joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e1b2
Capabilities:
Decode data using base64 via winapi

Disassembly:
push 0x18
mov eax, 0x1025c86
call fcn.0100a094
mov ebx, dword [ebp + 8]
xor edi, edi
cmp ebx, edi
jne 0x100e1e8
push edi
push 0x54f
push 0x1003990
push 0xc54
push 0x10032f8
call fcn.0100a7c1
xor eax, eax
jmp 0x100e307
mov esi, dword [ebp + 0xc]
cmp esi, edi
jne 0x100e201
push ebx
push 0x54f
push 0x1003984
push 0xc55
jmp 0x100e1d7
mov eax, esi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x100e206
sub eax, ecx
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push edi
sar eax, 1
push 4
push eax
push esi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
test eax, eax
jne 0x100e25d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xd
jne 0x100e24b
mov eax, 0x803380b7
mov ecx, dword [ebx]
push esi
push 0x4033c3a9
push eax
push ebx
call dword [ecx + 0x1c]
add esp, 0x10
jmp 0x100e1e1
push edi
lea eax, [ebp - 0xd]
push eax
push 8
call sub.WsmSvc.DLL_public:_static_void____stdcall_WSManMemory::Alloc_unsigned_int__class_TestSystem::CallSite_const___enum_TestSystem::Mode_
cmp eax, edi
je 0x100e276
mov dword [eax], edi
mov dword [eax + 4], edi
mov esi, eax
jmp 0x100e278
xor esi, esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], edi
cmp esi, edi
jne 0x100e28e
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc]
jmp 0x100e1e1
mov eax, dword [ebp - 0x14]
mov dword [esi], eax
push edi
lea eax, [ebp - 0xe]
push eax
push dword [ebp - 0x14]
call sub.WsmSvc.DLL_public:_static_void____stdcall_WSManMemory::Alloc_unsigned_int__class_TestSystem::CallSite_const___enum_TestSystem::Mode_
lea ebx, [esi + 4]
push eax
mov ecx, ebx
call fcn.0100c8e1
mov ebx, dword [ebx]
cmp ebx, edi
jne 0x100e2c7
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0xc]
push 1
mov ecx, esi
call fcn.0100d03e
jmp 0x100e1e1
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push 4
push dword [ebp - 0x20]
push dword [ebp + 0xc]
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
test eax, eax
jne 0x100e305
mov ebx, dword [ebp + 8]
mov edi, dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100395c
push 0x4033c360
push ebx
call dword [edi + 0x28]
add esp, 0x10
jmp 0x100e2b9
mov eax, esi
call fcn.0100a180
ret 8
Function at 0x100e8db
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [0x102b00c]
cmp eax, 0x102b00c
je 0x100e90c
test dword [eax + 0x1c], 0x1000
je 0x100e90c
push ecx
push 0x1003b44
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100a936
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push edi
push 9
push dword [ebp - 4]
push 0x59
push dword [ebp + 8]
call esi
mov ebx, 0x54f
mov edi, 0x1003b68
test eax, eax
jne 0x100e940
push dword [ebp + 0xc]
push ebx
push 0x1003b5c
push 0x55
push edi
call fcn.0100a7c1
mov eax, dword [ebp - 4]
push 9
add eax, 0x12
push eax
push 0x5a
push dword [ebp + 8]
call esi
test eax, eax
jne 0x100e965
push dword [ebp + 0xc]
push ebx
push 0x1003b54
push 0x59
push edi
call fcn.0100a7c1
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x101046d
Capabilities:
Start http server

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
xor eax, eax
inc eax
push esi
mov word [ebp - 4], ax
xor eax, eax
push eax
push 2
mov word [ebp - 2], ax
push dword [ebp - 4]
mov esi, ecx
and dword [esi], 0
call dword [sym.imp.HTTPAPI.dll_HttpInitialize]
mov dword [esi], eax
test eax, eax
je 0x10104c2
mov ecx, dword [0x102b00c]
cmp ecx, 0x102b00c
je 0x10104c2
test dword [ecx + 0x1c], 0x400000
je 0x10104c2
push eax
push 0x1004080
push 0xa
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0100a936
mov eax, esi
pop esi
leave
ret
Function at 0x1010fcf
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
jne 0x1010fff
push dword [ebp + 8]
push 0x54f
push 0x1004278
push 0x341
push 0x10040e0
call fcn.0100a7c1
xor eax, eax
jmp 0x101111d
cmp dword [ebp + 0x18], edi
jne 0x1011018
push dword [ebp + 8]
push 0x54f
push 0x1004270
push 0x342
jmp 0x1010fee
push ebx
mov ebx, dword [ebp + 0x1c]
cmp ebx, edi
jne 0x1011043
push dword [ebp + 8]
push 0x54f
push 0x1004268
push 0x343
push 0x10040e0
call fcn.0100a7c1
xor eax, eax
jmp 0x101111c
push esi
push edi
push edi
push edi
push edi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
mov eax, 0x103
cmp esi, eax
jne 0x101106c
push eax
jmp 0x101110e
cmp esi, edi
je 0x10110b5
mov eax, dword [0x102b00c]
cmp eax, 0x102b00c
je 0x1011098
test dword [eax + 0x1c], 0x400000
je 0x1011098
push esi
push 0x1004080
push 0x26
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100a936
mov eax, dword [ebp + 8]
cmp eax, edi
je 0x101110d
mov ecx, dword [eax]
push esi
push 0x100424c
push 0x4033c364
push eax
call dword [ecx + 0x28]
add esp, 0x10
jmp 0x101110d
push 0x1004248
push dword [ebp + 0x18]
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
mov dword [ebx], eax
cmp eax, edi
jne 0x1011118
mov eax, dword [0x102b00c]
cmp eax, 0x102b00c
je 0x10110f2
test dword [eax + 0x1c], 0x400000
je 0x10110f2
push 0x1004080
push 0x27
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100905c
mov eax, dword [ebp + 8]
mov esi, 0x80338005
cmp eax, edi
je 0x101110d
mov ecx, dword [eax]
push 0x4033c44a
push esi
push eax
call dword [ecx + 0x1c]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x101111b
xor eax, eax
inc eax
pop esi
pop ebx
pop edi
pop ebp
ret 0x18
Function at 0x101152b
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
jne 0x101155b
push dword [ebp + 8]
push 0x54f
push 0x10042f8
push 0x8f0
push 0x10040e0
call fcn.0100a7c1
xor eax, eax
jmp 0x101165e
cmp dword [ebp + 0x18], esi
jne 0x1011574
push dword [ebp + 8]
push 0x54f
push 0x10042ec
push 0x8f1
jmp 0x101154a
cmp dword [ebp + 0x1c], esi
jne 0x101158d
push dword [ebp + 8]
push 0x54f
push 0x10042e0
push 0x8f2
jmp 0x101154a
push edi
push esi
push esi
push esi
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
mov eax, 0x103
cmp edi, eax
jne 0x10115b6
push eax
jmp 0x1011650
cmp edi, esi
je 0x10115f1
mov eax, dword [0x102b00c]
cmp eax, 0x102b00c
je 0x10115e2
test dword [eax + 0x1c], 0x400000
je 0x10115e2
push edi
push 0x1004080
push 0x3d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100a936
mov eax, dword [ebp + 8]
cmp eax, esi
je 0x101164f
push edi
push 0x100424c
jmp 0x1011641
push dword [ebp + 0x1c]
push 0x20119
push esi
push dword [ebp + 0x18]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, esi
je 0x101165a
mov eax, dword [0x102b00c]
cmp eax, 0x102b00c
je 0x1011634
test dword [eax + 0x1c], 0x400000
je 0x1011634
push edi
push 0x1004080
push 0x3e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100a936
mov eax, dword [ebp + 8]
cmp eax, esi
je 0x101164f
push edi
push 0x1003e88
mov ecx, dword [eax]
push 0x4033c364
push eax
call dword [ecx + 0x28]
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x101165d
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret 0x18
Function at 0x1011bfa
Capabilities:
Query or enumerate registry key

Disassembly:
push 8
mov eax, 0x1025f10
call fcn.0100a094
mov edi, dword [ebp + 0x10]
xor esi, esi
cmp edi, esi
jne 0x1011c33
push esi
push 0x54f
push 0x1004440
push 0x377
push 0x10040e0
call fcn.0100a7c1
xor eax, eax
call fcn.0100a180
ret 0xc
mov eax, dword [0x102b00c]
cmp eax, 0x102b00c
je 0x1011c5a
test dword [eax + 0x1c], 0x200000
je 0x1011c5a
push 0x1004080
push 0x28
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100905c
push 2
pop edx
xor ecx, ecx
mov eax, 0x100
mov dword [ebp - 0x14], eax
mul edx
seto cl
push esi
neg ecx
or eax, ecx
lea ecx, [ebp + 0x13]
push ecx
push eax
call sub.WsmSvc.DLL_public:_static_void____stdcall_WSManMemory::Alloc_unsigned_int__class_TestSystem::CallSite_const___enum_TestSystem::Mode_
push eax
lea ecx, [ebp - 0x10]
call fcn.0100e10e
mov dword [ebp - 4], esi
cmp dword [ebp - 0x10], esi
jne 0x1011ca2
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0100c5c0
jmp 0x1011c29
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ecx, 0x103
cmp eax, ecx
jne 0x1011cc5
push ecx
jmp 0x1011c8e
cmp eax, esi
je 0x1011ce3
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0100c5c0
mov eax, esi
jmp 0x1011c2b
mov eax, dword [ebp - 0x10]
mov dword [edi + 8], eax
xor eax, eax
inc eax
mov dword [ebp - 0x10], esi
mov dword [edi + 0xc], eax
mov esi, eax
jmp 0x1011cd0
Function at 0x101b1b1
Capabilities:
Set registry value

Disassembly:
push 0x60
mov eax, 0x102687a
call fcn.0100a107
mov edi, dword [ebp + 8]
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x60], 1
mov eax, dword [0x102b00c]
mov esi, 0x102b00c
mov ebx, 0x100667c
cmp eax, esi
je 0x101b1f5
test dword [eax + 0x1c], 0x200000
je 0x101b1f5
push ecx
push ebx
push 0x4a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100a936
and dword [ebp - 0x6c], 0
mov dword [ebp - 4], 1
lea eax, [ebp - 0x6c]
push eax
push 0x102
push 0
push dword [ebp - 0x64]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
mov dword [ebp - 0x68], ecx
cmp ecx, 2
jne 0x101b254
mov eax, dword [0x102b00c]
cmp eax, esi
je 0x101b246
test dword [eax + 0x1c], 0x400000
je 0x101b246
push dword [ebp - 0x64]
push ebx
push 0x4b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100a963
mov eax, dword [edi]
push 0x80338005
mov ecx, edi
call dword [eax + 0x20]
jmp 0x101b2c3
cmp ecx, 5
jne 0x101b285
mov eax, dword [0x102b00c]
cmp eax, esi
je 0x101b27c
test dword [eax + 0x1c], 0x400000
je 0x101b27c
push dword [ebp - 0x64]
push ebx
push 0x4c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100a963
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x10]
jmp 0x101b2c3
test ecx, ecx
je 0x101b2cc
mov eax, dword [0x102b00c]
cmp eax, esi
je 0x101b2ad
test dword [eax + 0x1c], 0x400000
je 0x101b2ad
push dword [ebp - 0x64]
push ecx
push ebx
push 0x4d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010103f9
push dword [ebp - 0x68]
mov eax, dword [edi]
push 0x1003e88
push 0x4033c360
push edi
call dword [eax + 0x28]
add esp, 0x10
and dword [ebp - 0x60], 0
jmp 0x101b35f
lea eax, [ebp - 0x5c]
push eax
call fcn.0100bace
push 0x4a
lea eax, [ebp - 0x5c]
push eax
push 1
push 0
push 0x10069a4
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x68], eax
test eax, eax
je 0x101b336
mov ecx, dword [edi]
and dword [ebp - 0x60], 0
push eax
push 0x100414c
push 0x4033c360
push edi
call dword [ecx + 0x28]
add esp, 0x10
mov eax, dword [0x102b00c]
cmp eax, esi
je 0x101b35f
test dword [eax + 0x1c], 0x400000
je 0x101b35f
push 0x10069a4
push dword [ebp - 0x68]
push ebx
push 0x4e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010103f9
jmp 0x101b35f
mov eax, dword [0x102b00c]
cmp eax, esi
je 0x101b35f
test dword [eax + 0x1c], 0x200000
je 0x101b35f
lea ecx, [ebp - 0x5c]
push ecx
push 0x10069a4
push ebx
push 0x4f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100a6e3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.0100c418
mov eax, dword [ebp - 0x60]
call fcn.0100a199
ret 4
Function at 0x101fd5e
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x102b01c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
mov edi, ecx
call fcn.0100b9e4
mov esi, 0x104
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x101fd9c
xor al, al
jmp 0x101fe4c
lea eax, [ebp - 0x210]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x101fda5
sub eax, edx
push 0x5c
sar eax, 1
pop ecx
cmp cx, word [ebp + eax*2 - 0x212]
lea eax, [ebp - 0x210]
jne 0x101fdcd
push 0x10071e0
jmp 0x101fdd2
push 0x10071c4
push esi
push eax
call fcn.0100b6ba
test eax, eax
jge 0x101fe06
mov eax, dword [0x102b00c]
cmp eax, 0x102b00c
je 0x101fd95
test dword [eax + 0x1c], 0x200
je 0x101fd95
push 0x1006f50
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100905c
jmp 0x101fd95
push 0
push 0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push eax
mov ecx, edi
call fcn.0100c42e
cmp dword [edi], 0
jne 0x101fe4a
mov eax, dword [0x102b00c]
cmp eax, 0x102b00c
je 0x101fd95
test dword [eax + 0x1c], 0x200
je 0x101fd95
push 0x1006f50
push 0xb
jmp 0x101fdf9
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0100a07f
leave
ret

Function at 0x10242d2
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
push edi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
lea edi, [esi + 0xc]
mov dword [edi], ebx
mov dword [esi + 0x10], ebx
mov eax, dword [0x102b00c]
cmp eax, 0x102b00c
je 0x1024317
test dword [eax + 0x1c], 0x200000
je 0x1024317
push esi
push 0x10084e8
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100a936
push ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
cmp eax, ebx
mov dword [ebp - 4], eax
jge 0x1024347
mov eax, dword [0x102b00c]
cmp eax, 0x102b00c
je 0x1024391
test dword [eax + 0x1c], 0x400000
je 0x1024391
push dword [ebp - 4]
push 0x10084e8
push 0xb
jmp 0x1024386
push edi
xor eax, eax
push 0x1008538
inc eax
push eax
push ebx
push 0x1008528
mov dword [esi + 8], eax
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
mov dword [ebp - 4], eax
jge 0x102439e
mov eax, dword [0x102b00c]
cmp eax, 0x102b00c
je 0x1024391
test dword [eax + 0x1c], 0x400000
je 0x1024391
push dword [ebp - 4]
push 0x10084e8
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100a936
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
push 0x10084f8
lea ecx, [esi + 0x10]
call fcn.01024251
mov dword [esi], 1
jmp 0x1024397
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e072
mov ebx, 0x407ef8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x36ee2cce
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x42e0d2
nop
nop
nop
nop
mov ebx, 0x42cd70
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0x1cf43964
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x402470
Capabilities:
Packed with generic packer

Disassembly:
push ebp
push esp
pop ebp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push esi
pop eax
shr eax, 4
push edi
inc eax
movzx eax, ax
push 6
push eax
push ebx
push ecx
pop edi
call dword [0x40d010]
test eax, eax
je 0x40251c
push esi
mov edx, eax
push ebx
pop ecx
call fcn.00402a80
push eax
pop ebx
add esp, 4
or ebx, ebx
je 0x40251c
movzx ecx, word [ebx]
push 0
push 0
push 0
push 0
push ecx
lea eax, [ebx + 2]
push eax
push 0
push 3
call dword [0x40d054]
push eax
pop esi
or esi, esi
js 0x402525
mov eax, dword [edi]
pushfd
xor ecx, ecx
inc ecx
popfd
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, esi
or ecx, eax
jge 0x4024e7
push esi
push edi
pop ecx
call fcn.00402830
movzx eax, word [ebx]
push 0
push 0
push esi
push dword [edi]
push eax
lea eax, [ebx + 2]
push eax
push 0
push 3
call dword [0x40d054]
mov ecx, dword [edi]
cmp esi, dword [ecx - 8]
jg 0x402525
mov dword [ecx - 0xc], esi
mov ecx, dword [edi]
pop edi
mov byte [esi + ecx], 0
pop esi
push 1
pop eax
pushal
popal
pop ebx
pop ebp
ret 8
pop edi
pop esi
sub eax, eax
pop ebx
pop ebp
ret 8
push 0x80070057
call fcn.00402bb0
int3

Function at 0x402e0f
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x14
push 0x4127f0
call fcn.00404cf0
call fcn.004049c6
movzx esi, ax
push 2
call fcn.004047c6
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x402cc6
xor ebx, ebx
jmp 0x402cf9
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x402cc2
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x402cc2
sub ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x402cf9
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.004041e8
test eax, eax
jne 0x402d0d
push 0x1c
call fcn.00402de8
pop ecx
call fcn.00403c4b
or eax, eax
jne 0x402d1e
push 0x10
call fcn.00402de8
pop ecx
call fcn.004048ad
and dword [ebp - 4], 0
call fcn.004041fd
test eax, eax
jns 0x402d38
push 0x1b
call fcn.00402de8
pop ecx
call dword [0x40d064]
mov dword [0x484150], eax
call fcn.004048ed
mov dword [0x482144], eax
call fcn.004044ab
test eax, eax
jns 0x402d5e
push 8
call fcn.00403d26
pop ecx
call fcn.004046e4
or eax, eax
jns 0x402d6f
push 9
call fcn.00403d26
pop ecx
push 1
call fcn.00403d60
pop ecx
or eax, eax
je 0x402d82
push eax
call fcn.00403d26
pop ecx
call fcn.00404c9d
push esi
push eax
push 0
push 0x400000
call main
mov esi, eax
mov dword [ebp - 0x24], esi
or ebx, ebx
jne 0x402da4
push esi
call fcn.00403fbc
call fcn.00403d51
jmp 0x402dd9
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.00404d35
ret
call fcn.00404813
jmp 0x402c98

Function at 0x407030
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push esp
pop ebp
mov eax, dword [ebp + 8]
push ebx
mov ecx, dword [eax + 0x3c]
add ecx, eax
push esi
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
xor edx, edx
add eax, ecx
push edi
or ebx, ebx
je 0x40706c
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407064
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x40706e
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407054
sub eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x407140
Capabilities:
Parse pe header

Disassembly:
push ebp
push esp
pop ebp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x407154
sub eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x40716f
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x5636656c
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x2c633717
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x401190
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bb41d
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov dword [ebp - 0x10], 0xcccccccc
mov eax, dword [0x51197c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov esi, esp
lea eax, [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call dword [sym.imp.MFC80U.DLL_Ordinal_774]
cmp esi, esp
call fcn.004b81e1
mov ecx, dword [ebp - 0x10]
add ecx, 8
mov esi, esp
push ecx
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp edi, esp
call fcn.004b81e1
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp esi, esp
call fcn.004b81e1
mov edx, dword [ebp - 0x10]
mov dword [edx + 4], eax
push str.Modal
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00402fd0
push 0x4c8d54
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00402fd0
mov dword [ebp - 4], 0xffffffff
mov esi, esp
lea ecx, [ebp + 8]
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
cmp esi, esp
call fcn.004b81e1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
cmp ebp, esp
call fcn.004b81e1
mov esp, ebp
pop ebp
ret 4

Function at 0x407000
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 0
je 0x40703f
mov eax, dword [ebp - 4]
cmp dword [eax + 0x2c], 0
je 0x40703f
mov dword [ebp - 8], 0x8000ffff
push 0x4e4804
lea ecx, [ebp - 8]
push ecx
call fcn.004b838e
cmp dword [ebp + 8], 0
jne 0x407058
mov edx, dword [ebp - 4]
cmp dword [edx + 0x28], 0
je 0x407058
mov eax, dword [ebp - 4]
mov dword [eax + 0x2c], 0
cmp dword [ebp + 8], 0
je 0x40710f
mov ecx, dword [ebp - 4]
add ecx, 8
push ecx
push 0
call fcn.00404cb0
add esp, 8
movzx edx, al
test edx, edx
je 0x40708f
mov dword [ebp - 0xc], 0x8000ffff
push 0x4e4804
lea eax, [ebp - 0xc]
push eax
call fcn.004b838e
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [ecx + 0x2c], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x34], ecx
mov edx, dword [ebp - 4]
cmp dword [edx + 0x28], 0
jne 0x4070f1
mov ecx, dword [ebp - 4]
add ecx, 8
call fcn.00407640
mov eax, dword [eax]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x14
call fcn.00407830
mov ecx, dword [ebp - 4]
add ecx, 0x30
mov esi, esp
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
push 0x407300
push 0
push 0
call dword [sym.imp.MSVCR80.dll__beginthreadex]
add esp, 0x18
cmp esi, esp
call fcn.004b81e1
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x28], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x28], 0
jne 0x40710f
mov dword [ebp - 0x10], 0x8000ffff
push 0x4e4804
lea eax, [ebp - 0x10]
push eax
call fcn.004b838e
xor eax, eax
pop esi
add esp, 0x10
cmp ebp, esp
call fcn.004b81e1
mov esp, ebp
pop ebp
ret 8