joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404b00
Capabilities:
Get file system object information

Disassembly:
push ebp
push esp
pop ebp
push esi
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0x45b1d8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp esi, esp
call fcn.00407340
test eax, eax
je 0x404b58
push esp
pop esi
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
nop
nop
push 1
pop eax
jmp 0x404c5e
push esp
pop esi
push 0x45b1e4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp esi, esp
call fcn.00407340
or eax, eax
je 0x404b9a
push esp
pop esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
nop
push 1
nop
pop eax
jmp 0x404c5e
push esp
pop esi
push 0x45b1f0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp esi, esp
call fcn.00407340
or eax, eax
je 0x404bdf
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 3
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.00407340
pushfd
sub eax, eax
inc eax
popfd
jmp 0x404c5e
push esp
pop esi
push 0x45b1fc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp esi, esp
call fcn.00407340
test eax, eax
je 0x404c0a
call fcn.00407570
call fcn.00407570
push 1
pop eax
push eax
pop eax
jmp 0x404c5e
push esp
pop esi
push 0x45b20c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp esi, esp
call fcn.00407340
or eax, eax
je 0x404c52
push esp
pop esi
push 0
push 0x44d870
push 0
push 0
push 0x44d870
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
nop
push 1
nop
pop eax
jmp 0x404c5e
call fcn.00407570
call fcn.00407570
sub eax, eax
pop esi
cmp ebp, esp
call fcn.00407340
pop ebp
ret

Function at 0x404c70
Capabilities:
Check for vm using instruction vpcext
Get file system object information

Disassembly:
push ebp
push esp
pop ebp
push 0xffffffffffffffff
push 0x4597a8
push 0x408a18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0x24], 0xcccccccc
mov dword [ebp - 0x20], 0xcccccccc
mov dword [ebp - 0x1c], 0xcccccccc
mov dword [ebp - 0x18], esp
call fcn.00407570
call fcn.00407570
mov eax, 0x1144
mov word [ebp - 0x1c], ax
push esp
pop esi
push 0
push 0x44d870
push 0
push 0
push 0x44d870
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
mov ecx, 0xa6b
mov word [ebp - 0x20], cx
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 3
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.00407340
mov dword [ebp - 4], 0
push 1
pop eax
push eax
pop eax
invalid
Function at 0x404da0
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
push esp
pop ebp
push 0xffffffffffffffff
push 0x4597b8
push 0x408a18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffd0
push ebx
push esi
push edi
lea edi, [ebp - 0x40]
push 0xa
pop ecx
push eax
pop eax
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov dword [ebp - 0x18], esp
push esp
pop esi
push 0
push 0x44d870
push 0
push 0
push 0x44d870
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x28], 0x74f
call fcn.00407570
call fcn.00407570
mov eax, 0x130d
mov word [ebp - 0x2c], ax
push esp
pop esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
mov dword [ebp - 0x30], 0x564d5868
push esp
pop esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
mov dword [ebp - 0x34], 0x8685d465
mov ecx, 0x541
mov word [ebp - 0x38], cx
call fcn.00407570
call fcn.00407570
mov dword [ebp - 0x3c], 0xbe3
call fcn.00407570
call fcn.00407570
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp esi, esp
call fcn.00407340
mov dword [ebp - 4], 0
push ebx
mov eax, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x34]
pushal
popal
push 0xa
pop ecx
mov dx, 0x5658
in eax, dx
mov dword [ebp - 0x20], ebx
pop ebx
mov dword [ebp - 4], 0xffffffff
jmp 0x404eea
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 0x30]
jne 0x404ef9
nop
push 1
nop
pop eax
jmp 0x404f20
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
xor eax, eax
push edx
push ebp
pop ecx
push eax
lea edx, [0x404f4c]
call fcn.00407370
pop eax
pop edx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x40
cmp ebp, esp
call fcn.00407340
push ebp
pop esp
pop ebp
ret
Function at 0x404f80
Capabilities:
Get file system object information

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x1c
push esi
push edi
mov eax, 0xcccccccc
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
call fcn.00407570
call fcn.00407570
mov eax, 0x10c1
mov word [ebp - 4], ax
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
cmp esi, esp
call fcn.00407340
mov dword [ebp - 0xc], 0
mov ecx, 0xd40
mov word [ebp - 0x14], cx
call fcn.00407570
call fcn.00407570
mov dword [ebp - 0x18], 7
call fcn.00407570
call fcn.00407570
mov dword [ebp - 0x1c], 0x1cf
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0
push 4
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x18]
push eax
push esp
pop edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.00407340
push eax
call dword [0x45d290]
cmp esi, esp
call fcn.00407340
cmp dword [ebp - 0xc], 0
je 0x40504c
pushfd
xor eax, eax
inc eax
popfd
jmp 0x40508a
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 3
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
sub eax, eax
push edx
push ebp
pop ecx
push eax
lea edx, [0x4050ac]
call fcn.00407370
pop eax
pop edx
pop edi
pop esi
add esp, 0x1c
cmp ebp, esp
call fcn.00407340
push ebp
pop esp
pop ebp
ret

Function at 0x4050f0
Capabilities:
Get file system object information

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0xc
push esi
mov dword [ebp - 0xc], 0xcccccccc
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
push esp
pop esi
push 3
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
mov dword [ebp - 4], 0x6a3
push esp
pop esi
push 3
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.00407340
mov dword [ebp - 8], 0x1230
call fcn.00407570
call fcn.00407570
mov dword [ebp - 0xc], 0
jmp 0x40516e
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x1dcd6500
jae 0x40518f
push eax
pop eax
push eax
pop eax
mov eax, 0x6dd0
push eax
pop eax
jmp 0x40518d
jmp 0x405165
push esp
pop esi
push 0
push 0x44d870
push 0
push 0
push 0x44d870
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
xor eax, eax
pop esi
add esp, 0xc
cmp ebp, esp
call fcn.00407340
push ebp
pop esp
pop ebp
ret
Function at 0x4051f0
Capabilities:
Encrypt data using rc4 prga
Get file system object information

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x418
push esi
push edi
lea edi, [ebp - 0x418]
mov ecx, 0x106
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
call fcn.00407570
call fcn.00407570
mov dword [ebp - 8], 0
call fcn.00407570
call fcn.00407570
call fcn.00407570
call fcn.00407570
call fcn.00407570
call fcn.00407570
mov dword [ebp - 4], 0
jmp 0x40524e
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x100
jge 0x405266
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x40c], edx
jmp 0x405245
call fcn.00407570
call fcn.00407570
mov dword [ebp - 4], 0
jmp 0x405282
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x100
jge 0x4052f3
mov ecx, dword [ebp - 4]
mov esi, dword [ebp - 8]
add esi, dword [ebp + ecx*4 - 0x40c]
mov eax, dword [ebp - 4]
xor edx, edx
div dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax + edx]
add esi, ecx
and esi, 0x800000ff
jns 0x4052b9
dec esi
or esi, 0xffffff00
inc esi
mov dword [ebp - 8], esi
mov edx, dword [ebp - 4]
mov al, byte [ebp + edx*4 - 0x40c]
mov byte [ebp - 0x411], al
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp + edx*4 - 0x40c]
mov dword [ebp + ecx*4 - 0x40c], eax
movzx ecx, byte [ebp - 0x411]
mov edx, dword [ebp - 8]
mov dword [ebp + edx*4 - 0x40c], ecx
jmp 0x405279
push esp
pop esi
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
mov dword [ebp - 0x418], 0
jmp 0x405331
mov eax, dword [ebp - 0x418]
add eax, 1
mov dword [ebp - 0x418], eax
mov ecx, dword [ebp - 0x418]
cmp ecx, dword [ebp + 0x10]
jae 0x4053f5
mov edx, dword [ebp - 4]
add edx, 1
and edx, 0x800000ff
jns 0x405356
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
add ecx, dword [ebp + eax*4 - 0x40c]
and ecx, 0x800000ff
jns 0x405376
dec ecx
or ecx, 0xffffff00
inc ecx
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov al, byte [ebp + edx*4 - 0x40c]
mov byte [ebp - 0x411], al
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp + edx*4 - 0x40c]
mov dword [ebp + ecx*4 - 0x40c], eax
movzx ecx, byte [ebp - 0x411]
mov edx, dword [ebp - 8]
mov dword [ebp + edx*4 - 0x40c], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + eax*4 - 0x40c]
mov edx, dword [ebp - 8]
add ecx, dword [ebp + edx*4 - 0x40c]
and ecx, 0x800000ff
jns 0x4053d2
dec ecx
or ecx, 0xffffff00
inc ecx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x418]
movzx edx, byte [eax]
xor edx, dword [ebp + ecx*4 - 0x40c]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x418]
mov byte [eax], dl
jmp 0x405322
call fcn.00407570
call fcn.00407570
mov eax, dword [ebp + 8]
push edx
push ebp
pop ecx
push eax
lea edx, [0x405428]
call fcn.00407370
pop eax
pop edx
pop edi
pop esi
add esp, 0x418
cmp ebp, esp
call fcn.00407340
push ebp
pop esp
pop ebp
ret
Function at 0x4054e0
Capabilities:
Get file system object information

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x20
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0
push 0x18
lea eax, [ebp - 0x1c]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [0x45d290]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 3
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
mov eax, dword [ebp - 0x18]
push edx
push ebp
pop ecx
push eax
lea edx, [0x405594]
call fcn.00407370
pop eax
pop edx
pop esi
add esp, 0x20
cmp ebp, esp
call fcn.00407340
push ebp
pop esp
pop ebp
ret
Function at 0x4055c0
Capabilities:
Get file system object information

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x38
push esi
push edi
lea edi, [ebp - 0x38]
nop
push 0xe
nop
pop ecx
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
push esp
pop esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
mov byte [ebp - 0xc], 0
mov byte [ebp - 0xb], 0
mov byte [ebp - 0xa], 0
mov byte [ebp - 9], 0
mov byte [ebp - 8], 0
mov byte [ebp - 7], 5
call fcn.00407570
call fcn.00407570
mov dword [ebp - 0x18], 0
call fcn.00407570
call fcn.00407570
mov dword [ebp - 0x20], 0x33a
push esp
pop esi
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0x45b43c
mov eax, dword [0x45d258]
push eax
call dword [0x45d2b0]
cmp esi, esp
call fcn.00407340
mov dword [ebp - 0x24], eax
push esp
pop esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push esp
pop esi
lea ecx, [ebp - 0x18]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea edx, [ebp - 0xc]
push edx
call dword [ebp - 0x24]
cmp esi, esp
call fcn.00407340
test eax, eax
jne 0x4056d2
push esp
pop esi
push 3
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
sub eax, eax
jmp 0x405809
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
cmp esi, esp
call fcn.00407340
mov dword [ebp - 0x2c], 0
call fcn.00407570
call fcn.00407570
push esp
pop esi
push str.vY__t__W_a_n:P77
mov eax, dword [0x45d258]
push eax
call dword [0x45d2b0]
cmp esi, esp
call fcn.00407340
mov dword [ebp - 0x34], eax
push esp
pop esi
push 0
push 0x44d870
push 0
push 0
push 0x44d870
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
call fcn.00407570
call fcn.00407570
push esp
pop esi
lea ecx, [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x18]
push edx
push 0
call dword [ebp - 0x34]
cmp esi, esp
call fcn.00407340
or eax, eax
jne 0x405781
call fcn.00407570
call fcn.00407570
mov dword [ebp - 0x2c], 0
call fcn.00407570
call fcn.00407570
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0x45b470
mov eax, dword [0x45d258]
push eax
call dword [0x45d2b0]
cmp esi, esp
call fcn.00407340
mov dword [ebp - 0x38], eax
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0
push 0x44d870
push 0
push 0
push 0x44d870
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp esi, esp
call fcn.00407340
push esp
pop esi
mov ecx, dword [ebp - 0x18]
push ecx
call dword [ebp - 0x38]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
mov eax, dword [ebp - 0x2c]
push edx
push ebp
pop ecx
push eax
lea edx, [0x40582c]
call fcn.00407370
pop eax
pop edx
pop edi
pop esi
add esp, 0x38
cmp ebp, esp
call fcn.00407340
push ebp
pop esp
pop ebp
ret
Function at 0x408b60
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebx
pop ebx
push ebp
push esp
pop ebp
push 0xfffffffffffffffe
push 0x4598b8
push 0x40e260
mov eax, dword fs:[0]
push eax
add esp, 0xffffff98
push ebx
push esi
push edi
mov eax, dword [0x45ba3c]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x70], 0
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
cmp dword [0x45f248], 0
jne 0x408bbd
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
call fcn.00408d50
mov dword [ebp - 0x6c], eax
call 0x414170
or eax, eax
jne 0x408bd8
push 0x1c
call fcn.00408d20
add esp, 4
call 0x40a5c0
or eax, eax
jne 0x408beb
push 0x10
call fcn.00408d20
add esp, 4
push 1
call fcn.0040e100
add esp, 4
call fcn.00409010
mov dword [ebp - 4], 0
call fcn.00413cc0
or eax, eax
jge 0x408c14
push 0x1b
call fcn.00406c80
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x45f244], eax
call fcn.00413bc0
mov dword [0x45d308], eax
call fcn.00413730
test eax, eax
jge 0x408c3c
push 8
call fcn.00406c80
add esp, 4
call fcn.00413590
or eax, eax
jge 0x408c4f
push 9
call fcn.00406c80
add esp, 4
push 1
call fcn.00406b60
add esp, 4
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
je 0x408c6e
mov ecx, dword [ebp - 0x64]
push ecx
call fcn.00406c80
add esp, 4
call fcn.004134c0
mov dword [ebp - 0x68], eax
mov edx, dword [ebp - 0x34]
and edx, 1
je 0x408c87
movzx eax, word [ebp - 0x30]
mov dword [ebp - 0x78], eax
jmp 0x408c8e
mov dword [ebp - 0x78], 0xa
mov ecx, dword [ebp - 0x78]
push ecx
mov edx, dword [ebp - 0x68]
push edx
push 0
push 0x400000
call fcn.00401120
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x6c], 0
jne 0x408cb4
mov eax, dword [ebp - 0x70]
push eax
call main
call 0x406c40
mov dword [ebp - 4], 0xfffffffe
jmp 0x408d01
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
push ebp
pop esp
pop ebp
ret

Function at 0x408d50
Capabilities:
Parse pe header

Disassembly:
push ecx
pop ecx
push ebp
push esp
pop ebp
sub esp, 8
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
je 0x408d71
xor eax, eax
jmp 0x408dba
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
add eax, dword [edx + 0x3c]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0x4550
je 0x408d8c
sub eax, eax
jmp 0x408dba
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x18]
cmp eax, 0x10b
je 0x408d9e
sub eax, eax
jmp 0x408dba
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x74], 0xe
ja 0x408dab
sub eax, eax
jmp 0x408dba
mov edx, dword [ebp - 8]
sub eax, eax
cmp dword [edx + 0xe8], 0
setne al
push ebp
pop esp
pop ebp
ret
Function at 0x4090b0
Capabilities:
Parse pe header

Disassembly:
push edi
pop edi
push ebp
push esp
pop ebp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x4090d0
xor eax, eax
jmp 0x40910b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp dword [edx], 0x4550
je 0x4090eb
sub eax, eax
jmp 0x40910b
mov eax, dword [ebp - 0xc]
add eax, 0x18
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
movzx edx, word [ecx]
cmp edx, 0x10b
je 0x409106
xor eax, eax
jmp 0x40910b
pushfd
sub eax, eax
inc eax
popfd
push ebp
pop esp
pop ebp
ret

Function at 0x409110
Capabilities:
Enumerate pe sections

Disassembly:
pushal
popal
push ebp
push esp
pop ebp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
mov edx, dword [ebp - 4]
movzx eax, word [edx + 0x14]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 0x18]
mov dword [ebp - 0xc], edx
jmp 0x409150
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x28
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
movzx eax, word [edx + 6]
cmp dword [ebp - 8], eax
jae 0x40917f
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0xc]
cmp edx, dword [ecx + 0xc]
jb 0x40917d
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0xc]
add ecx, dword [edx + 8]
cmp dword [ebp + 0xc], ecx
jae 0x40917d
mov eax, dword [ebp - 0xc]
jmp 0x409181
jmp 0x40913e
sub eax, eax
push ebp
pop esp
pop ebp
ret
Function at 0x40f710
Capabilities:
Terminate process

Disassembly:
pushal
popal
push ebp
push esp
pop ebp
push 1
push 0xc0000417
push 2
call fcn.0040f740
add esp, 0xc
push 0xc0000417
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop ebp
ret

Function at 0x411b10
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45ba3c]
jne 0x411b1a
repz ret
jmp 0x41ad10
push edi
pop edi
push ebp
push esp
pop ebp
sub esp, 0x328
mov dword [0x45ddf8], eax
mov dword [0x45ddf4], ecx
mov dword [0x45ddf0], edx
mov dword [0x45ddec], ebx
mov dword [0x45dde8], esi
mov dword [0x45dde4], edi
mov word [0x45de10], ss
mov word [0x45de04], cs
mov word [0x45dde0], ds
mov word [0x45dddc], es
mov word [0x45ddd8], fs
mov word [0x45ddd4], gs
pushfd
pop dword [0x45de08]
mov eax, dword [ebp]
mov dword [0x45ddfc], eax
mov eax, dword [ebp + 4]
mov dword [0x45de00], eax
lea eax, [ebp + 8]
mov dword [0x45de0c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x45dd48], 0x10001
mov eax, dword [0x45de00]
mov dword [0x45dcfc], eax
mov dword [0x45dcf0], 0xc0000409
mov dword [0x45dcf4], 1
mov ecx, dword [0x45ba3c]
mov dword [ebp - 0x328], ecx
mov edx, dword [0x45ba40]
mov dword [ebp - 0x324], edx
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x45dd40], eax
push 1
call fcn.00416a00
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x454730
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x45dd40], 0
jne 0x41ae08
push 1
call fcn.00416a00
add esp, 4
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push ebp
pop esp
pop ebp
ret
Function at 0x413bc0
Capabilities:
Query environment variable

Disassembly:
pushal
popal
push ebp
push esp
pop ebp
sub esp, 0x14
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x413be5
xor eax, eax
jmp 0x413cb4
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
movzx edx, word [ecx]
test edx, edx
je 0x413c13
mov eax, dword [ebp - 0xc]
add eax, 2
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
movzx edx, word [ecx]
or edx, edx
jne 0x413c11
mov eax, dword [ebp - 0xc]
add eax, 2
mov dword [ebp - 0xc], eax
jmp 0x413beb
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 8]
sar ecx, 1
add ecx, 1
mov dword [ebp - 0x10], ecx
push 0
push 0
push 0
push 0
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x413c62
push 0x4a
push str.f:dd_vctoolscrt_bld_self_x86crt_src_a_env.c
push 2
mov ecx, dword [ebp - 4]
push ecx
call fcn.0040acf0
add esp, 0x10
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x413c70
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x413cb4
push 0
push 0
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x413ca7
push 2
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.0040bc20
add esp, 8
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, dword [ebp - 0x14]
push ebp
pop esp
pop ebp
ret