joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d7870
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x40c
push ebx
push ebp
mov ebp, ecx
push esi
mov ecx, dword [0x520690]
mov esi, dword [esp + 0x41c]
test ecx, ecx
push edi
mov byte [esp + 0x13], 0
je 0x4d78c1
mov ebx, dword [esp + 0x424]
mov eax, dword [ecx]
push ebx
push esi
call dword [eax + 0x10]
mov eax, dword [0x520690]
test eax, eax
je 0x4d78c8
cmp byte [eax + 0x90], 1
jne 0x4d78c8
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x40c
ret 8
mov ebx, dword [esp + 0x424]
call fcn.004cd4a0
test al, al
je 0x4d78e0
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x40c
ret 8
cmp dword [ebp], 0
je 0x4d7a72
mov al, byte [ebp + 8]
mov dl, bl
inc al
lea edi, [esp + 0x23]
mov byte [ebp + 8], al
mov cl, al
mov eax, ebx
mov byte [esp + 0x22], cl
sar eax, 8
mov byte [esp + 0x1e], al
mov ecx, ebx
not al
mov byte [esp + 0x20], al
mov eax, ecx
not dl
shr ecx, 2
mov byte [esp + 0x1c], 0xcf
mov byte [esp + 0x1d], 0x33
mov byte [esp + 0x1f], bl
mov byte [esp + 0x21], dl
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [ebx + 7]
xor cl, cl
test esi, esi
jle 0x4d7947
mov dl, byte [esp + eax + 0x1c]
add cl, dl
inc eax
cmp eax, esi
jl 0x4d793c
mov byte [esp + ebx + 0x23], cl
add ebx, 8
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], ebx
mov eax, dword [esp + 0x18]
mov ecx, dword [ebp]
push eax
lea eax, [esp + 0x20]
mov edx, dword [ecx]
push eax
call dword [edx + 8]
xor bl, bl
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp + 4]
sub eax, edi
cmp eax, ecx
ja 0x4d7a60
mov ecx, dword [ebp]
lea eax, [esp + 0x11]
push 1
push eax
mov edx, dword [ecx]
call dword [edx + 0xc]
cmp eax, 1
jne 0x4d7978
mov al, byte [esp + 0x11]
mov cl, byte [esp + 0x13]
test bl, bl
mov byte [esp + 0x13], al
jne 0x4d79cf
cmp cl, 0xcf
jne 0x4d7978
cmp al, 0x33
jne 0x4d7978
mov byte [esp + 0x21c], cl
mov byte [esp + 0x21d], al
mov bl, 1
mov esi, 2
jmp 0x4d7978
mov byte [esp + esi + 0x21c], al
inc esi
cmp esi, 9
jne 0x4d7978
mov al, byte [esp + 0x21e]
mov cl, byte [esp + 0x21f]
xor dx, dx
xor bx, bx
mov dl, al
mov bl, cl
shl edx, 8
add edx, ebx
cmp dx, 1
je 0x4d7a06
xor bl, bl
jmp 0x4d7978
mov dl, byte [esp + 0x220]
not dl
cmp al, dl
jne 0x4d79ff
mov al, byte [esp + 0x221]
not al
cmp cl, al
jne 0x4d79ff
mov al, byte [ebp + 8]
mov cl, byte [esp + 0x222]
cmp cl, al
jne 0x4d7a3b
mov cl, byte [esp + 0x223]
not cl
cmp al, cl
je 0x4d7a44
xor bl, bl
xor esi, esi
jmp 0x4d7978
xor cl, cl
xor eax, eax
mov bl, byte [esp + eax + 0x21c]
add cl, bl
inc eax
cmp eax, 8
jl 0x4d7a48
cmp cl, byte [esp + 0x224]
je 0x4d7a81
mov eax, dword [esp + 0x14]
inc eax
cmp eax, 3
mov dword [esp + 0x14], eax
jl 0x4d795a
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x40c
ret 8
mov eax, dword [esp + 0x424]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40c
ret 8
Function at 0x4d85b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4f6454
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi], 0x4f81d8
mov dword [esp + 0x40], 3
call fcn.004d8b00
mov eax, dword [esi + 0x74]
push eax
mov dword [esp + 0x18], eax
call fcn.004deb10
xor ebx, ebx
add esp, 4
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov eax, dword [esi + 0x6c]
cmp eax, ebx
mov byte [esp + 0x40], 1
je 0x4d86c8
mov edi, dword [esi + 0x4c]
add edi, 4
dec eax
cmp eax, ebx
mov dword [esi + 0x4c], edi
mov ecx, edi
mov dword [esi + 0x6c], eax
je 0x4d862c
cmp ecx, dword [esi + 0x48]
jne 0x4d86bd
mov eax, dword [esi + 0x50]
lea ecx, [eax + 4]
mov dword [esi + 0x50], ecx
mov eax, dword [eax]
push eax
call fcn.004deb10
mov eax, dword [esi + 0x6c]
add esp, 4
cmp eax, ebx
jne 0x4d868e
lea ecx, [esp + 0x18]
call fcn.004d9ce0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
lea edx, [esi + 0x44]
mov edi, dword [esp + 0x24]
mov ebp, edx
mov edx, dword [esp + 0x20]
mov dword [ebp], eax
mov dword [ebp + 4], ecx
mov dword [ebp + 8], edx
mov dword [ebp + 0xc], edi
lea ebp, [esi + 0x54]
mov dword [esi + 0x54], eax
mov eax, dword [esi + 0x64]
push eax
mov dword [ebp + 4], ecx
mov dword [ebp + 8], edx
mov dword [ebp + 0xc], edi
call fcn.004deb10
add esp, 4
jmp 0x4d86bd
mov eax, dword [esi + 0x50]
push eax
mov ecx, dword [eax]
push ecx
lea ecx, [esp + 0x30]
call fcn.004d9d50
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
lea eax, [esi + 0x44]
mov dword [esi + 0x44], ecx
mov ecx, dword [esp + 0x30]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x34]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov eax, dword [esi + 0x6c]
cmp eax, ebx
jne 0x4d8610
mov eax, dword [esi + 0x34]
push eax
mov dword [esp + 0x18], eax
call fcn.004deb10
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
add esi, 4
add esp, 4
mov dword [esp + 0x14], esi
mov ebp, dword [esi + 0x18]
mov edi, dword [esi + 0x14]
cmp edi, ebp
mov dword [esp + 0x40], 4
je 0x4d8708
mov ecx, edi
call fcn.004beab0
add edi, 4
cmp edi, ebp
jne 0x4d86fa
mov eax, dword [esi + 0x14]
push eax
call fcn.004deb10
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov eax, dword [esi + 4]
add esp, 4
cmp eax, ebx
je 0x4d8741
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4d8738
cmp al, 0xff
je 0x4d8738
dec al
mov byte [ecx], al
jmp 0x4d8741
push ecx
call fcn.004deb10
add esp, 4
mov ecx, dword [esp + 0x38]
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret
Function at 0x4dc490
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0xc
test eax, eax
push edi
mov edi, ecx
jbe 0x4dc5d5
fldln2
push ebx
push ebp
push esi
fld qword [0x4f7408]
fyl2x
fldln2
fld qword [0x4f8248]
fyl2x
fdivp st(1)
call fcn.004df2e8
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x20]
mov ecx, 0xfffffffc
sub ecx, eax
lea esi, [eax + 4]
mov dword [esp + 0x18], ecx
mov eax, dword [edi + 8]
mov ecx, dword [esi]
add ecx, eax
mov eax, dword [esi + 8]
mov dword [esi], ecx
mov ecx, dword [edi + 0xc]
add eax, ecx
lea ebp, [edi + 0x14]
mov dword [esi + 8], eax
mov dword [esp + 0x14], 0x10
mov edx, dword [esp + 0x10]
mov ebx, dword [esi]
push edx
mov ecx, edi
call fcn.004dc6b0
push eax
lea eax, [ebx + ebx + 1]
imul eax, ebx
push eax
mov ecx, edi
call fcn.004dc6e0
mov ecx, dword [esp + 0x10]
mov ebx, dword [esi + 8]
push ecx
mov ecx, edi
mov dword [esp + 0x24], eax
call fcn.004dc6b0
lea edx, [ebx + ebx + 1]
push eax
imul edx, ebx
push edx
mov ecx, edi
call fcn.004dc6e0
mov ebx, eax
mov ecx, edi
push ebx
call fcn.004dc6b0
mov ecx, dword [esp + 0x20]
push eax
mov eax, dword [esi - 4]
xor eax, ecx
mov ecx, edi
push eax
call fcn.004dc6e0
mov ecx, dword [ebp - 4]
add eax, ecx
mov ecx, dword [esp + 0x20]
push ecx
mov ecx, edi
mov dword [esi - 4], eax
call fcn.004dc6b0
mov ecx, dword [esi + 4]
push eax
xor ebx, ecx
mov ecx, edi
push ebx
call fcn.004dc6e0
mov edx, dword [ebp]
add ebp, 8
add eax, edx
mov edx, dword [esi]
mov dword [esi + 4], eax
mov eax, dword [esi - 4]
mov ecx, dword [esi + 4]
mov dword [esi - 4], edx
mov edx, dword [esi + 8]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x14]
mov dword [esi], ecx
dec eax
mov dword [esi + 4], edx
mov dword [esp + 0x14], eax
jne 0x4dc4f5
mov eax, dword [edi + 0x90]
mov ebx, dword [esi - 4]
add ebx, eax
mov eax, dword [esp + 0x24]
mov dword [esi - 4], ebx
mov ecx, dword [edi + 0x94]
add edx, ecx
mov dword [esi + 4], edx
mov edx, dword [esp + 0x18]
add esi, 0x10
add edx, esi
cmp edx, eax
jb 0x4dc4d6
pop esi
pop ebp
pop ebx
pop edi
add esp, 0xc
ret 8
Function at 0x4dc5e0
Capabilities:
Encrypt data using rc6

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, eax
mov ecx, eax
mov edx, eax
and ebx, 0x1000
and eax, 1
shr ecx, 0x10
shl edx, 0x10
or ebx, ecx
or edx, eax
shr ebx, 8
shl edx, 8
push edi
or ebx, edx
mov dword [esi + 8], 0xb7e15163
lea eax, [esi + 0xc]
mov ecx, 0x23
mov edx, dword [eax - 4]
add eax, 4
sub edx, 0x61c88647
dec ecx
mov dword [eax - 4], edx
jne 0x4dc61b
xor ebp, ebp
xor edi, edi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x10], 0x6c
push 3
mov ecx, esi
call fcn.004dc6b0
push eax
mov eax, dword [esp + 0x1c]
add eax, ebp
mov ebp, dword [esi + edi*4 + 8]
add eax, ebp
mov ecx, esi
push eax
call fcn.004dc6e0
mov ecx, dword [esp + 0x18]
mov ebp, eax
mov dword [esi + edi*4 + 8], eax
lea eax, [ecx + ebp]
mov ecx, esi
push eax
mov dword [esp + 0x1c], eax
call fcn.004dc6b0
mov edx, dword [esp + 0x18]
push eax
add edx, ebx
mov ecx, esi
push edx
call fcn.004dc6e0
mov ebx, eax
lea eax, [edi + 1]
xor edx, edx
mov ecx, 0x24
div ecx
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], ebx
dec eax
mov dword [esp + 0x10], eax
mov edi, edx
jne 0x4dc63d
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4

Function at 0x4dc7e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x60
mov ecx, 8
lea eax, [esp]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x74]
push edi
lea edi, [esp + 0x10]
push 0x30
push 0x515478
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.004dc700
mov esi, dword [esp + 0x80]
lea ecx, [esp + 0x1c]
add esp, 0xc
xor eax, eax
sub esi, ecx
mov bl, byte [esp + eax + 0x10]
lea ecx, [esp + eax + 0x10]
mov dl, byte [esi + ecx]
xor dl, bl
mov byte [esp + eax + 0x40], dl
inc eax
cmp eax, 0x30
jl 0x4dc819
mov ebp, dword [esp + 0x7c]
xor ebx, ebx
lea ecx, [esp + 0x45]
lea esi, [ebp + 2]
movsx eax, byte [ecx - 5]
movsx edx, byte [ecx]
lea eax, [edx + eax*2]
movsx edx, byte [ecx - 4]
lea eax, [edx + eax*2]
movsx edx, byte [ecx - 3]
lea eax, [edx + eax*2]
movsx edx, byte [ecx - 2]
lea eax, [edx + eax*2]
movsx edx, byte [ecx - 1]
lea eax, [edx + eax*2]
lea edi, [ebx + eax]
mov eax, dword [edi*4 + 0x5155b8]
cdq
and edx, 7
add eax, edx
sar eax, 3
movsx eax, al
and eax, 0x80000001
jns 0x4dc885
dec eax
or eax, 0xfffffffe
inc eax
mov byte [esi - 2], al
mov eax, dword [edi*4 + 0x5155b8]
cdq
and edx, 3
add eax, edx
sar eax, 2
movsx edx, al
and edx, 0x80000001
jns 0x4dc8a8
dec edx
or edx, 0xfffffffe
inc edx
mov byte [esi - 1], dl
mov eax, dword [edi*4 + 0x5155b8]
cdq
sub eax, edx
sar eax, 1
movsx eax, al
and eax, 0x80000001
jns 0x4dc8c6
dec eax
or eax, 0xfffffffe
inc eax
mov byte [esi], al
movsx edx, byte [edi*4 + 0x5155b8]
and edx, 0x80000001
jns 0x4dc8dd
dec edx
or edx, 0xfffffffe
inc edx
mov byte [esi + 1], dl
add ebx, 0x40
add ecx, 6
add esi, 4
cmp ebx, 0x200
jl 0x4dc83d
push 0x20
push 0x515538
push ebp
call fcn.004dc700
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret
Function at 0x4dc910
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x50c
mov ecx, dword [esp + 0x514]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x520]
sub ecx, edi
lea ebp, [esp + 0x5c]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], 8
jmp 0x4dc940
mov ecx, dword [esp + 0x18]
mov cl, byte [ecx + edi]
mov dl, byte [edi]
mov byte [esp + 0x13], cl
mov esi, ebp
lea ecx, [esp + 0x5c]
xor eax, eax
mov byte [esp + 0x12], dl
mov edx, 7
sub esi, ecx
mov bl, byte [esp + 0x13]
mov cl, dl
sar bl, cl
lea ecx, [esi + eax]
and bl, 1
mov byte [esp + ecx + 0x5c], bl
mov bl, byte [esp + 0x12]
mov cl, dl
sar bl, cl
lea ecx, [esi + eax]
and bl, 1
inc eax
dec edx
cmp eax, 8
mov byte [esp + ecx + 0x1c], bl
jl 0x4dc95c
mov eax, dword [esp + 0x14]
inc edi
add ebp, 8
dec eax
mov dword [esp + 0x14], eax
jne 0x4dc93c
push 0x40
lea edx, [esp + 0x20]
push 0x515098
push edx
call fcn.004dc700
push 0x38
lea eax, [esp + 0x6c]
push str.91__
push eax
call fcn.004dc700
add esp, 0x18
lea ebp, [esp + 0x11c]
mov ebx, 0x515378
mov ecx, dword [ebx]
lea edx, [esp + 0x5c]
push ecx
push edx
call fcn.004dc780
mov edi, ebp
add ebx, 4
add esp, 8
mov ecx, 0x10
lea esi, [esp + 0x5c]
add ebp, 0x40
cmp ebx, 0x5153b8
rep movsd dword es:[edi], dword [esi]
jl 0x4dc9c7
push 0x30
lea eax, [esp + 0x4e0]
push 0x5153b8
push eax
call fcn.004dc700
mov ecx, 8
lea esi, [esp + 0x28]
lea edi, [esp + 0xe8]
lea edx, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
mov ecx, 8
lea esi, [esp + 0x48]
lea edi, [esp + 0x28]
lea eax, [esp + 0x4e8]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0xa8]
push ecx
push edx
push eax
call fcn.004dc7e0
add esp, 0x18
xor eax, eax
mov cl, byte [esp + eax + 0x9c]
mov bl, byte [esp + eax + 0xdc]
xor cl, bl
mov byte [esp + eax + 0x1c], cl
inc eax
cmp eax, 0x20
jl 0x4dca46
lea ebx, [esp + 0x49c]
mov ebp, 0xf
mov ecx, 8
lea esi, [esp + 0x3c]
lea edi, [esp + 0xdc]
push 0x30
rep movsd dword es:[edi], dword [esi]
mov ecx, 8
lea esi, [esp + 0x20]
lea edi, [esp + 0x40]
push 0x5153b8
rep movsd dword es:[edi], dword [esi]
push ebx
call fcn.004dc700
lea edx, [esp + 0xa8]
lea eax, [esp + 0x28]
push edx
push eax
push ebx
call fcn.004dc7e0
add esp, 0x18
xor eax, eax
mov cl, byte [esp + eax + 0x9c]
mov dl, byte [esp + eax + 0xdc]
xor cl, dl
mov byte [esp + eax + 0x1c], cl
inc eax
cmp eax, 0x20
jl 0x4dcab2
sub ebx, 0x40
dec ebp
jne 0x4dca6c
push 0x40
lea edx, [esp + 0x20]
push 0x515198
push edx
call fcn.004dc700
mov eax, dword [esp + 0x534]
lea ecx, [esp + 0x28]
push eax
push ecx
call fcn.004dc740
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50c
ret
Function at 0x4ddc60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov al, 0x62
mov edx, dword [esp + 0x24]
mov byte [esp + 5], al
mov byte [esp + 0xd], al
xor eax, eax
mov ecx, dword [ecx + 0x10]
mov dword [esp + 0x10], eax
push edx
mov dword [esp + 0x18], eax
mov byte [esp + 4], 0x12
mov dword [esp + 0x1c], eax
mov byte [esp + 5], 0x22
mov dword [esp + 0x20], eax
push eax
lea eax, [esp + 8]
mov byte [esp + 0xa], 0x32
push eax
push 0
push 1
mov byte [esp + 0x17], 0x42
mov byte [esp + 0x18], 0x5a
mov byte [esp + 0x1a], 0x72
mov byte [esp + 0x1b], 0x82
mov byte [esp + 0x1c], 0xff
mov byte [esp + 0x1d], 0x24
mov byte [esp + 0x1e], 0x3a
mov byte [esp + 0x1f], 0x44
mov byte [esp + 0x20], 0x53
mov byte [esp + 0x22], 0xc4
mov byte [esp + 0x23], 0x84
call fcn.004ddeb0
neg eax
sbb eax, eax
inc eax
add esp, 0x20
ret 4
Function at 0x4de550
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov edx, 1
cmp dword [esi + 0x1c], edx
jbe 0x4de65b
push ebx
push edi
lea eax, [esi + 0x32]
xor ebx, ebx
xor ecx, ecx
mov bl, byte [eax - 1]
mov cl, byte [eax + 1]
add eax, 0x10
mov edi, dword [ebx*4 + 0x5184a8]
mov ecx, dword [ecx*4 + 0x518ca8]
xor ebx, ebx
xor ecx, edi
mov bl, byte [eax - 0x10]
mov edi, dword [ebx*4 + 0x5188a8]
xor ebx, ebx
mov bl, byte [eax - 0x12]
xor ecx, edi
mov edi, dword [ebx*4 + 0x5180a8]
xor ebx, ebx
xor ecx, edi
mov dword [eax - 0x12], ecx
mov bl, byte [eax - 0xc]
xor ecx, ecx
mov cl, byte [eax - 0xb]
mov edi, dword [ebx*4 + 0x5188a8]
xor ebx, ebx
mov ecx, dword [ecx*4 + 0x518ca8]
mov bl, byte [eax - 0xd]
xor ecx, edi
mov edi, dword [ebx*4 + 0x5184a8]
xor ebx, ebx
mov bl, byte [eax - 0xe]
xor ecx, edi
mov edi, dword [ebx*4 + 0x5180a8]
xor ebx, ebx
xor ecx, edi
mov dword [eax - 0xe], ecx
mov bl, byte [eax - 8]
xor ecx, ecx
mov cl, byte [eax - 7]
mov edi, dword [ebx*4 + 0x5188a8]
xor ebx, ebx
mov ecx, dword [ecx*4 + 0x518ca8]
mov bl, byte [eax - 9]
xor ecx, edi
mov edi, dword [ebx*4 + 0x5184a8]
xor ebx, ebx
mov bl, byte [eax - 0xa]
xor ecx, edi
mov edi, dword [ebx*4 + 0x5180a8]
xor ebx, ebx
xor ecx, edi
mov dword [eax - 0xa], ecx
mov bl, byte [eax - 4]
xor ecx, ecx
mov cl, byte [eax - 3]
mov edi, dword [ebx*4 + 0x5188a8]
xor ebx, ebx
mov ecx, dword [ecx*4 + 0x518ca8]
mov bl, byte [eax - 5]
xor ecx, edi
mov edi, dword [ebx*4 + 0x5184a8]
xor ebx, ebx
mov bl, byte [eax - 6]
xor ecx, edi
mov edi, dword [ebx*4 + 0x5180a8]
xor ecx, edi
inc edx
mov dword [eax - 6], ecx
mov ecx, dword [esi + 0x1c]
cmp edx, ecx
jb 0x4de566
pop edi
pop ebx
pop esi
ret
Function at 0x4e3789
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x5194d8
cmp edx, dword [eax]
je 0x4e37ab
add eax, 8
inc ecx
cmp eax, 0x519568
jl 0x4e379c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x5194d8]
jne 0x4e38d9
mov eax, dword [0x520700]
cmp eax, 1
je 0x4e38b3
test eax, eax
jne 0x4e37dc
cmp dword [0x5191d4], 1
je 0x4e38b3
cmp edx, 0xfc
je 0x4e38d9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4e3813
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004e3ea0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004e08a0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4e3856
lea eax, [ebp - 0x1a4]
push eax
call fcn.004e08a0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4fc1dc
push edi
call fcn.004e6350
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004e3ea0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004e3eb0
lea eax, [ebp - 0xa0]
push 0x510388
push eax
call fcn.004e3eb0
push dword [esi + 0x5194dc]
lea eax, [ebp - 0xa0]
push eax
call fcn.004e3eb0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004e62c1
add esp, 0x2c
pop edi
jmp 0x4e38d9
lea eax, [ebp + 8]
lea esi, [esi + 0x5194dc]
push 0
push eax
push dword [esi]
call fcn.004e08a0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x438ca5
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x438a14
and eax, edx
add edx, 0x62b17ad4
push eax
pop eax
call fcn.00438cdb
add eax, 0x406f03eb
xor dword [ebx], edi
and eax, eax
dec eax
inc ebx
mov eax, edx
sub eax, 0x29a5b7ba
cmp ebx, ecx
jne fcn.00438ca5
sub eax, edx
ret
Function at 0x431005
Capabilities:
Encode data using xor

Disassembly:
pushal
mov eax, section..rsrc
nop
nop
mov ebx, 0x40915c
mov ecx, 0x60ba1e89
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x2e0e415b
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x5033dc
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov eax, dword [0x52914c]
mov eax, dword [eax]
call fcn.00405258
push eax
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.KERNEL32.DLL_CreateFileMappingA
mov esi, eax
mov dword [ebx + 0x3bc], esi
push 0
push 0
push 0
push 0xf001f
push esi
call sub.KERNEL32.DLL_MapViewOfFile
mov edi, eax
mov dword [ebx + 0x3c0], edi
test edi, edi
je 0x503431
mov eax, ebx
call fcn.004598b0
mov edx, dword [ebx + 0x3c0]
mov dword [edx], eax
pop edi
pop esi
pop ebx
ret

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x760d7b0e
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..text_1
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x5caf186c
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x400703ff
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x1e091f83
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219