joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10017611
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0xa0
mov eax, dword [0x10088374]
xor eax, esp
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xa8]
push ebx
mov ebx, dword [esp + 0xa8]
push ebp
push esi
mov esi, dword [esp + 0xb8]
push edi
xor edi, edi
mov dword [esp + 0x18], ebx
push ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x10017676
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push esi
jmp 0x100177a0
mov edx, 0x80
test esi, esi
je 0x1001768d
test ebp, 0x400
mov eax, 0x200080
cmovne edx, eax
mov ecx, edx
mov eax, ebp
push edi
or ecx, 0x2000000
test al, 0x10
cmove ecx, edx
push ecx
push 3
push edi
push 7
push 0x88
push ebx
call dword [sym.imp.kernel32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10017662
lea eax, [esp + 0x78]
push eax
push ebx
call dword [sym.imp.kernel32.dll_GetFileInformationByHandle]
mov esi, eax
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esp + 0x1c], eax
test esi, esi
je 0x1001778f
push 0x18
lea eax, [esp + 0x64]
push eax
push 1
push ebx
call dword [sym.imp.kernel32.dll_GetFileInformationByHandleEx]
mov esi, eax
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esp + 0x1c], eax
test esi, esi
je 0x1001778f
mov esi, dword [esp + 0x18]
test ebp, 0x400
je 0x10017748
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x10]
xor edx, edx
test ecx, ecx
push 1
cmovne eax, edx
push eax
push edi
push edi
lea eax, [esp + 0x24]
push eax
xor eax, eax
test ecx, ecx
cmovne eax, ebx
test ecx, ecx
push eax
mov eax, esi
cmovne eax, edx
push eax
call fcn.10027c0f
add esp, 0x1c
test eax, eax
jns 0x10017744
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x100177ac
mov edi, dword [esp + 0x14]
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x7c]
push eax
push dword [esp + 0x18]
push esi
call fcn.10027c0f
push dword [esp + 0x20]
call sym.glib_lite.dll_Ordinal_121
push dword [esp + 0x38]
lea eax, [esp + 0x78]
push edi
push eax
lea eax, [esp + 0x98]
push eax
lea eax, [esp + 0x4c]
push eax
call fcn.10027c0f
add esp, 0x28
xor eax, eax
jmp 0x100177af
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [esp + 0x1c]
mov ecx, eax
call fcn.10017cf5
add esp, 4
mov dword [ecx], eax
or eax, 0xffffffff
mov ecx, dword [esp + 0xac]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10034eb7
add esp, 0xa0
ret
Function at 0x100179e3
Capabilities:
Create directory

Disassembly:
push ebp
xor eax, eax
push eax
push eax
push eax
push 0xffffffffffffffff
push dword [esp + 0x18]
call sym.glib_lite.dll_Ordinal_482
mov ebp, eax
add esp, 0x14
test ebp, ebp
jne 0x10017a0e
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
pop ebp
mov dword [eax], 0x16
or eax, 0xffffffff
ret
push ebx
push esi
push ebp
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wmkdir]
mov ebx, eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push ebp
mov esi, dword [eax]
call sym.glib_lite.dll_Ordinal_121
pop ecx
pop ecx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], esi
mov eax, ebx
pop esi
pop ebx
pop ebp
ret

Function at 0x10017a94
Capabilities:
Move file

Disassembly:
push ebx
push esi
push edi
xor esi, esi
or edi, 0xffffffff
push esi
push esi
push esi
push edi
push dword [esp + 0x20]
call sym.glib_lite.dll_Ordinal_482
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x10017ac0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], 0x16
jmp 0x10017b26
push ebp
push esi
push esi
push esi
push edi
push dword [esp + 0x28]
call sym.glib_lite.dll_Ordinal_482
mov ebp, eax
add esp, 0x14
test ebp, ebp
jne 0x10017aec
push ebx
call sym.glib_lite.dll_Ordinal_121
pop ecx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], 0x16
jmp 0x10017b25
push 1
push ebp
push ebx
call dword [sym.imp.kernel32.dll_MoveFileExW]
test eax, eax
je 0x10017afe
mov edi, esi
jmp 0x10017b0f
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.10017cf5
add esp, 4
mov esi, eax
push ebx
call sym.glib_lite.dll_Ordinal_121
push ebp
call sym.glib_lite.dll_Ordinal_121
pop ecx
pop ecx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], esi
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x1001aa35
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ecx
push esi
lea eax, [esp + 8]
xor esi, esi
push eax
push 1
push esi
push 0x1003a9e8
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001aac4
push ebp
lea eax, [esp + 8]
mov dword [esp + 8], esi
push eax
push esi
push esi
push esi
mov ebp, str.TimeZoneKeyName
push ebp
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1001aab9
push edi
push dword [esp + 0xc]
call sym.glib_lite.dll_Ordinal_214
mov edi, eax
pop ecx
test edi, edi
je 0x1001aab1
lea eax, [esp + 0xc]
push eax
push edi
push esi
push esi
push ebp
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1001aab1
push esi
push esi
push esi
push 0xffffffffffffffff
push edi
call sym.glib_lite.dll_Ordinal_480
add esp, 0x14
mov esi, eax
jmp 0x1001aab8
push edi
call sym.glib_lite.dll_Ordinal_121
pop ecx
pop edi
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
mov eax, esi
pop esi
pop ecx
pop ecx
ret

Function at 0x1001c8c2
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x2c
mov eax, dword [0x10088374]
xor eax, esp
mov dword [esp + 0x28], eax
push ebp
push esi
xor ebp, ebp
push str.LC_ALL
mov esi, ebp
call sym.glib_lite.dll_Ordinal_130
pop ecx
test eax, eax
je 0x1001c8ea
cmp byte [eax], 0
jne 0x1001c912
push str.LC_MESSAGES
call sym.glib_lite.dll_Ordinal_130
pop ecx
test eax, eax
je 0x1001c8fe
cmp byte [eax], 0
jne 0x1001c912
push str.LANG
call sym.glib_lite.dll_Ordinal_130
pop ecx
test eax, eax
je 0x1001c91e
cmp byte [eax], 0
je 0x1001c91e
push eax
call sym.glib_lite.dll_Ordinal_386
pop ecx
jmp 0x1001c9e6
push ebx
push edi
call dword [sym.imp.kernel32.dll_GetThreadLocale]
mov ebx, dword [sym.imp.kernel32.dll_GetLocaleInfoW]
mov edi, eax
push 0x14
lea eax, [esp + 0x14]
push eax
push 0x59
push edi
call ebx
test eax, eax
je 0x1001c9d9
push 0x14
lea eax, [esp + 0x28]
push eax
push 0x5a
push edi
call ebx
test eax, eax
je 0x1001c9d9
movzx ecx, di
mov eax, ecx
and ecx, 0x3ff
shr eax, 0xa
cmp ecx, 0x1a
je 0x1001c984
cmp ecx, 0x2c
je 0x1001c973
cmp ecx, 0x43
jne 0x1001c994
sub eax, 1
je 0x1001c98f
sub eax, 1
jne 0x1001c994
mov esi, str._Cyrl
jmp 0x1001c994
dec eax
sub eax, 1
je 0x1001c98f
sub eax, 4
jne 0x1001c994
mov esi, str._Latn
push ebp
push ebp
push ebp
lea eax, [esp + 0x1c]
push 0xffffffffffffffff
push eax
call sym.glib_lite.dll_Ordinal_480
push ebp
push ebp
push ebp
mov ebx, eax
lea eax, [esp + 0x44]
push 0xffffffffffffffff
push eax
call sym.glib_lite.dll_Ordinal_480
push ebp
push esi
mov edi, eax
push edi
push 0x1003ae10
push ebx
call sym.glib_lite.dll_Ordinal_384
push edi
mov esi, eax
call sym.glib_lite.dll_Ordinal_121
add esp, 0x40
push ebx
call sym.glib_lite.dll_Ordinal_121
mov eax, esi
jmp 0x1001c9e3
push 0x10039878
call sym.glib_lite.dll_Ordinal_386
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x30]
pop esi
pop ebp
xor ecx, esp
call fcn.10034eb7
add esp, 0x2c
ret
Function at 0x1001cce7
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10088374]
xor eax, ebp
mov dword [ebp - 4], eax
push str.G_DEBUG
mov dword [ebp - 0x1c], str.gc_friendly
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], str.fatal_warnings
mov dword [ebp - 0x10], 0x18
mov dword [ebp - 0xc], str.fatal_criticals
mov dword [ebp - 8], 8
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
pop ecx
test eax, eax
je 0x1001cd40
push 3
lea ecx, [ebp - 0x1c]
push ecx
push eax
call fcn.1001cdfe
add esp, 0xc
mov ecx, eax
and eax, 1
and ecx, 0xfffffffc
mov dword [0x100888c8], eax
or dword [0x1008821c], ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10034eb7
leave
ret

Function at 0x1001ec99
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
lea eax, [edi + 0x74]
push eax
xor eax, eax
push eax
push edi
push dword [esp + 0x20]
push eax
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov esi, eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
test esi, esi
jne 0x1001ece0
push dword [eax]
call sym.glib_lite.dll_Ordinal_391
push eax
push str.Error_creating_thread:__s.
push 0x10
push str.Glib
call sym.glib_lite.dll_Ordinal_202
add esp, 0x14
jmp 0x1001ed14
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x1001ed14
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.10027c0f
mov esi, eax
push esi
push str.Error_closing_thread_handle:__s.
push 0x10
push str.Glib
call sym.glib_lite.dll_Ordinal_202
push esi
call sym.glib_lite.dll_Ordinal_121
add esp, 0x18
push 0xffffffffffffffff
push dword [edi + 0x8c]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
pop edi
pop esi
ret
Function at 0x1002669a
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
xor ebp, ebp
push edi
sub eax, ebp
je 0x100267b6
sub eax, 1
je 0x1002671f
sub eax, 1
je 0x100266ef
sub eax, 1
jne 0x10026823
movzx edi, word [esi + 2]
and edi, 1
je 0x10026823
mov ebx, edi
shl ebx, 4
mov eax, dword [esi + 0xc]
lea ebx, [ebx - 8]
push esi
push dword [eax + ebx]
call dword [eax + ebx + 4]
pop ecx
pop ecx
sub edi, 1
jne 0x100266d5
jmp 0x10026823
movzx edi, word [esi + 2]
and edi, 1
je 0x10026823
lea ebx, [edi*8 - 8]
mov ecx, dword [esi + 0xc]
mov eax, ebx
push esi
sub ebx, 8
push dword [ecx + eax]
call dword [ecx + eax + 4]
pop ecx
pop ecx
sub edi, 1
jne 0x10026703
jmp 0x10026823
mov edi, dword [sym.glib_lite.dll_Ordinal_28]
mov eax, dword [esi]
or eax, 0x8000000
push eax
push dword [esi]
push esi
call edi
add esp, 0xc
test eax, eax
je 0x10026725
jmp 0x10026792
mov ecx, dword [esi]
shr ecx, 0x13
dec ecx
shl ecx, 0x13
xor ecx, dword [esi]
and ecx, 0x7f80000
xor ecx, dword [esi]
push ecx
push dword [esi]
mov eax, ecx
shr eax, 0x13
push esi
movzx ebx, al
call edi
add esp, 0xc
test eax, eax
je 0x1002673b
mov ecx, dword [esi]
mov eax, ecx
shr ecx, 0x11
shr eax, 0x10
and ecx, 3
and eax, 1
add ecx, ebx
push esi
lea edx, [ecx + eax*2]
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx + edx*8 + 4]
mov dword [esi + 4], eax
mov eax, dword [ecx + edx*8]
mov dword [esi + 8], eax
push dword [ecx + edx*8]
call dword [ecx + edx*8 + 4]
pop ecx
pop ecx
test dword [esi], 0x7f80000
jne 0x1002673b
mov dword [esi + 4], ebp
mov dword [esi + 8], ebp
mov eax, dword [esi]
and eax, 0xf7ffffff
push eax
push dword [esi]
push esi
call edi
add esp, 0xc
test eax, eax
je 0x100267a0
jmp 0x10026823
test dword [esi], 0x60000
je 0x1002681d
mov eax, dword [esi]
shr eax, 0x11
dec eax
shl eax, 0x11
xor eax, dword [esi]
and eax, 0x60000
xor eax, dword [esi]
push eax
push dword [esi]
mov ebp, eax
shr ebp, 0x11
push esi
and ebp, 3
call dword [0x100848d4]
add esp, 0xc
test eax, eax
je 0x100267be
movzx eax, word [esi + 2]
mov ecx, dword [esi + 0xc]
and eax, 1
push esi
lea edx, [eax*2]
add edx, ebp
mov eax, dword [ecx + edx*8 + 4]
mov dword [esi + 4], eax
mov eax, dword [ecx + edx*8]
mov dword [esi + 8], eax
push dword [ecx + edx*8]
call dword [ecx + edx*8 + 4]
test dword [esi], 0x60000
pop ecx
pop ecx
jne 0x100267be
xor ebp, ebp
mov dword [esi + 4], ebp
mov dword [esi + 8], ebp
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10026828
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
mov ecx, dword [ebx]
mov eax, ecx
shr eax, 0x13
movzx edx, al
mov eax, ecx
shr eax, 0x10
and eax, 1
shr ecx, 0x11
and ecx, 3
add ecx, edx
lea edi, [eax*2 - 1]
mov eax, dword [ebx + 0xc]
add edi, ecx
lea edi, [eax + edi*8]
mov eax, edx
shl eax, 3
mov esi, edi
sub esi, eax
add esi, 8
cmp esi, edi
ja 0x10026880
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
cmp dword [esi + 4], eax
jne 0x10026879
cmp dword [esi], ecx
je 0x10026886
add esi, 8
cmp esi, edi
jbe 0x10026870
xor eax, eax
pop edi
pop esi
pop ebx
ret
mov eax, dword [ebx]
and eax, 0xfff80000
dec eax
xor eax, dword [ebx]
and eax, 0x7f80000
xor eax, dword [ebx]
push eax
push dword [ebx]
push ebx
call dword [0x100848d4]
add esp, 0xc
test eax, eax
je 0x10026886
cmp esi, edi
jae 0x100268b6
mov ecx, dword [edi]
mov edx, dword [edi + 4]
mov dword [esi], ecx
mov dword [esi + 4], edx
xor eax, eax
inc eax
jmp 0x10026882

Function at 0x10026d92
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
push 8
mov edx, dword [esi]
mov eax, edx
shr eax, 0x13
movzx ecx, al
mov eax, edx
shr eax, 0x11
shr edx, 0xf
and eax, 3
and edx, 2
add ecx, eax
lea eax, [edx + 1]
add eax, ecx
push eax
push dword [esi + 0xc]
call dword [0x100848dc]
mov edi, dword [esi]
mov ebx, eax
mov ecx, edi
mov dword [esi + 0xc], ebx
shr ecx, 0x13
add esp, 0xc
movzx eax, cl
test cl, cl
je 0x10026dff
mov edx, edi
shr edi, 0x11
shr edx, 0x10
and edi, 3
and edx, 1
add edx, edx
lea ecx, [edx + edi]
add edx, edi
add edx, eax
mov eax, dword [ebx + ecx*8]
mov ecx, dword [ebx + ecx*8 + 4]
mov dword [ebx + edx*8], eax
mov dword [ebx + edx*8 + 4], ecx
mov eax, dword [esi]
mov edx, eax
mov ecx, dword [esi + 0xc]
shr eax, 0xf
shr edx, 0x11
and eax, 2
and edx, 3
add edx, eax
mov eax, dword [esp + 0x14]
mov dword [ecx + edx*8], eax
mov ecx, dword [esi + 0xc]
mov eax, dword [esp + 0x18]
mov dword [ecx + edx*8 + 4], eax
mov ecx, dword [esi]
lea eax, [ecx + 0x20000]
xor eax, ecx
and eax, 0x60000
xor eax, ecx
push eax
push ecx
push esi
call dword [0x100848d4]
add esp, 0xc
test eax, eax
je 0x10026e26
pop edi
pop esi
pop ebx
ret

Function at 0x10026f88
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
mov edx, dword [esi]
lea ecx, [edx + 1]
xor ecx, edx
and ecx, 0x7fff
xor ecx, edx
push ecx
push edx
push esi
call dword [0x100848d4]
add esp, 0xc
test eax, eax
je 0x10026f8d
mov eax, esi
pop esi
ret
Function at 0x1002706b
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov ebx, 0x7fff
mov eax, dword [edi]
and eax, ebx
cmp eax, 1
jne 0x10027087
push edi
call fcn.10026e4b
pop ecx
mov ecx, dword [edi]
lea eax, [ecx - 1]
xor eax, ecx
and eax, ebx
xor eax, ecx
push eax
push ecx
mov esi, eax
push edi
and esi, ebx
call dword [0x100848d4]
add esp, 0xc
test eax, eax
je 0x10027087
test esi, esi
jne 0x100270c5
push esi
push edi
call fcn.1002669a
push dword [edi + 0xc]
mov esi, dword [sym.glib_lite.dll_Ordinal_121]
call esi
lea eax, [edi - 0x10]
push eax
call esi
add esp, 0x10
pop edi
pop esi
pop ebx
ret

Function at 0x10027c0f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x10027c1e
pop dword [ebp - 0x4c]
mov eax, 0xcabc55dc
sub eax, 0xbab9d9be
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x2d336022
add dword [ebp - 0x5c], 0x211ee529
mov dword [ebp - 0x58], 0xcd2249d4
sub dword [ebp - 0x58], 0x9aeefd8f
mov dword [ebp - 0x54], 0x28863e9e
sub dword [ebp - 0x54], 0xdc39fa70
mov dword [ebp - 0x50], 0xa46eb88c
add dword [ebp - 0x50], 0x5b914774
lea eax, [ebp - 0x5c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x8363a96
add dword [ebp - 0x5c], 0x6c3c2ec0
mov dword [ebp - 0x58], 0x19e0001
add dword [ebp - 0x58], 0x3fce6174
mov dword [ebp - 0x54], 0xba5894f9
add dword [ebp - 0x54], 0xa916d773
mov dword [ebp - 0x50], 0x8413cc24
sub dword [ebp - 0x50], 0x8413cc24
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0xd3f521a2
add eax, 0x3c0e4fbe
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x39d1f
push 0
call eax
mov ecx, 0x8037bd74
add ecx, 0x7fc8865a
xor ebx, ebx
add ebx, eax
mov edi, 0xaec0dd02
add edi, 0x6147fefe
add edi, dword [ebp - 0x4c]
mov edx, 0xf6c3c25f
sub edx, 0x99ed2759
sub dword [ebp - 0x18], edi
mov esi, dword [edi]
xor dword [ebp - 0x1c], eax
sub esi, edx
xor dword [ebp - 0xc], ecx
mov dword [ebx], esi
xor dword [ebp - 0x24], ecx
add ebx, 0x6595df75
add ebx, 0x9a6a208f
add edi, 0x5f5e2e10
add edi, 0xa0a1d1f4
loop 0x10027d3d
add eax, 0x571d38b6
add eax, 0xa8e3c955
mov ebx, eax
add eax, 5
mov ecx, 0x9fb51339
sub ecx, 0x8fb51339
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
je 0x432072
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x4ced6f64
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x432060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4320d2
nop
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x4ec87855
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x401485
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x401485
lcall 0x5de5, 0x8b10c483
jmp loc.00788f3c

Function at 0x501d80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x502360
push 0x501f80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
add esp, 4
mov dword [0x5033f4], 0xffffffff
mov dword [0x5033f8], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x5033f0]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov edx, dword [0x5033ec]
mov dword [eax], edx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov ecx, dword [eax]
mov dword [0x5033fc], ecx
call fcn.00501f70
mov eax, dword [0x503128]
test eax, eax
jne 0x501e11
push 0x501f60
call dword [sym.imp.MSVCRT.dll___setusermatherr]
add esp, 4
call fcn.00501f40
push 0x50300c
push 0x503008
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [0x5033e8]
mov dword [ebp - 0x6c], edx
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [0x5033e4]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.MSVCRT.dll___getmainargs]
add esp, 0x14
push 0x503004
push section..data
call sub.MSVCRT.dll__initterm
add esp, 8
call dword [sym.imp.MSVCRT.dll___p__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x501f1f
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x501e85
cmp al, 0x22
jne 0x501e77
cmp byte [esi], 0x22
jne 0x501e8e
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x501e9e
cmp al, 0x20
ja 0x501e9e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x501e8e
mov dword [ebp - 0x30], 0
lea edx, [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x501ebf
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x501ec4
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x501f04
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x501e8e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x501f1f
Function at 0x40113e
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 6]
and dword [ebp - 8], 0
push ebx
mov dword [ebp - 4], eax
movzx eax, word [ecx + 0x14]
push esi
push edi
lea esi, [eax + ecx + 0x18]
mov eax, dword [ebp + 8]
cmp eax, dword [esi + 0xc]
jb 0x4011ad
mov edi, dword [ecx + 0x38]
mov eax, dword [esi + 8]
mov edx, dword [ecx + 0x3c]
mov ebx, dword [esi + 0x10]
lea eax, [eax + edi - 1]
dec edi
not edi
and eax, edi
lea edi, [ebx + edx - 1]
dec edx
not edx
and edi, edx
cmp edi, eax
jbe 0x401191
mov eax, dword [ecx + 0x3c]
lea edx, [eax + ebx - 1]
jmp 0x40119b
mov eax, dword [ecx + 0x38]
mov edx, dword [esi + 8]
lea edx, [eax + edx - 1]
dec eax
not eax
and edx, eax
mov eax, dword [esi + 0xc]
add eax, edx
cmp dword [ebp + 8], eax
jae 0x4011ad
mov dword [ebp - 8], esi
mov eax, dword [ebp - 8]
add esi, 0x28
dec dword [ebp - 4]
test eax, eax
jne 0x4011bf
cmp dword [ebp - 4], eax
jne 0x40115e
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x401399
Capabilities:
Terminate process

Disassembly:
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test eax, eax
mov dword [0x404010], eax
je 0x4013d9
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, 0x102
push eax
call fcn.0040146d
test eax, eax
jne 0x4013dc
push esi
call fcn.004014bb
jmp 0x4013dc
push 8
pop eax
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]