joyce8/EMBER2024-capa huggingface dataset:
Function at 0x30612460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [edi + 0x2c]
push ebp
push esi
mov ebp, dword [edi + 0x3c]
sub ebp, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x2c]
lea edx, [ebx + ecx - 0x106]
sub ebp, eax
cmp eax, edx
jb 0x306124de
mov eax, dword [edi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call sub.MSVCR90.dll_memcpy
mov edx, dword [edi + 0x4c]
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
add esp, 0xc
sub dword [edi + 0x5c], ebx
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x306124b1
sub eax, ebx
jmp 0x306124b3
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x306124a2
mov ecx, dword [edi + 0x40]
mov edx, ebx
lea ecx, [ecx + ebx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x306124d2
sub eax, ebx
jmp 0x306124d4
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x306124c3
add ebp, ebx
mov esi, dword [edi]
cmp dword [esi + 4], 0
je 0x30612539
mov edx, dword [edi + 0x74]
add edx, dword [edi + 0x6c]
mov ecx, ebp
add edx, dword [edi + 0x38]
push edx
call fcn.306122c0
add dword [edi + 0x74], eax
mov edx, dword [edi + 0x74]
add esp, 4
cmp edx, 3
jb 0x30612525
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x38]
lea esi, [eax + ecx]
movzx eax, byte [esi]
mov ecx, dword [edi + 0x58]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [esi + 1]
xor eax, ecx
and eax, dword [edi + 0x54]
mov dword [edi + 0x48], eax
cmp edx, 0x106
jae 0x30612539
mov edx, dword [edi]
cmp dword [edx + 4], 0
jne 0x30612466
pop esi
pop ebp
pop ebx
ret

Function at 0x30613150
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x306131aa
cmp byte [esi + 0x5c], 0x77
jne 0x306131aa
cmp dword [esi + 0x10], 0
jne 0x30613195
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 0x48]
push ecx
push 0x4000
push 1
push eax
mov dword [esi + 0xc], eax
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
cmp eax, 0x4000
je 0x3061318e
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x10], 0x4000
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push edx
push eax
push esi
call sym.zlib1.dll_deflateParams
add esp, 0xc
pop esi
ret
mov eax, 0xfffffffe
pop esi
ret

Function at 0x306131c0
Capabilities:
Read file on windows

Disassembly:
cmp dword [esi + 0x3c], 0
jne 0x30613216
cmp dword [esi + 4], 0
jne 0x3061321f
call dword [sym.imp.MSVCR90.dll__errno]
mov dword [eax], 0
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x44]
push eax
push 0x4000
push 1
push ecx
call dword [sym.imp.MSVCR90.dll_fread]
add esp, 0x10
mov dword [esi + 4], eax
test eax, eax
jne 0x3061321a
mov edx, dword [esi + 0x40]
push edx
mov dword [esi + 0x3c], 1
call dword [sym.imp.MSVCR90.dll_ferror]
add esp, 4
test eax, eax
je 0x30613216
mov dword [esi + 0x38], 0xffffffff
or eax, 0xffffffff
ret
mov eax, dword [esi + 0x44]
mov dword [esi], eax
mov eax, dword [esi]
dec dword [esi + 4]
mov cl, byte [eax]
inc eax
mov dword [esi], eax
movzx eax, cl
ret
Function at 0x30613230
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, eax
push edi
mov edi, dword [esi + 4]
cmp edi, 2
jae 0x306132a8
test edi, edi
je 0x30613249
mov eax, dword [esi]
mov ecx, dword [esi + 0x44]
mov dl, byte [eax]
mov byte [ecx], dl
call dword [sym.imp.MSVCR90.dll__errno]
mov dword [eax], 0
mov eax, dword [esi + 0x40]
mov ecx, edi
push eax
mov eax, dword [esi + 0x44]
mov edx, 0x4000
sar edx, cl
add eax, edi
push edx
push 1
push eax
call dword [sym.imp.MSVCR90.dll_fread]
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x30613292
mov ecx, dword [esi + 0x40]
push ecx
call dword [sym.imp.MSVCR90.dll_ferror]
add esp, 4
test eax, eax
je 0x30613292
mov dword [esi + 0x38], 0xffffffff
add dword [esi + 4], edi
mov eax, dword [esi + 4]
mov edx, dword [esi + 0x44]
mov dword [esi], edx
cmp eax, 2
jae 0x306132a8
pop edi
mov dword [esi + 0x58], eax
pop esi
ret
mov eax, dword [esi]
cmp byte [eax], 0x1f
jne 0x3061337e
cmp byte [eax + 1], 0x8b
jne 0x3061337e
add dword [esi + 4], 0xfffffffe
add eax, 2
push ebx
mov dword [esi], eax
call fcn.306131c0
mov edi, eax
call fcn.306131c0
mov ebx, eax
cmp edi, 8
jne 0x30613373
test bl, 0xe0
jne 0x30613373
mov edi, 6
lea esp, [esp]
call fcn.306131c0
sub edi, 1
jne 0x306132f0
test bl, 4
je 0x30613321
call fcn.306131c0
mov edi, eax
call fcn.306131c0
shl eax, 8
add edi, eax
mov eax, edi
dec edi
test eax, eax
je 0x30613321
call fcn.306131c0
cmp eax, 0xffffffff
jne 0x30613310
test bl, 8
je 0x30613334
call fcn.306131c0
test eax, eax
je 0x30613334
cmp eax, 0xffffffff
jne 0x30613326
test bl, 0x10
je 0x3061334e
lea esp, [esp]
call fcn.306131c0
test eax, eax
je 0x3061334e
cmp eax, 0xffffffff
jne 0x30613340
test bl, 2
je 0x30613362
mov edi, 2
call fcn.306131c0
sub edi, 1
jne 0x30613358
mov ecx, dword [esi + 0x3c]
neg ecx
sbb ecx, ecx
pop ebx
and ecx, 0xfffffffd
pop edi
mov dword [esi + 0x38], ecx
pop esi
ret
pop ebx
pop edi
mov dword [esi + 0x38], 0xfffffffd
pop esi
ret
pop edi
mov dword [esi + 0x58], 1
pop esi
ret
Function at 0x30613490
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x3061353c
cmp byte [esi + 0x5c], 0x77
jne 0x3061353c
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
mov dword [esi], eax
mov dword [esi + 4], ebx
test ebx, ebx
je 0x3061351f
push edi
mov edi, dword [sym.imp.MSVCR90.dll_fwrite]
cmp dword [esi + 0x10], 0
jne 0x306134e7
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 0x48]
push ecx
push 0x4000
push 1
push eax
mov dword [esi + 0xc], eax
call edi
add esp, 0x10
cmp eax, 0x4000
jne 0x30613517
mov dword [esi + 0x10], eax
mov edx, dword [esi + 4]
mov eax, dword [esi + 0x10]
add dword [esi + 0x64], edx
add dword [esi + 0x68], eax
push 0
push esi
call sym.zlib1.dll_deflate
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0x10]
sub dword [esi + 0x64], ecx
sub dword [esi + 0x68], edx
add esp, 8
mov dword [esi + 0x38], eax
test eax, eax
jne 0x3061351e
test ecx, ecx
jne 0x306134c0
jmp 0x3061351e
mov dword [esi + 0x38], 0xffffffff
pop edi
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x4c]
push ebx
push eax
push ecx
call sym.zlib1.dll_crc32
add esp, 0xc
mov dword [esi + 0x4c], eax
mov eax, ebx
sub eax, dword [esi + 4]
pop ebx
pop esi
ret
mov eax, 0xfffffffe
pop esi
ret

Function at 0x30613650
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov esi, eax
xor ebx, ebx
test esi, esi
je 0x30613705
cmp byte [esi + 0x5c], 0x77
jne 0x30613705
mov dword [esi + 4], ebx
push edi
lea esp, [esp]
mov edi, 0x4000
sub edi, dword [esi + 0x10]
je 0x3061369f
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x48]
push eax
push edi
push 1
push ecx
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
cmp eax, edi
jne 0x306136fb
mov edx, dword [esi + 0x48]
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], 0x4000
test ebx, ebx
jne 0x306136eb
mov ecx, dword [esp + 0x10]
mov eax, dword [esi + 0x10]
add dword [esi + 0x68], eax
push ecx
push esi
call sym.zlib1.dll_deflate
mov ecx, dword [esi + 0x10]
sub dword [esi + 0x68], ecx
add esp, 8
mov dword [esi + 0x38], eax
test edi, edi
jne 0x306136cc
cmp eax, 0xfffffffb
jne 0x306136cc
mov dword [esi + 0x38], edi
test ecx, ecx
jne 0x306136da
cmp dword [esi + 0x38], 1
je 0x306136da
xor ebx, ebx
jmp 0x306136df
mov ebx, 1
mov eax, dword [esi + 0x38]
test eax, eax
je 0x30613670
cmp eax, 1
je 0x30613670
mov esi, dword [esi + 0x38]
mov eax, esi
dec eax
neg eax
sbb eax, eax
pop edi
and eax, esi
pop esi
pop ebx
ret
or eax, 0xffffffff
pop edi
mov dword [esi + 0x38], eax
pop esi
pop ebx
ret
pop esi
mov eax, 0xfffffffe
pop ebx
ret
Function at 0x30619ae8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x30620044]
jne 0x30619af2
repz ret
jmp fcn.30619ed9

Function at 0x1001784a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x10017859
pop dword [ebp - 0x24]
mov eax, 0x1c802051
sub eax, 0xc7ea7f8
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x6aa162c5
add dword [ebp - 0x34], 0xe3b0e286
mov dword [ebp - 0x30], 0x6d7c2375
add dword [ebp - 0x30], 0xc4b728d0
mov dword [ebp - 0x2c], 0xb279a08
add dword [ebp - 0x2c], 0x4124aa26
mov dword [ebp - 0x28], 0x41e11096
sub dword [ebp - 0x28], 0x41e11096
lea eax, [ebp - 0x34]
push eax
mov eax, 0x29d7f76e
sub eax, 0x19d65766
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xca5f08af
add dword [ebp - 0x34], 0xaa1360a7
mov dword [ebp - 0x30], 0xc6441e5b
sub dword [ebp - 0x30], 0x84d7bce6
mov dword [ebp - 0x2c], 0xc735719
sub dword [ebp - 0x2c], 0xa903eaad
mov dword [ebp - 0x28], 0x352a490b
sub dword [ebp - 0x28], 0x352a490b
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0xf1e4d9ef
add eax, 0x1e1cc61d
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3be3e
push 0
call eax
mov ecx, 0x48bfb68a
add ecx, 0xb74097e4
mov edi, eax
mov ebx, 0xd77afff4
add ebx, 0x38874a0c
add ebx, dword [ebp - 0x24]
mov esi, 0xe73c2b9f
mov dword [ebp - 0x20], 0x68d3ac84
mov edx, dword [ebx]
xor dword [ebp - 0x10], 0x70a42f47
xor edx, esi
mov dword [edi], edx
xor dword [ebp - 0xc], edi
add edi, 0xf57d8287
sub edi, 0xf57d8283
add ebx, 0x783e314d
sub ebx, 0x783e3149
loop 0x10017975
add eax, 0x12c8b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x839bb250
add ecx, 0x8c644db0
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x401014
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x402490
sub esp, 0x18
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
push str.CryptStringToBinaryA
push eax
mov word [esp + 0x18], 0x43
mov word [esp + 0x1a], 0x72
mov word [esp + 0x1c], 0x59
mov word [esp + 0x1e], 0x70
mov word [esp + 0x20], 0x54
mov word [esp + 0x22], 0x33
mov word [esp + 0x24], 0x32
mov word [esp + 0x26], 0x2e
mov word [esp + 0x28], 0x44
mov word [esp + 0x2a], 0x6c
mov word [esp + 0x2c], 0x4c
mov word [esp + 0x2e], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call fcn.0040105a
mov esi, dword [esp + 0x38]
mov ebx, dword [esp + 0x40]
mov ebp, dword [esp + 0x3c]
add esp, 8
mov edi, eax
push 0
push 0
push esi
push 0
push 1
push ebx
push ebp
call edi
test eax, eax
jne 0x40252d
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x18
ret
mov ecx, dword [esi]
inc ecx
push ecx
call fcn.0040ce9c
mov edx, dword [esp + 0x30]
add esp, 4
push 0
push 0
push esi
push eax
push 1
push ebx
push ebp
mov dword [edx], eax
call edi
pop edi
pop esi
test eax, eax
pop ebp
pop ebx
setne al
add esp, 0x18
ret
Function at 0x40105a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x4022e0
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
xor ebx, ebx
mov eax, dword [edi + 0x3c]
mov ebp, dword [eax + edi + 0x78]
lea esi, [eax + edi + 0x78]
add ebp, edi
mov dword [esp + 0x1c], esi
mov edx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x24]
mov ecx, dword [ebp + 0x20]
add edx, edi
add eax, edi
add ecx, edi
test dword [esp + 0x28], 0xffff0000
mov dword [esp + 0x18], edx
jne 0x402345
mov eax, dword [esp + 0x28]
mov ecx, dword [ebp + 0x10]
and eax, 0xffff
cmp eax, ecx
jb 0x4023de
mov ebx, dword [ebp + 0x14]
add ebx, ecx
cmp eax, ebx
ja 0x4023de
sub eax, ecx
mov ebx, dword [edx + eax*4]
add ebx, edi
jmp 0x4023c2
mov edx, dword [ebp + 0x18]
test edx, edx
jbe 0x4023c2
mov dword [esp + 0x24], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov eax, dword [ecx]
mov esi, dword [esp + 0x28]
add eax, edi
mov dl, byte [esi]
mov cl, dl
cmp dl, byte [eax]
jne 0x402384
test cl, cl
je 0x402380
mov dl, byte [esi + 1]
mov cl, dl
cmp dl, byte [eax + 1]
jne 0x402384
add esi, 2
add eax, 2
test cl, cl
jne 0x402360
xor eax, eax
jmp 0x402389
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40239d
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
mov ax, word [ecx]
mov ebx, dword [edx + eax*4]
add ebx, edi
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
add ecx, 4
add edx, 2
dec eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x14], eax
jne 0x402358
mov esi, dword [esp + 0x1c]
cmp ebx, ebp
jb 0x402425
mov eax, dword [esi + 4]
add eax, ebp
cmp ebx, eax
jae 0x402425
push ebx
call fcn.00417539
mov esi, eax
add esp, 4
test esi, esi
jne 0x4023e8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
push 0x2e
push esi
xor ebx, ebx
call fcn.0040cde0
add esp, 8
mov edi, eax
mov byte [edi], bl
push esi
inc edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x402410
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x40241c
push edi
push eax
call fcn.0040105a
add esp, 8
mov ebx, eax
push esi
call fcn.0040cc89
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x407daf
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ax, word [esi + 2]
and ax, 0xff00
cmp ax, 0x100
jne 0x407e5e
movzx eax, word [esi + 8]
mov edi, dword [ebp + 0x14]
xor ebx, ebx
mov ecx, edi
push ebx
imul ecx, eax
add ecx, dword [ebp + 0x10]
mov eax, dword [esi + 0x84]
push ebx
push dword [eax + ecx*4]
push dword [esi + 0x6c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp + 8]
push ebx
push eax
movzx eax, word [esi + 8]
imul edi, eax
add edi, dword [ebp + 0x10]
mov eax, dword [esi + 0x88]
push dword [eax + edi*4]
push dword [esi + 0x70]
push dword [esi + 0x6c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, dword [esi + 0x70]
mov edi, dword [ebp + 0xc]
mov al, byte [esi]
inc esi
mov cl, al
mov dword [ebp + 0x10], edi
and ecx, 0x7f
je 0x407e99
test al, 0x80
je 0x407e37
lea eax, [ecx]
mov cl, byte [esi]
mov byte [edi], cl
inc edi
inc esi
dec eax
jne 0x407e2c
jmp 0x407e19
mov al, byte [esi]
mov dword [ebp + 0x14], ecx
mov bl, al
mov edx, ecx
mov bh, bl
inc esi
mov eax, ebx
shl eax, 0x10
mov ax, bx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [ebp + 0x10]
add edi, edx
jmp 0x407e19
movzx eax, word [esi + 8]
imul eax, dword [ebp + 0x14]
movzx ecx, word [esi + 6]
add eax, dword [ebp + 0x10]
xor ebx, ebx
push ebx
push ebx
imul eax, ecx
add eax, 0x200
push eax
push dword [esi + 0x6c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp + 8]
push ebx
push eax
movzx eax, word [esi + 6]
push eax
push dword [ebp + 0xc]
push dword [esi + 0x6c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x409118
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
lea eax, [ebp - 4]
push edi
xor esi, esi
and dword [ebp - 4], esi
push eax
push 1
push esi
push str.Control_PanelColors
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4091ba
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x4091b7
mov esi, dword [ebp + 8]
mov edi, 0x422430
sub edi, esi
mov dword [ebp + 0xc], eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x40
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [edi + esi]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4091af
cmp dword [ebp - 0xc], 1
jne 0x4091af
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x54]
push 0x41e360
push eax
call fcn.0040d8db
movzx ecx, byte [ebp - 0x14]
xor eax, eax
add esp, 0x14
mov ah, byte [ebp + 8]
mov al, byte [ebp - 0x10]
shl eax, 8
or eax, ecx
mov dword [esi], eax
add esi, 4
dec dword [ebp + 0xc]
jne 0x409154
push 1
pop esi
cmp dword [ebp - 4], 0
je 0x4091c9
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
leave
ret 8

Function at 0x4114f5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x423bb8
cmp edx, dword [eax]
je 0x411517
add eax, 8
inc ecx
cmp eax, str.__t__r_
jl 0x411508
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x423bb8]
jne 0x411645
mov eax, dword [0x4251a8]
cmp eax, 1
je 0x41161f
test eax, eax
jne 0x411548
cmp dword [0x423634], 1
je 0x41161f
cmp edx, 0xfc
je 0x411645
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41157f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00413610
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0040e2c0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4115c2
lea eax, [ebp - 0x1a4]
push eax
call fcn.0040e2c0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x41ea64
push edi
call fcn.004151b0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00413610
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00413620
lea eax, [ebp - 0xa0]
push 0x41ea44
push eax
call fcn.00413620
push dword [esi + 0x423bbc]
lea eax, [ebp - 0xa0]
push eax
call fcn.00413620
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00415121
add esp, 0x2c
pop edi
jmp 0x411645
lea eax, [ebp + 8]
lea esi, [esi + 0x423bbc]
push 0
push eax
push dword [esi]
call fcn.0040e2c0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4010f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, 0x97
push edi
mov edi, 0x1ec7
mov esi, 0x5d2c
lea ecx, [eax - 0x49]
mov edx, 0x656d
mov ebx, 0xeb
cmp eax, 0xeb
cmovl eax, ebx
dec edx
jne 0x401112
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x401189
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x401189
cmp ebx, eax
jae 0x401189
sub eax, ebx
je 0x401150
mov ecx, eax
mov al, byte [edx + ebx + 1]
add al, 0x5f
xor byte [edx + ebx], al
inc edx
cmp edx, ecx
jb 0x401135
mov ecx, 0x4e
jmp 0x401150
mov eax, 0x88888889
imul edi
add edx, edi
sar edx, 5
mov edi, edx
shr edi, 0x1f
add edi, edx
jne 0x401150
mov eax, 0x66666667
imul esi
sar edx, 1
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x401165
mov eax, 0x8de
mov edx, 0x66
cmp ecx, edx
cmovg ecx, edx
dec eax
jne 0x401181
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x402f70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov ecx, 0x59d9
jmp 0x402f80
mov eax, 0xaf3addc7
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x402f80
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0x10], eax
jbe 0x4030bd
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
lea esp, [esp]
add eax, dword [ebp + 0xc]
mov ebx, 0xe3
mov dword [ebp - 0x1c], eax
mov al, byte [eax]
inc byte [edx + 0x10c]
mov byte [ebp - 1], al
movzx eax, byte [edx + 0x10c]
add eax, 0xc
add eax, edx
mov dword [ebp - 8], eax
movzx ecx, byte [eax]
movzx eax, byte [edx + 0xa]
add eax, ecx
mov dword [ebp - 0x10], 0x7806
mov ecx, dword [ebp - 0x10]
mov edi, 0x30
mov dword [ebp - 0x18], 0x79e6
lea esi, [ebx - 0x56]
mov dword [ebp - 0x14], eax
mov byte [edx + 0xa], al
lea ecx, [ecx]
mov eax, 0x9c09c09d
imul ecx
add edx, ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x403000
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
movzx eax, al
add ecx, 0xc
add eax, ecx
push eax
push dword [ebp - 8]
mov dword [ebp - 0x14], eax
call fcn.00403470
add esp, 8
mov eax, 0x5695
mov ecx, 0x8a
lea esp, [esp]
cmp ebx, ecx
cmovg ebx, ecx
dec eax
jne 0x403040
mov eax, 0x157f
mov ecx, 0xb3
cmp edi, ecx
cmovg edi, ecx
dec eax
jne 0x403052
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx]
mov eax, 0xa0a0a0a1
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x403060
mov eax, dword [ebp - 0x14]
mov edx, 0x71
mov cl, byte [eax]
mov eax, dword [ebp - 8]
add cl, byte [eax]
mov eax, 0x2ef6
lea esp, [esp]
cmp esi, edx
cmovl esi, edx
dec eax
jne 0x403090
mov edx, dword [ebp + 8]
movzx eax, cl
mov ecx, dword [ebp - 0x1c]
mov al, byte [eax + edx + 0xc]
xor al, byte [ebp - 1]
mov byte [ecx], al
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp eax, dword [ebp + 0x10]
jb 0x402fb0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6f86a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1e3000]
push edi
or ebp, 0xffffffff
jmp 0x6f86c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6f86c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6f86b8
mov eax, 1
add ebx, ebx
jne 0x6f86db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x6f86ec
jne 0x6f870b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6f870b
dec eax
add ebx, ebx
jne 0x6f86f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x6f86d0
add ebx, ebx
jne 0x6f8707
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x6f875d
xor ecx, ecx
sub eax, 3
jb 0x6f8723
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x6f8792
sar eax, 1
mov ebp, eax
jmp 0x6f872e
add ebx, ebx
jne 0x6f872e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6f86fc
inc ecx
add ebx, ebx
jne 0x6f873c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6f86fc
add ebx, ebx
jne 0x6f8749
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x6f873e
jne 0x6f875a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x6f873e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x6f877c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x6f876e
jmp 0x6f86be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x6f877c
add edi, ecx
jmp 0x6f86be
pop esi
mov edi, esi
mov ecx, 0x37e4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x6f879a
cmp byte [edi], 0x13
jne 0x6f879a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x6f879f
lea edi, [esi + 0x2f5000]
mov eax, dword [edi]
or eax, eax
je 0x6f8817
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2fedf4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2feeb8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6f87cc
mov ecx, edi
jns 0x6f87fb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2feec0]
or eax, eax
je 0x6f8811
mov dword [ebx], eax
add ebx, 4
jmp 0x6f87e9
call dword [esi + 0x2feebc]
mov ebp, dword [esi + 0x2feec4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x6f884b
sub esp, 0xffffff80
jmp 0x46f1ee