0
jne 0x409ea7
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x40a04c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x4e0038], 0
je 0x40a077
mov edx, edi
mov eax, esi
call dword [0x4e0038]
mov ebx, eax
jmp 0x40a088
mov eax, 8
call fcn.00406dd8
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x4e6059], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x40a014
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x40a0b8
mov eax, ebx
call fcn.00406df4
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc