joyce8/EMBER2024-capa huggingface dataset:
Function at 0x450bb4
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd9c
push ebx
xor edx, edx
mov dword [ebp - 0x264], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x450d84
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x450d65
mov dl, 1
mov eax, dword [0x415c20]
call fcn.00403700
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004044bc
lea eax, [ebp - 0x118]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
mov ebx, eax
call sub.kernel32.dll_GetSystemDefaultLangID
movzx eax, ax
mov dword [ebp - 0x10], eax
dec ebx
test ebx, ebx
jl 0x450d54
inc ebx
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x118]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
call fcn.0043ea34
test al, al
jne 0x450c51
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x450d47
xor edx, edx
push ebp
push 0x450d40
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x450c71
mov ebx, dword [ebp - 0x10]
jmp 0x450c73
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov dword [ebp - 0x260], ebx
mov byte [ebp - 0x25c], 0
lea ecx, [ebp - 0x260]
mov edx, 0x450d94
lea eax, [ebp - 0x258]
call fcn.00409538
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x450d29
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x450dcc
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x450d29
lea eax, [ebp - 0x264]
lea edx, [ebp - 0x218]
mov ecx, pe_nt_image_headers32
call fcn.0040472c
mov edx, dword [ebp - 0x264]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x450d29
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x218]
mov ecx, pe_nt_image_headers32
call fcn.0040472c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450d47
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x18], 4
dec dword [ebp - 0x14]
jne 0x450c32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.004197c4
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450d8b
lea eax, [ebp - 0x264]
call fcn.004044bc
ret
Function at 0x4516cc
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x483b48]
cmp byte [eax + 0xa5], 0
jne 0x45173d
cmp dword [0x483b60], 0
jne 0x4516fe
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x451688
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x483b60], eax
cmp dword [0x483b5c], 0
jne 0x451719
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x483b5c], eax
cmp dword [0x483b64], 0
jne 0x45173d
push esp
push 0
push 0
push 0x45162c
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x483b64], eax
pop edx
ret

Function at 0x451dd0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x483b48]
cmp dword [eax + 0x30], 0
je 0x451e7a
cmp dword [ebx + 0x94], 0
jne 0x451e74
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x451d60
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x451e74
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x451e3a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x451e74
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00417b80
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x451e49
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4529d8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x452a0d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004045ac
jmp 0x452a1a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404510
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x453bcc
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x453c0d
mov eax, esi
call fcn.0043a0a4
test al, al
je 0x453c0d
mov eax, dword [ebx + 0x84]
call fcn.00439dcc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x453c0d
push 0
mov eax, dword [ebx + 0x84]
call fcn.00439dcc
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x4549d8
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x414e00]
call fcn.00404e2c
xor eax, eax
push ebp
push 0x454b1c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x47fcf4], 0
jne 0x454a2b
mov ecx, dword [0x482a04]
mov dl, 1
mov eax, dword [0x4077ac]
call fcn.0040bf9c
call fcn.00403ed0
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.0040311c
mov eax, ebx
call fcn.00404cf8
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x454b2c
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00405e6c
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404d08
test eax, eax
jle 0x454ac3
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x454abc
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404744
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.0040472c
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408644
test eax, eax
jne 0x454abc
mov ebx, 0x15
jmp 0x454ac8
mov ebx, 0x10
jmp 0x454ac8
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x47fcf4]
call fcn.00454850
mov eax, dword [ebp - 8]
call fcn.00454850
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00405e84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x454b23
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004044e0
lea eax, [ebp - 0x10]
mov edx, dword [0x414e00]
call fcn.00404efc
ret

Function at 0x45fd34
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x45fd62
mov eax, ebx
call fcn.004607e8
cmp dword [ebx + 0x40], 0
je 0x45fd5b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x45fdd3
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x45fdc5
cmp dword [ebx + 8], 0
je 0x45fd84
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x45fd96
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x45fdc5
cmp dword [ebx + 8], 0
je 0x45fd77
cmp eax, 3
je 0x45fda9
dec eax
jne 0x45fd77
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x45fd77
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x45fd77
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x45fdf1
cmp dword [ebx + 0x14], 0xcc
je 0x45fdf1
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0045fdfc
pop ebx
ret
Function at 0x4777ec
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x483c60
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x47780e
shr eax, 1
xor eax, 0xedb88320
jmp 0x477810
shr eax, 1
dec edx
jne 0x4777fc
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4777f5
mov byte [0x484060], 1
pop esi
pop ebx
ret

Function at 0x47782c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x484060], 0
jne 0x477843
call fcn.004777ec
mov eax, edi
dec eax
test eax, eax
jl 0x47786c
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x483c60]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x47784d
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x479e8c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x479ebd
dec al
je 0x479ef9
dec al
je 0x479f3d
dec al
je 0x479fa8
jmp 0x47a032
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x47a032
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x479ecd
jmp 0x47a032
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x47a032
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x479f09
jmp 0x47a032
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x47a032
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x479f6b
xor ebp, ebp
jmp 0x479f7c
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x479f85
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x479f4d
jmp 0x47a032
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x47a032
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x47a000
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00477874
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x479fbc
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x47da30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x140], ecx
mov dword [ebp - 0x148], ecx
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x130], ecx
mov dword [ebp - 0x13c], ecx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x138], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.0040496c
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x47db98
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.0047066c
mov esi, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, esi
call fcn.0047068c
mov ebx, eax
jmp 0x47db6a
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.0040472c
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.00408d88
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00408470
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00408470
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.004048c8
je 0x47db4a
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.0040472c
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00408470
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00408470
mov edx, dword [ebp - 0x148]
pop eax
call fcn.004048c8
jne 0x47db5f
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, edi
mov eax, esi
call fcn.004706ac
mov ebx, eax
test ebx, ebx
jne 0x47daab
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47db9f
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.004044e0
lea eax, [ebp - 4]
call fcn.004044bc
ret
Function at 0x10012bf8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x10012c07
pop dword [ebp - 0x20]
mov eax, 0x91d776aa
add eax, 0x7e29b55d
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x62a3263a
add dword [ebp - 0x30], 0xebaf1f11
mov dword [ebp - 0x2c], 0x3e218323
add dword [ebp - 0x2c], 0xf411c922
mov dword [ebp - 0x28], 0x65463c14
add dword [ebp - 0x28], 0xe706081a
mov dword [ebp - 0x24], 0xa8a43ac4
sub dword [ebp - 0x24], 0xa8a43ac4
lea eax, [ebp - 0x30]
push eax
mov eax, 0xf93f5f2a
sub eax, 0xe93d5f26
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x44021d23
add dword [ebp - 0x30], 0x30704c33
mov dword [ebp - 0x2c], 0xd9f04f18
add dword [ebp - 0x2c], 0x677c125d
mov dword [ebp - 0x28], 0x31f4f325
add dword [ebp - 0x28], 0x317a7947
mov dword [ebp - 0x24], 0x4fe8e17b
add dword [ebp - 0x24], 0xb0171e85
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x8d31802b
sub eax, 0x7d2f802b
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3c6da
push 0
call eax
mov ecx, 0x467a
mov edx, eax
mov ebx, 0x1002bc00
add ebx, dword [ebp - 0x20]
mov edi, 0x4d87b3ed
add dword [ebp - 0xc], esi
mov esi, dword [ebx]
xor dword [ebp - 0xc], edi
xor esi, edi
sub dword [ebp - 0x18], 0x7bef2424
mov dword [edx], esi
add dword [ebp - 4], ecx
add edx, 4
add ebx, 4
loop 0x10012d17
add eax, 0x37d8c6bb
sub eax, 0x37d7ba00
mov ebx, eax
add eax, 5
mov ecx, 0xb82f6481
sub ecx, 0xa82f6481
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x64a5b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x95000]
push edi
jmp 0x64a5ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x64a5d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x64a5c0
mov eax, 1
add ebx, ebx
jne 0x64a5e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x64a5f4
jne 0x64a613
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x64a613
dec eax
add ebx, ebx
jne 0x64a600
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x64a5d8
add ebx, ebx
jne 0x64a60f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x64a665
xor ecx, ecx
sub eax, 3
jb 0x64a62b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x64a69a
sar eax, 1
mov ebp, eax
jmp 0x64a636
add ebx, ebx
jne 0x64a636
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x64a604
inc ecx
add ebx, ebx
jne 0x64a644
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x64a604
add ebx, ebx
jne 0x64a651
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x64a646
jne 0x64a662
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x64a646
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x64a684
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x64a676
jmp 0x64a5c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x64a684
add edi, ecx
jmp 0x64a5c6
pop esi
mov edi, esi
mov ecx, 0x4a63
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x64a6a2
cmp byte [edi], 0x11
jne 0x64a6a2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x64a6a7
lea edi, [esi + 0x247000]
mov eax, dword [edi]
or eax, eax
je 0x64a71f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x265338]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x265464]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x64a6d4
mov ecx, edi
jns 0x64a703
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x265468]
or eax, eax
je 0x64a719
mov dword [ebx], eax
add ebx, 4
jmp 0x64a6f1
call dword [esi + 0x265478]
mov ebp, dword [esi + 0x26546c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x64a753
sub esp, 0xffffff80
jmp 0x47b236
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x1eb079a
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x7f457d1d
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4047a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x426858
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push 0
mov eax, dword [esi]
call dword [eax + 4]
mov ebp, dword [esp + 0x2c]
test ebp, ebp
jne 0x4047d5
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebp, eax
mov ecx, dword [esp + 0x28]
push 6
mov eax, ecx
and ecx, 0xf
shr eax, 4
inc eax
mov dword [esp + 0x30], ecx
and eax, 0xffff
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
jne 0x40480f
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 8
push edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
shr edi, 1
mov dword [esp + 0x10], 0x428260
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edi
mov ecx, dword [esp + 0x30]
xor edx, edx
test ecx, ecx
mov dword [esp + 0x24], 0
jle 0x40486d
mov ebx, ecx
mov ecx, edx
inc edx
test ecx, ecx
jl 0x404860
cmp ecx, edi
jge 0x404860
mov cx, word [eax + ecx*2]
jmp 0x404862
xor ecx, ecx
and ecx, 0xffff
add edx, ecx
dec ebx
jne 0x40484f
mov ecx, edx
inc edx
test ecx, ecx
jl 0x40487e
cmp ecx, edi
jge 0x40487e
mov cx, word [eax + ecx*2]
jmp 0x404880
xor ecx, ecx
and ecx, 0xffff
mov ebp, dword [esi]
push 0
push 0
mov edi, ecx
push 0
lea ebx, [eax + edx*2]
push 0
push edi
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push eax
mov ecx, esi
call dword [ebp + 4]
mov ebp, dword [esi + 8]
mov edx, dword [esi]
push ebp
mov ecx, esi
call dword [edx + 4]
mov eax, dword [esi + 4]
mov edx, dword [esi]
push 0
inc ebp
push 0
push ebp
push eax
push edi
push ebx
push 0
push 0
mov dword [esp + 0x50], edx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push eax
mov eax, dword [esp + 0x34]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 8
Function at 0x4050b0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0xc
cmp eax, 1
push ebp
mov ebp, ecx
jge 0x4050e4
lea eax, [esp + 0x18]
lea ecx, [esp + 4]
push eax
mov dword [esp + 0x1c], str.Key_Length_should_be_at_least_1
call fcn.0040d8b1
lea ecx, [esp + 4]
push 0x42c888
push ecx
call fcn.0040d9a0
push ebx
push esi
xor ecx, ecx
push edi
xor eax, eax
lea ebx, [ebp + 1]
mov byte [ebx + eax], al
inc eax
cmp eax, 0x100
jl 0x4050ee
mov esi, dword [esp + 0x20]
or edi, 0xffffffff
mov byte [ebp + 0x201], cl
mov byte [ebp + 0x202], cl
mov ecx, ebx
sub edi, ebp
xor edx, edx
mov dword [ebp + 0x204], ecx
mov dl, byte [ebp + 0x201]
mov al, byte [edx + esi]
mov dl, byte [ecx]
add al, dl
mov dl, byte [ebp + 0x202]
add dl, al
mov al, dl
mov byte [ebp + 0x202], dl
and eax, 0xff
lea edx, [eax + ebp + 1]
mov dword [ebp + 0x208], edx
mov al, byte [ecx]
mov byte [ebp + 0x20c], al
mov al, byte [edx]
mov byte [ecx], al
mov edx, dword [ebp + 0x208]
mov al, byte [ebp + 0x20c]
mov byte [edx], al
xor eax, eax
mov al, byte [ebp + 0x201]
inc eax
cdq
idiv dword [esp + 0x24]
inc ecx
mov byte [ebp + 0x201], dl
lea edx, [edi + ecx]
cmp edx, 0x100
jl 0x405110
lea edi, [ebp + 0x101]
mov ecx, 0x40
mov esi, ebx
xor al, al
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov byte [ebp + 0x201], al
mov byte [ebp + 0x202], al
mov byte [ebp], 1
pop ebx
pop ebp
add esp, 0xc
ret 8

Function at 0x4054d0
Capabilities:
Hash data using sha256

Disassembly:
mov edx, 0x4283a0
push esi
push edi
mov eax, ecx
sub edx, ecx
mov esi, 8
mov edi, dword [edx + eax]
mov dword [eax], edi
add eax, 4
dec esi
jne 0x4054e0
xor eax, eax
pop edi
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], eax
mov byte [ecx + 0x68], al
pop esi
ret