joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009a48c
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1009a47c
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1009a49a
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
or byte [ecx], al
add byte [eax], al
or byte [ecx], al
add byte [eax], al
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1009a4f8
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1009a4df
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1009a4e8
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1009a4f2
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1009a4d4
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1009a45e
mov dword [ebp + 8], esi
xor edi, edi

Function at 0x1009a4e6
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1009a47c
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1009a49a
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
or byte [ecx], al
add byte [eax], al
or byte [ecx], al
add byte [eax], al
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1009a4f8
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1009a4df
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1009a4e8
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1009a4f2
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1009a4d4
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1009a45e
mov dword [ebp + 8], esi
xor edi, edi
Function at 0x100bb4ea
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x10113a30]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.100bb349
mov eax, 0x10000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.1008ef90
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x100bb539
cmp dword [ebp - 0x1c], 5
jb 0x100bb551
jmp 0x100bb54d
cmp dword [ebp - 0x10], 1
jne 0x100bb551
cmp dword [ebp - 0x1c], 4
ja 0x100bb54d
jne 0x100bb551
cmp dword [ebp - 0x18], 0
jbe 0x100bb551
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x100f7290
call fcn.10019581
test eax, eax
jge 0x100bb572
mov byte [0x10114f6c], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1008e5e8
add ebp, 0x78
leave
ret
Function at 0x401000
Capabilities:
Timestomp file

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x28
push esi
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [esp + 0x1c]
push ecx
mov esi, eax
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0xc]
push ecx
push eax
shr eax, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
lea edx, [esp + 4]
push edx
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x18]
push edx
mov eax, ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
add esp, 0x28
ret
Function at 0x40725c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410410]
jne 0x407266
repz ret
jmp fcn.0040aaa1

Function at 0x408975
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x410410]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004029be
and dword [ebp - 0x14], 0
cmp dword [0x411814], 0
mov dword [ebp - 0x18], eax
jne 0x408a28
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x408ad0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x408ad0
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x411814], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x411818], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x41181c], eax
call edi
push eax
call esi
mov dword [0x411824], eax
test eax, eax
je 0x408a28
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x411820], eax
mov eax, dword [0x411820]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x408a81
cmp dword [0x411824], ecx
je 0x408a81
push eax
call esi
push dword [0x411824]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x408a81
test ebx, ebx
je 0x408a81
call edi
test eax, eax
je 0x408a78
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x408a78
test byte [ebp - 8], 1
jne 0x408a81
or dword [ebp + 0x10], 0x200000
jmp 0x408ab4
mov eax, dword [0x411818]
cmp eax, dword [ebp - 0x18]
je 0x408ab4
push eax
call esi
test eax, eax
je 0x408ab4
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x408ab4
mov eax, dword [0x41181c]
cmp eax, dword [ebp - 0x18]
je 0x408ab4
push eax
call esi
test eax, eax
je 0x408ab4
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x411814]
call esi
test eax, eax
je 0x408ad0
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x408ad2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040725c
leave
ret
Function at 0x405b29
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x405b38
pop dword [ebp - 0xc]
mov eax, 0x4e9c48fe
sub eax, 0x4e5bedc6
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xc9cff2a3
add dword [ebp - 0x1c], 0x848252a8
mov dword [ebp - 0x18], 0x156c77ca
add dword [ebp - 0x18], 0x1cc6d47b
mov dword [ebp - 0x14], 0x4ee9ea8d
sub dword [ebp - 0x14], 0x29da65f
mov dword [ebp - 0x10], 0x558ac739
sub dword [ebp - 0x10], 0x558ac739
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xfcdc2ee2
sub eax, 0xfc99fe6e
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xd40a5465
add dword [ebp - 0x1c], 0xa06814f1
mov dword [ebp - 0x18], 0x575783b9
add dword [ebp - 0x18], 0xea14ddbc
mov dword [ebp - 0x14], 0x42454cf0
add dword [ebp - 0x14], 0x212a1f7c
mov dword [ebp - 0x10], 0x528dad40
sub dword [ebp - 0x10], 0x528dad40
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3c90a
push 0
call eax
mov ecx, 0x7e05f436
sub ecx, 0x7e05b48e
mov edx, eax
mov esi, 0x4d94ea2b
sub esi, 0x4d51a62b
add esi, dword [ebp - 0xc]
mov ebx, 0x9b0c65e2
sub ebx, 0xfc30afcd
mov dword [ebp - 4], 0x1fdf02f1
mov edi, dword [esi]
xor dword [ebp - 8], 0xfba722a3
sub edi, ebx
sub dword [ebp - 4], edi
mov dword [edx], edi
add edx, 4
add esi, 4
loop 0x405c55
add eax, 0x436e8d4f
sub eax, 0x436d9bdc
mov ebx, eax
add eax, 5
mov ecx, 0x1ff7a47f
sub ecx, 0x1fb7a47f
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x401000
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [0x43a400]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor ebx, ebx
xor eax, ebx
mov eax, esi
mov ebx, ebx
xor ebx, esi
mov eax, esi
mov esi, esi
xor esi, ebx
xor eax, esi
inc edx
rcl esi, 0x86
imul ebx
add edi, 0x5f
rol edx, 0x41
and edx, 0xfd
ror edx, 0x4e
rol ebx, 0xb6
or edi, 0xe4
sbb eax, 0x8c
rcr eax, 0x7c
bswap edx
bswap edx
not edi
sub eax, 0x54
and edx, 0x82
dec ebx
and eax, 0x12
dec eax
inc eax
imul edx
neg edi
and edi, 0x36
sub edx, 0xb2
dec edx
not ebx
or eax, 0x81
dec eax
rcr edx, 1
not eax
mov esi, 0xe7
inc ebx
and eax, 0x1f
or esi, 0xea
add esi, 0x4a
not ebx
bswap edx
dec edx
sbb edi, 0xac
or edx, 0x3e
inc ebx
or edx, 0x4b
bswap edi
dec esi
dec edi
mov eax, 0x32
rcr edi, 0x88
rol edi, 0xe4
not esi
inc esi
xor ecx, ecx
xor edi, edi
mov ebx, esi
mov eax, eax
mov ebx, eax
xor esi, esi
mov ebx, esi
xor ebx, eax
inc ebx
inc esi
add esi, 0x41
bswap edi
sub edx, 0x4b
and edx, 0x6a
ror ebx, 0xb9
rol esi, 0x83
imul eax
rol edx, 0x3d
rcl eax, 0x96
bswap ebx
add ebx, 0x26
not esi
not edx
rcr eax, 0x44
neg ebx
dec edx
add ebx, 0x3d
neg eax
inc esi
not eax
or esi, 0x6a
dec esi
imul ebx
rol ebx, 0xb6
add esi, 0xfe
bswap eax
ror edx, 0xe8
and ebx, 0x5f
imul edx
and esi, 0x6e
rcl ebx, 0x1a
or ebx, 0x67
sbb eax, 0xfc
bswap eax
ror ebx, 0x4b
rcl eax, 0x11
imul esi
sub ebx, 0xed
inc edi
rcl eax, 0x7c
and edx, 0xfa
neg edx
ror edi, 0xd6
sub ebx, 0x8e
bswap edi
ror esi, 0x7e
sbb esi, 0xc5
ror edi, 0x7d
mov ebx, ebx
mov eax, ebx
xor esi, esi
xor esi, ebx
xor esi, eax
xor ebx, esi
xor esi, ebx
xor eax, esi
xor eax, ebx
mov ecx, dword [ebp + 0xc]
rcl ebx, 0xee
inc edi
neg edx
rcl edx, 0x6d
not eax
dec eax
dec edx
rcl edx, 0xf6
not esi
inc ebx
rol edx, 0x60
neg ebx
inc eax
inc edi
bswap ebx
neg eax
rcl ebx, 0x26
imul edx
imul ebx
inc ebx
dec eax
rol edi, 0xf4
mov eax, 0x20
rol edi, 3
inc eax
imul ebx
sub esi, 0x3b
dec eax
inc edi
inc esi
mov edx, 0xb0
rol esi, 0x69
rol edx, 0xd9
imul edx
rcr ebx, 0x89
rcr edi, 0x3e
dec ebx
and edx, 0xb7
inc esi
sbb edx, 0x6b
inc edx
ror ebx, 0x5f
bswap esi
bswap edi
neg edx
bswap ebx
mov edx, 0xc5
rol edx, 0xdf
not eax
rcl eax, 0x14
mov edi, dword [ebp + 8]
xor esi, esi
xor ebx, esi
xor eax, eax
mov ebx, eax
mov ebx, esi
xor ebx, eax
xor ebx, esi
mov eax, eax
mov eax, eax
not byte [edi]
xor ebx, eax
mov ebx, ebx
mov esi, esi
xor eax, ebx
xor eax, ebx
xor esi, ebx
xor esi, esi
xor ebx, eax
xor esi, ebx
xor ebx, ebx
xor eax, ebx
xor esi, eax
sub byte [edi], 0x39
mov esi, eax
xor esi, esi
mov eax, esi
xor ebx, esi
xor ebx, ebx
mov ebx, eax
add byte [edi], 0x68
xor ebx, eax
mov eax, ebx
mov eax, ebx
mov esi, eax
mov esi, ebx
xor esi, eax
mov esi, esi
xor esi, esi
mov eax, eax
imul byte [edi]
inc edi
loop 0x4011e0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401390
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x401b8f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401bce
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401bce
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401bce
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401bce
cmp dword [ecx + 0x74], 0xe
jbe 0x401bce
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x407a96
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4196b8
push 0x4196b0
push str.FlsAlloc
push 0x1f
call fcn.00407955
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407aca
push dword [ebp + 8]
mov ecx, esi
call dword [0x418130]
call esi
jmp 0x407ad0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x407b14
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4196c8
push 0x4196c0
push str.FlsGetValue
push 0x21
call fcn.00407955
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407b4b
push dword [ebp + 8]
mov ecx, esi
call dword [0x418130]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x407b53
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4196d0
push 0x4196c8
push str.FlsSetValue
push 0x22
call fcn.00407955
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407b8d
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x418130]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40b0d8
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40b175
push ebx
push esi
call fcn.0040b0a1
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040b035
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40b122
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40b174
push edi
push eax
call fcn.00408245
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40b142
call fcn.004077e8
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40b173
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040b035
add esp, 0x20
test eax, eax
jne 0x40b161
push edi
call fcn.004077e8
jmp 0x40b169
push ebx
call fcn.004077e8
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x413230
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41325d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41325d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x404440
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x461580]
test eax, eax
je 0x404455
push eax
call fcn.00428f47
add esp, 4
mov eax, dword [0x461584]
test eax, eax
je 0x404467
push eax
call fcn.00428f47
add esp, 4
mov eax, dword [0x46157c]
test eax, eax
je 0x404479
push eax
call fcn.00428f47
add esp, 4
mov eax, dword [0x461578]
test eax, eax
je 0x40448b
push eax
call fcn.00428f47
add esp, 4
mov eax, dword [0x462da8]
test eax, eax
je 0x4044ba
cmp dword [eax + 4], 2
jne 0x4044af
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x4044af
push ecx
call fcn.00428f47
mov eax, dword [0x462da8]
add esp, 4
mov eax, dword [eax]
mov dword [0x462da8], eax
test eax, eax
jne 0x404494
mov eax, dword [0x462da0]
mov dword [0x462da8], eax
test eax, eax
je 0x4044ee
cmp dword [eax + 4], 1
jne 0x4044e3
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x4044e3
push ecx
call fcn.00428f47
mov eax, dword [0x462da8]
add esp, 4
mov eax, dword [eax]
mov dword [0x462da8], eax
test eax, eax
jne 0x4044c8
call fcn.0040b770
cmp dword [0x4627b0], 0
je 0x40463c
cmp dword [0x461564], 0
jne 0x404512
cmp dword [0x461568], 0
je 0x404552
push dword [0x461560]
push str._ASxxxx_Info_pass_count______________________3d_n
push 2
call fcn.00428dfa
add esp, 4
push eax
call fcn.004011b0
mov eax, dword [0x461558]
add esp, 0xc
test eax, eax
je 0x404552
push eax
push str._ASxxxx_Info_residual_fuzz___________________3d_n
push 2
call fcn.00428dfa
add esp, 4
push eax
call fcn.004011b0
add esp, 0xc
push dword [0x462ac4]
push str._ASxxxx_Info_maxinc_include_file_level_______3d_n
push 2
call fcn.00428dfa
add esp, 4
push eax
call fcn.004011b0
add esp, 0xc
push dword [0x462abc]
push str._ASxxxx_Info_maxmcr_macro_expansion_level____3d_n
push 2
call fcn.00428dfa
add esp, 4
push eax
call fcn.004011b0
add esp, 0xc
push dword [0x462d80]
push str._ASxxxx_Info_mcrcnt_macro_definitions________3d_n
push 2
call fcn.00428dfa
add esp, 4
push eax
call fcn.004011b0
add esp, 0xc
push dword [0x462d7c]
push str._ASxxxx_Info_mcrexe_macros_executed__________3d_n
push 2
call fcn.00428dfa
add esp, 4
push eax
call fcn.004011b0
add esp, 0xc
push dword [0x462d74]
push str._ASxxxx_Info_inlexe_inlines_executed_________3d_n
push 2
call fcn.00428dfa
add esp, 4
push eax
call fcn.004011b0
add esp, 0xc
push dword [0x462ad0]
push str._ASxxxx_Info_asmblk_1K_Byte_Allocations______3d_n
push 2
call fcn.00428dfa
add esp, 4
push eax
call fcn.004011b0
add esp, 0xc
push dword [0x462acc]
push str._ASxxxx_Info_mcrblk_1K_Byte_Allocations______3d_n
push 2
call fcn.00428dfa
add esp, 4
push eax
call fcn.004011b0
add esp, 0xc
push 0x4524b0
push 2
call fcn.00428dfa
add esp, 4
push eax
call fcn.004011b0
add esp, 8
push dword [ebp + 8]
call fcn.00429f88
int3
Function at 0x438b40
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00438738

Function at 0x438b4b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004388c2

Function at 0x439af6
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004399ca

Function at 0x43c72b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043c0e9
Function at 0x420b5b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x420b9a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x420b9a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x420b9a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x420b9a
cmp dword [ecx + 0x74], 0xe
jbe 0x420b9a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x433310
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43333d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43333d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x50d0b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x50d0d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x50d0d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50d0c8
mov eax, 1
add ebx, ebx
jne 0x50d0eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x50d0e0
jne 0x50d0fc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x50d0e0
xor ecx, ecx
sub eax, 3
jb 0x50d110
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x50d182
mov ebp, eax
add ebx, ebx
jne 0x50d11b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x50d128
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x50d14c
inc ecx
add ebx, ebx
jne 0x50d138
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x50d12d
jne 0x50d149
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x50d12d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x50d16c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x50d15d
jmp 0x50d0ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x50d16c
add edi, ecx
jmp 0x50d0ce
pop esi
mov edi, esi
mov ecx, 0x130
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x50d18a
cmp byte [edi], 4
jne 0x50d18a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x50d18f
lea edi, [esi + 0xb000]
mov eax, dword [edi]
or eax, eax
je 0x50d207
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xd1e8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xd260]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x50d1bc
mov ecx, edi
jns 0x50d1eb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xd264]
or eax, eax
je 0x50d201
mov dword [ebx], eax
add ebx, 4
jmp 0x50d1d9
call dword [esi + 0xd268]
popal
jmp 0x50567e
Function at 0x40183c
Capabilities:
Create process on windows
Get common file path
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp byte [0x4055ac], 0
je 0x401919
xor edx, edx
push ebp
push 0x401912
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x405035], 0
je 0x40186e
push 0x4055b4
call sub.KERNEL32.DLL_TlsSetValue
mov byte [0x4055ac], 0
mov eax, dword [0x40560c]
push eax
call sub.KERNEL32.DLL_DeleteCriticalSection
xor eax, eax
mov dword [0x40560c], eax
mov ebx, dword [0x4055d4]
jmp 0x4018a1
push 0x8000
push 0
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_LocalAlloc
mov ebx, dword [ebx]
cmp ebx, 0x4055d4
jne 0x40188f
mov eax, 0x4055d4
call fcn.0040113c
mov eax, 0x4055e4
call fcn.0040113c
mov eax, 0x405610
call fcn.0040113c
mov eax, dword [0x4055cc]
test eax, eax
je 0x4018e7
mov edx, dword [eax]
mov dword [0x4055cc], edx
push eax
call sub.KERNEL32.DLL_DeleteCriticalSection
mov eax, dword [0x4055cc]
test eax, eax
jne 0x4018d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401919
cmp byte [0x405035], 0
je 0x401907
push 0x4055b4
call sub.KERNEL32.DLL_GetSystemDirectoryA
push 0x4055b4
call sub.KERNEL32.DLL_WinExec
ret
pop ebx
pop ebp
ret
Function at 0x401e64
Capabilities:
Get common file path
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
cmp byte [0x4055ac], 0
jne 0x401e81
call fcn.00401778
test al, al
je 0x401e89
cmp ebx, 0x7ffffff8
jle 0x401e93
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x401fe7
xor ecx, ecx
push ebp
push 0x401fe0
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x405035], 0
je 0x401eb4
push 0x4055b4
call sub.KERNEL32.DLL_TlsSetValue
add ebx, 7
and ebx, 0xfffffffc
cmp ebx, 0xc
jge 0x401ec4
mov ebx, 0xc
cmp ebx, 0x1000
jg 0x401f63
mov eax, ebx
test eax, eax
jns 0x401ed9
add eax, 3
sar eax, 2
mov edx, dword [0x40560c]
mov edx, dword [edx + eax*4 - 0xc]
test edx, edx
je 0x401f63
mov esi, edx
mov eax, esi
add eax, ebx
and dword [eax], 0xfffffffe
mov eax, dword [edx + 4]
cmp edx, eax
jne 0x401f14
mov eax, ebx
test eax, eax
jns 0x401f03
add eax, 3
sar eax, 2
mov ecx, dword [0x40560c]
xor edi, edi
mov dword [ecx + eax*4 - 0xc], edi
jmp 0x401f3a
mov ecx, ebx
test ecx, ecx
jns 0x401f1d
add ecx, 3
sar ecx, 2
mov edi, dword [0x40560c]
mov dword [edi + ecx*4 - 0xc], eax
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, esi
mov edx, dword [edx + 8]
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x40559c]
sub ebx, 4
add dword [0x4055a0], ebx
call fcn.00402a94
jmp 0x401fe7
cmp ebx, dword [0x405604]
jg 0x401fb5
sub dword [0x405604], ebx
cmp dword [0x405604], 0xc
jge 0x401f87
add ebx, dword [0x405604]
xor eax, eax
mov dword [0x405604], eax
mov eax, dword [0x405608]
add dword [0x405608], ebx
mov edx, ebx
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x40559c]
sub ebx, 4
add dword [0x4055a0], ebx
call fcn.00402a94
jmp 0x401fe7
mov eax, ebx
call fcn.00401d70
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401fe7
cmp byte [0x405035], 0
je 0x401fdf
push 0x4055b4
call sub.KERNEL32.DLL_GetSystemDirectoryA
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret