joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4213c7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
mov eax, dword [ebp + 8]
mov dword [esi], eax
cmp dword [esi], 0x3e8
jl 0x4213e9
mov dword [0x468dce], 0x8c3
jmp fcn.00401db5
mov eax, dword [esi]
mov ecx, 0x48
add bh, dh
loope 0x4213f8
pop edx
xchg edi, eax
dec esi
invalid
mov edi, eax
mov eax, dword [edi]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, 0xb
sub edx, edx
cmp dword [esi], eax
jne 0x421411
or edx, 1
mov dword [esi], edx
add esi, 4
mov eax, dword [ebp + 8]
mov dword [esi], eax
cmp dword [esi], 0x3e8
add byte [eax], al
jl 0x421432
mov dword [0x468dce], 0x8c4
jmp fcn.00401db5
mov eax, dword [esi]
mov ecx, 0x48
mul ecx
add eax, 0x4e975a
mov edi, eax
mov eax, dword [edi + 0x14]
mov dword [esi], eax
sub eax, eax
sub edx, edx
cmp dword [esi], eax
jne 0x421452
or edx, 1
sub esi, 4
and dword [esi], edx
je 0x42147a
push 0xffff
push dword [ebp + 0xc]
push dword [0x4fb09a]
call fcn.00402d7b
mov eax, dword [0x4fb09a]
leave
ret 8
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, 3
sub edx, edx
cmp dword [esi], eax
jne 0x42148d
invalid

Function at 0x421676
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push 0x1c38
push 0x40
invalid

Function at 0x423464
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push 0x1020
push 0x40
invalid
invalid

Function at 0x426500
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push 0x1428
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x18], eax
add eax, 0x408
mov dword [ebp - 0x1c], eax
add eax, 0x408
mov dword [ebp - 0x20], eax
add eax, 0x408
mov dword [ebp - 0x24], eax
add eax, 0x408

Function at 0x42b87c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0x408
push 0x40
invalid
invalid
invalid

Function at 0x42d55f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push 0x408
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
add eax, 0x408
mov dword [0x468dca], 0xffffffff
push 0xffff
push str.NOFILE.___
push dword [0x4fb09a]
call fcn.00402d7b
mov dword [esi], 1
invalid
invalid
into

Function at 0x42deeb
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push 0x408
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x18], eax
invalid

Function at 0x42eb32
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
invalid
and byte [eax], dl

Function at 0x4308cb
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0x408
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
add eax, 0x408
call fcn.00409299

Function at 0x43177d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push 0x1020
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x1c], eax
Function at 0x434fd7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push 0x1020
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x2c], eax
add eax, 0x408
mov dword [ebp - 0x30], eax
add eax, 0x408
mov dword [ebp - 0x34], eax
add eax, 0x408
mov dword [ebp - 0x38], eax
add eax, 0x408
push 0x404
push dword [0x4e968c]
push dword [ebp - 0x2c]
call fcn.00402d7b
sub eax, eax
mov dword [ebp - 0x10], eax
mov eax, 0
mov dword [ebp - 0x14], eax
mov eax, 0
mov dword [ebp - 0x1c], eax
mov eax, 0
mov dword [ebp - 0x20], eax
push 0xffff
push dword [0x4e9694]
push dword [0x4fb09a]
call fcn.00402d7b
push 2
push 0xffff
push 0x462b73

Function at 0x43d58c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push 0x408
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
add eax, 0x408
push 0xffff
push dword [0x4e9694]
push dword [0x4fb09a]
call fcn.00402d7b
push 4
push 0xffff
push 0x463a26
push dword [0x4fb09a]
call fcn.00403008
jne 0x43d807
call fcn.00409299
push 0xffff
push dword [0x4e9694]
push dword [0x4fb09a]
call fcn.00402d7b
push 6
push 0xffff
push 0x463a2a
push dword [0x4fb09a]
call fcn.00403008
je 0x43d66a
call fcn.00401e33
mov dword [esi], 0x7530
mov eax, 0xace
add dword [esi], eax
push dword [esi]
push 0xffff
push 0x463a30
push dword [0x4fb09a]
call fcn.00402d7b
mov ecx, dword [0x4fb09a]
mov dword [esi], ecx
add esi, 4
push dword [0x4fb09a]
add eax, 0x1000
add dword [0x4fb09a], eax
call fcn.0042d55f
sub esi, 4
mov ecx, dword [esi]
mov dword [0x4fb09a], ecx
call fcn.004020d3
push 0x404
push dword [0x4e9698]
push dword [ebp - 8]
call fcn.00402d7b
push esi
cld
invalid
mov eax, 1
push eax
call fcn.0042eb32
mov eax, dword [0x4691d4]
mov dword [ebp - 4], eax
mov eax, 0x20
mov dword [0x4691d4], eax
mov eax, dword [0x469198]
mov dword [esi], eax
cmp dword [esi], 0x3e8
jl 0x43d6b8
mov dword [0x468dce], 0xad1
jmp fcn.00401db5
mov eax, dword [esi]
push eax
push dword [ebp - 0xc]
call sub.KERNEL32.dll_GlobalFree
pop eax
leave
ret
Function at 0x43f533
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0x408
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
add eax, 0x408
mov eax, 0
mov dword [ebp - 4], eax
push 0xffff
push dword [0x4e9694]
xchg esi, eax
dec esi
add bh, bh
xor eax, 0x4fb09a
call fcn.00402d7b
push 6
push 0xffff
push 0x463f0f
push dword [0x4fb09a]
call fcn.00403008
jne 0x43f6dd
mov eax, 1
mov dword [0x4692c4], eax
mov eax, 1
mov dword [0x4692c8], eax
mov eax, 1
push eax
call fcn.0042eb32
mov eax, 0
mov dword [0x4692c4], eax
mov eax, 0
mov dword [0x4692c8], eax
mov eax, dword [0x469198]
mov dword [esi], eax
cmp dword [esi], 0x3e8
jl 0x43f5dc
mov dword [0x468dce], 0xba2
jmp fcn.00401db5
mov eax, dword [esi]
mov ecx, 0x48
mul ecx
add eax, 0x4e975a
mov edi, eax
mov eax, dword [edi]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
sub edx, edx
mov ecx, 0xb
cmp ecx, eax
je 0x43f618
mov ecx, 0x1d
cmp ecx, eax
je 0x43f618
mov ecx, 0x24
cmp ecx, eax
je 0x43f618
mov ecx, 0x14
cmp ecx, eax
jne 0x43f683
mov eax, dword [ebp + 8]
test eax, eax
je 0x43f67c
mov eax, dword [0x469140]
mov dword [0x468dd6], eax
push dword [0x4e969c]
call fcn.00402c93
push 0x463f15
call fcn.00402c93
push dword [0x4e9698]
call fcn.00402c93
push 0x463f1a
call fcn.00402c93
mov eax, 1
push eax
call fcn.00407036
push eax
call fcn.00402c93
call fcn.00402ccc
mov eax, dword [0x468d68]
mov dword [0x468dd6], eax
call fcn.00409299
jmp 0x43f681
call fcn.0043ebb5
jmp 0x43f6d8
mov eax, dword [ebp - 8]
mov dword [esi], eax
mov eax, 8
sub edx, edx
cmp dword [esi], eax
jne 0x43f696
or edx, 1
mov dword [esi], edx
add esi, 4
mov eax, dword [0x4691d4]
mov dword [esi], eax
add esi, 4
mov eax, 0x10
sub esi, 4
sub edx, edx
cmp dword [esi], eax
jne 0x43f6b6
or edx, 1
sub esi, 4
and dword [esi], edx
je 0x43f6cf
mov eax, 0x20
mov dword [0x4691d4], eax
mov eax, 1
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.0043df9c
jmp 0x43f7c4
call fcn.00401e33
push 0xffff
push dword [0x4e9694]
push dword [0x4fb09a]
call fcn.00402d7b
mov ecx, dword [0x4fb09a]
mov dword [esi], ecx
add esi, 4
push dword [0x4fb09a]
add eax, 0x1000
add dword [0x4fb09a], eax
push 0xffff
push 0x461815
push dword [0x4fb09a]
call fcn.00402d7b
push dword [0x4fb09a]
add eax, 0x1000
add dword [0x4fb09a], eax
call fcn.004071c3
sub esi, 4
mov ecx, dword [esi]
mov dword [0x4fb09a], ecx
call fcn.004020d3
test eax, eax
je 0x43f7bb
mov eax, dword [ebp + 8]
test eax, eax
je 0x43f7b4
call fcn.00401e33
mov dword [esi], 0x7530
mov eax, 0xbb2
add dword [esi], eax
push dword [esi]
push 0xffff
push str.PROC_FUNC_based_indirection_not_supported_for_STRINGS___use_____instead
push dword [0x4fb09a]
call fcn.00402d7b
mov ecx, dword [0x4fb09a]
mov dword [esi], ecx
add esi, 4
push dword [0x4fb09a]
add eax, 0x1000
add dword [0x4fb09a], eax
call fcn.0042d55f
sub esi, 4
mov ecx, dword [esi]
mov dword [0x4fb09a], ecx
call fcn.004020d3
call fcn.0043ebb5
jmp 0x43f7c4
mov eax, dword [ebp + 8]
push eax
call fcn.0043df9c
invalid
Function at 0x441372
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push 0x1020
push 0x40
inc eax
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x20], eax
loopne 0x441390
or byte [eax + eax], al
add byte [ecx + 0x805dc45], cl
add al, 0
invalid
mov dword [ebp - 0x28], eax
add eax, 0x408
mov dword [ebp - 0x2c], eax
add eax, 0x408
mov eax, 0
mov dword [ebp - 0x18], eax
sub eax, eax
mov dword [ebp - 4], eax
sub eax, eax
mov dword [ebp - 8], eax
sub eax, eax
mov dword [ebp - 0x14], eax
mov ebx, dword [0x4e9694]
movzx eax, byte [ebx]
cmp eax, 0x5e
jne 0x441527
mov eax, 1
mov dword [ebp - 0x18], eax
call fcn.00409299
push 0xffff
add bh, bh
xor eax, 0x4e9694
push dword [0x4fb09a]
call fcn.00402d7b
push 6
push 0xffff
push 0x46486f
push dword [0x4fb09a]
call fcn.00403008
je 0x441466
call fcn.00401e33
mov dword [esi], 0x9c40
mov eax, 0x554
add eax, 0x6010000
push dword [esi]
push 0xffff
push str.can_only_use_pointers_to_VARiables
push dword [0x4fb09a]
call fcn.00402d7b
mov ecx, dword [0x4fb09a]
mov dword [esi], ecx
add esi, 4
push dword [0x4fb09a]
add eax, 0x1000
add dword [0x4fb09a], eax
call fcn.0042d55f
sub esi, 4
mov ecx, dword [esi]
mov dword [0x4fb09a], ecx
call fcn.004020d3
mov eax, 1
push eax
call fcn.0042eb32
mov eax, dword [0x469198]
mov dword [esi], eax
cmp dword [esi], 0x3e8
jl 0x44148f
mov dword [0x468dce], 0x555
jmp fcn.00401db5
mov eax, dword [esi]
mov ecx, 0x48
mul ecx
add eax, 0x4e975a
mov edi, eax
mov eax, dword [edi]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
sub edx, edx
mov ecx, 6
cmp ecx, eax
je 0x4414cb
mov ecx, 7
cmp ecx, eax
je 0x4414cb
mov ecx, 8
cmp ecx, eax
je 0x4414cb
mov ecx, 0xa
cmp ecx, eax
je 0x441527
call fcn.00401e33
mov dword [esi], 0x9c40
mov eax, 0x556
add dword [esi], eax
push dword [esi]
push 0xffff
push str.can_only_use_pointers_to_BYTEs__WORDs__DWORDs__or_FILEs
push dword [0x4fb09a]
call fcn.00402d7b
mov ecx, dword [0x4fb09a]
mov dword [esi], ecx
add esi, 4
push dword [0x4fb09a]
add eax, 0x1000
add dword [0x4fb09a], eax
call fcn.0042d55f
sub esi, 4
mov ecx, dword [esi]
mov dword [0x4fb09a], ecx
call fcn.004020d3
push 0xffff
push dword [0x4e9694]
invalid
invalid
invalid
mov al, 0x4f
Function at 0x4482dc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push 0x1020
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], eax
add eax, 0x408
mov dword [ebp - 0xc], eax
add eax, 0x408
mov dword [ebp - 0x10], eax
add eax, 0x408
mov dword [ebp - 0x14], eax
add eax, 0x408
mov eax, 0
mov dword [ebp - 4], eax
push 0x404
push dword [0x4e968c]
push dword [ebp - 0x14]
call fcn.00402d7b
push 0x404
push dword [0x4e9694]
push dword [ebp - 8]
call fcn.00402d7b
push 0xffff
push dword [ebp - 8]
push dword [0x4fb09a]
call fcn.00402d7b
push 6
push 0xffff
push str.WRITE
push dword [0x4fb09a]
call fcn.00403008
jne 0x4483f5
call fcn.00401e33
mov dword [esi], 0x9c40
mov eax, 0x756
add dword [esi], eax
push dword [esi]
push 0xffff
push 0x4658f8
push dword [0x4fb09a]
call fcn.00402d7b
mov ecx, dword [0x4fb09a]
mov dword [esi], ecx
add esi, 4
push dword [0x4fb09a]
add eax, 0x1000
add dword [0x4fb09a], eax
push 0xffff
push dword [0x4e968c]
push dword [0x4fb09a]
call fcn.00402d7b
sti
invalid
push dword [0x4fb09a]
add eax, 0x1000
add dword [0x4fb09a], eax
lcall 0xde36, 0xe8004fb0
sti
inc dword [ebx + 0xe8b04ee]
call fcn.00409299
call fcn.00401e33
push 0xffff
push dword [0x4e9694]
push dword [0x4fb09a]
call fcn.00402d7b
mov ecx, dword [0x4fb09a]
mov dword [esi], ecx
add esi, 4
push dword [0x4fb09a]
add eax, 0x1000
add dword [0x4fb09a], eax
push 0xffff
push 0x4658fa
push dword [0x4fb09a]
call fcn.00402d7b
push dword [0x4fb09a]
lcall 0x1000, 0x5004fb0
add byte [eax], al

Function at 0x4492c2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push 0xc18
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], eax
add eax, 0x408
add al, 0
add byte [ecx + 0x805f045], cl
add al, 0
add byte [ecx + 0x805ec45], cl
add al, 0
add byte [eax], bh

Function at 0x449dfc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push 0x1c38
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x24], eax
add eax, 0x408
mov dword [ebp - 0x28], eax
add eax, 0x408
mov dword [ebp - 0x2c], eax
add eax, 0x408
mov dword [ebp - 0x30], eax
add eax, 0x408
mov dword [ebp - 0x34], eax
add eax, 0x408
mov dword [ebp - 0x38], eax
Function at 0x44c18f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push 0xc20
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], eax
add eax, 0x408
mov dword [ebp - 0x28], eax
add eax, 0x408
mov dword [ebp - 0x2c], eax
add eax, 0x408
mov dword [ebp - 0x30], eax
add eax, 8
mov eax, dword [0x4692d0]
push eax
call fcn.00405d5c
mov eax, dword [0x4692cc]
push eax
call fcn.00405d5c
mov eax, 0
mov dword [ebp - 8], eax
mov eax, 0
mov dword [ebp - 0x1c], eax
push 0x404
push dword [0x4e968c]
push dword [0x4e96e0]
call fcn.00402d7b
push 4
push dword [0x4e968c]
push dword [0x4e96e4]
call fcn.00402d7b
push 0x404
push dword [0x4e9698]
push dword [ebp - 0x24]
call fcn.00402d7b
mov eax, dword [0x469198]
mov dword [ebp - 4], eax
sub eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov dword [esi], eax
cmp dword [esi], 0x3e8
jl 0x44c24d
mov eax, dword [esi]

Function at 0x44e352
Capabilities:
Write file on windows

Disassembly:
call fcn.00409299
mov eax, 0
push eax
call fcn.0042eb32
mov eax, dword [0x469198]
mov dword [esi], eax
cmp dword [esi], 0x3e8
jl 0x44e380
mov dword [0x468dce], 0x972
jmp fcn.00401db5
mov eax, dword [esi]

Function at 0x44e8c9
Capabilities:
Write file on windows

Disassembly:
call fcn.0040609d
push 0xffff
inc dword [eax]
add byte [eax - 1], dl
xor eax, 0x4fb09a

Function at 0x44ede7
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [0x4fdf30]
push eax
call fcn.00405d5c
mov eax, 0
mov dword [0x4fdf30], eax
mov eax, dword [0x4fdf2c]
push eax
call fcn.00405d5c
add dword [0x4fdf2c], 1
mov eax, dword [0x4fdf28]
fisttp word [edi]

Function at 0x44fa38
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push 0x408
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
add eax, 0x408
mov eax, 0
mov dword [ebp - 0xc], eax
call fcn.00409299

Function at 0x4504b3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push 0xc18
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
add byte [ecx + 0x4589e045], cl
in al, dx
Function at 0x4517fb
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
call fcn.00409299
sub eax, eax
mov dword [ebp - 4], eax
call fcn.00401e33
push 0xffff
push dword [0x4e9694]
push dword [0x4fb09a]
call fcn.00402d7b
mov ecx, dword [0x4fb09a]
mov dword [esi], ecx
add esi, 4
push dword [0x4fb09a]
add eax, 0x1000
add dword [0x4fb09a], eax
push 0xffff
push 0x4669a2
push dword [0x4fb09a]
call fcn.00402d7b
push dword [0x4fb09a]
add eax, 0x1000
add dword [0x4fb09a], eax
call fcn.004071c3
sub esi, 4
mov ecx, dword [esi]
mov dword [0x4fb09a], ecx
call fcn.004020d3
and eax, 1
xor eax, 1
je 0x4518df
call fcn.00401e33
mov dword [esi], 0x9c40
mov eax, 0xb02
add dword [esi], eax
push dword [esi]
push 0xffff
push str.number_or_constant_identifier_expected
push dword [0x4fb09a]
call fcn.00402d7b
mov ecx, dword [0x4fb09a]
mov dword [esi], ecx
add esi, 4
push dword [0x4fb09a]
add eax, 0x1000
add dword [0x4fb09a], eax
call fcn.0042d55f
sub esi, 4
mov ecx, dword [esi]
mov dword [0x4fb09a], ecx
call fcn.004020d3
push 0xffff
push dword [0x4e9694]
push dword [0x4fb09a]
call fcn.00402d7b
push 6
push 0xffff
add byte [eax], al
push 0x4669d5
push dword [0x4fb09a]
call fcn.00403008
jne 0x451a03
mov eax, 1
mov dword [0x4692c8], eax
inc esi
add byte [eax], bh
push eax
invalid

Function at 0x451cf9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
sub eax, eax
mov dword [0x4691c0], eax
call fcn.00409299

Function at 0x453cfd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push 0x810
push 0x40
invalid
aas

Function at 0x4543c6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push 0xc18
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], eax
add eax, 0x408
mov dword [ebp - 0x10], eax
add eax, 0x408
mov dword [ebp - 0x14], eax
add eax, 0x408
sub eax, eax
mov dword [0x4691d0], eax
cmp dword [0x4691ac], 1
jle 0x45448b
call fcn.00401e33
mov dword [esi], 0x9c40
mov eax, 0xbd2
add byte [ecx], al
push es

Function at 0x457147
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0x408
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
add byte [ecx + 0x4589f045], cl
hlt
add eax, 0x408
mov eax, dword [0x4691a8]
inc esi
add byte [ebx], bh
add eax, 0x4691e8

Function at 0x4575ea
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0x810

Function at 0x457b3c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push 0x810
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
add eax, 0x408
mov dword [ebp - 0x10], eax
add eax, 0x408
call fcn.00401e33
mov dword [esi], 0x9c40
mov eax, 0xcf8
add dword [esi], eax
push dword [esi]
push 0xffff
inc dword [eax]
add byte [eax - 0x34], ch
jae 0x457bc4
add bh, bh
xor eax, 0x4fb09a
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x1001ca3e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f7202
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x1001cad7
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x1001cad5
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x30]
call fcn.1001dff0
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x30]
push edx
mov ecx, dword [ebp - 0x38]
call fcn.1001cce8
mov byte [ebp - 0x34], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.1001e050
mov al, byte [ebp - 0x34]
jmp 0x1001caed
jmp 0x1001caeb
push str.Unable_to_load_resource_
mov eax, dword [ebp - 0x38]
add eax, 0x44
push eax
call fcn.10017860
add esp, 8
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10057300
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0xca
jne 0x10057343
mov ecx, dword [ebp + 8]
push ecx
call fcn.10099acb
add esp, 4
mov edx, dword [ebp + 8]
xor eax, eax
mov al, byte [edx + 0x40]
test eax, eax
je 0x10057339
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], 0xcf
mov al, 1
jmp 0x1005745a
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], 0xcb
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0xcb
jne 0x1005741a
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x190]
xor eax, eax
mov al, byte [edx + 0x10]
test eax, eax
je 0x10057409
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0
je 0x10057381
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
call dword [ecx]
add esp, 4
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x190]
call dword [ecx]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100573a3
xor al, al
jmp 0x1005745a
cmp dword [ebp - 4], 2
jne 0x100573ab
jmp 0x10057409
mov edx, dword [ebp + 8]
cmp dword [edx + 8], 0
je 0x10057404
cmp dword [ebp - 4], 3
je 0x100573c0
cmp dword [ebp - 4], 1
jne 0x10057404
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov edx, dword [ecx + 4]
add edx, 1
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov dword [ecx + 4], edx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov eax, dword [eax + 4]
cmp eax, dword [edx + 8]
jl 0x10057404
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov eax, dword [edx + 8]
mov ecx, dword [ebp + 8]
add eax, dword [ecx + 0x11c]
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 8]
mov dword [ecx + 8], eax
jmp 0x10057369
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x7c]
mov dword [edx + 0x84], ecx
jmp 0x1005744e
mov edx, dword [ebp + 8]
cmp dword [edx + 0x14], 0xcc
je 0x1005744e
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ecx + 0x14], 0x14
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x14]
mov dword [eax + 0x18], edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call dword [edx]
add esp, 4
mov eax, dword [ebp + 8]
push eax
call fcn.1005745e
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x1005745e
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0xcc
je 0x10057494
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x180]
call dword [eax]
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x78], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], 0xcc
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x180]
xor edx, edx
mov dl, byte [ecx + 8]
test edx, edx
je 0x1005755a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 0x78]
cmp edx, dword [ecx + 0x60]
jae 0x10057526
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
je 0x100574ee
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x78]
mov dword [edx + 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x60]
mov dword [eax + 8], edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
call dword [edx]
add esp, 4
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x78]
mov dword [ebp - 4], ecx
push 0
mov edx, dword [ebp + 8]
add edx, 0x78
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x184]
call dword [edx + 4]
add esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x78]
cmp ecx, dword [ebp - 4]
jne 0x10057524
xor al, al
jmp 0x10057576
jmp 0x100574aa
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x180]
call dword [ecx + 4]
add esp, 4
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x180]
call dword [ecx]
add esp, 4
mov edx, dword [ebp + 8]
mov dword [edx + 0x78], 0
jmp 0x10057494
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax + 0x41]
neg ecx
sbb ecx, ecx
neg ecx
add ecx, 0xcd
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], ecx
mov al, 1
mov esp, ebp
pop ebp
ret