joyce8/EMBER2024-capa huggingface dataset:
Function at 0x62c4c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1fd000]
push edi
or ebp, 0xffffffff
jmp 0x62c4e2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x62c4e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x62c4d8
mov eax, 1
add ebx, ebx
jne 0x62c4fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x62c50c
jne 0x62c51c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x62c51c
dec eax
add ebx, ebx
jne 0x62c518
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x62c4f0
xor ecx, ecx
sub eax, 3
jb 0x62c534
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x62c5a6
sar eax, 1
mov ebp, eax
jmp 0x62c53f
add ebx, ebx
jne 0x62c53f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x62c54c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x62c570
inc ecx
add ebx, ebx
jne 0x62c55c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x62c551
jne 0x62c56d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x62c551
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x62c590
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x62c581
jmp 0x62c4de
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x62c590
add edi, ecx
jmp 0x62c4de
pop esi
mov edi, esi
mov ecx, 0x351c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x62c5ae
cmp byte [edi], 0x16
jne 0x62c5ae
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x62c5b3
lea edi, [esi + 0x229000]
mov eax, dword [edi]
or eax, eax
je 0x62c622
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x22cf44]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x22cff8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x62c5e0
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x22cffc]
or eax, eax
je 0x62c61c
mov dword [ebx], eax
add ebx, 4
jmp 0x62c5fd
call dword [esi + 0x22d000]
popal
jmp 0x46a2e4
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x4058bd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x4058cc
pop dword [ebp - 0x28]
mov eax, 0x4900d7a4
add eax, 0xb73f8128
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x683bb34f
add dword [ebp - 0x38], 0xe61691fc
mov dword [ebp - 0x34], 0x5ada98c0
sub dword [ebp - 0x34], 0x28a74c7b
mov dword [ebp - 0x30], 0x43370b7b
add dword [ebp - 0x30], 0x91538b3
mov dword [ebp - 0x2c], 0xa6276ebe
add dword [ebp - 0x2c], 0x59d89142
lea eax, [ebp - 0x38]
push eax
mov eax, 0x1510271b
add eax, 0xeb30a939
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xba5afcdb
add dword [ebp - 0x38], 0xba176c7b
mov dword [ebp - 0x34], 0x568b030c
add dword [ebp - 0x34], 0xeae15e69
mov dword [ebp - 0x30], 0xb7803277
sub dword [ebp - 0x30], 0x5410c60b
mov dword [ebp - 0x2c], 0xd86de71c
sub dword [ebp - 0x2c], 0xd86de71c
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x645f41e2
sub eax, 0x641e7196
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3c1a0
push 0
call eax
mov ecx, 0x5238
mov edi, eax
mov esi, 0x41b000
add esi, dword [ebp - 0x28]
mov ebx, 0x96e108ad
xor dword [ebp - 0x14], 0x30f53bfc
mov edx, dword [esi]
sub dword [ebp - 0x24], 0x27af8fb4
sub edx, ebx
xor dword [ebp - 8], esi
mov dword [edi], edx
sub dword [ebp - 8], ecx
add edi, 0x38ecaba
add edi, 0xfc71354a
add esi, 0x29e4c7a2
add esi, 0xd61b3862
loop 0x4059dc
add eax, 0x22f686ad
sub eax, 0x22f54afa
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x61ca688c
sub ecx, 0x618a688c
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x401a40
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8

Function at 0x417f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x14000]
push edi
jmp 0x417f9a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x417fa1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x417f90
mov eax, 1
add ebx, ebx
jne 0x417fb3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x417fa8
jne 0x417fc4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x417fa8
xor ecx, ecx
sub eax, 3
jb 0x417fd8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41804a
mov ebp, eax
add ebx, ebx
jne 0x417fe3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x417ff0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x418014
inc ecx
add ebx, ebx
jne 0x418000
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x417ff5
jne 0x418011
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x417ff5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x418034
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x418025
jmp 0x417f96
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x418034
add edi, ecx
jmp 0x417f96
pop esi
mov edi, esi
mov ecx, 0x315
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x418052
cmp byte [edi], 4
jne 0x418052
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x418057
lea edi, [esi + 0x15000]
mov eax, dword [edi]
or eax, eax
je 0x4180cf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x18000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x18078]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x418084
mov ecx, edi
jns 0x4180b3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1807c]
or eax, eax
je 0x4180c9
mov dword [ebx], eax
add ebx, 4
jmp 0x4180a1
call dword [esi + 0x1808c]
mov ebp, dword [esi + 0x18080]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x418103
sub esp, 0xffffff80
jmp section.UPX0

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x2a30dd20
Capabilities:
Terminate thread

Disassembly:
push 0xc
mov eax, 0x2a353dc6
call fcn.2a302657
mov ebx, ecx
xor ecx, ecx
cmp dword [ebx], 0xb
mov edi, ecx
mov dword [ebp - 0x14], edi
jne 0x2a30de11
push 0xea60
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
or dword [ebx + 0x1a0], 0xffffffff
push 1
push dword [ebx + 0x2d4]
call dword [sym.imp.kernel32.dll_SetThreadPriority]
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
call dword [sym.imp.kernel32.dll_GetTickCount]
shr eax, 4
lea esi, [eax + 0x12c]
call dword [sym.imp.kernel32.dll_GetTickCount]
shr eax, 4
cmp eax, esi
jae 0x2a30ddca
mov edi, esi
push 0xea60
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
push dword [ebx + 0x2d8]
mov esi, dword [ebx]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
cmp esi, 0xb
jne 0x2a30ddc7
push 0x64
call dword [sym.imp.kernel32.dll_Sleep]
call dword [sym.imp.kernel32.dll_GetTickCount]
shr eax, 4
cmp eax, edi
jb 0x2a30dd8e
mov edi, dword [ebp - 0x14]
push 0xea60
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp dword [ebx], 0xb
jne 0x2a30ddf1
push 1
push dword [ebx + 0x2d4]
call dword [sym.imp.kernel32.dll_TerminateThread]
xor edi, edi
inc edi
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_CloseHandle]
xor ecx, ecx
mov dword [ebx + 0x2d8], ecx
cmp dword [ebx + 0x18], 0
lea esi, [ebx + 0x1a0]
mov dword [esi], ecx
je 0x2a30de46
test di, di
jne 0x2a30de43
push esi
push dword [ebx + 0x18]
call fcn.2a322a52
xor ecx, ecx
cmp dword [esi], ecx
jne 0x2a30de46
push esi
push dword [ebx + 0x14]
mov dword [ebx + 0x18], ecx
call fcn.2a322a52
xor ecx, ecx
jmp 0x2a30de46
mov dword [ebx + 0x18], ecx
cmp word [ebx + 0x144], cx
je 0x2a30decd
push ecx
push ecx
lea ecx, [ebp - 0x18]
call fcn.2a322a52
mov edi, dword [0x2a36bb18]
xor eax, eax
push eax
mov dword [ebp - 4], eax
lea eax, [ebx + 0x40]
push eax
mov eax, dword [0x2a36bb0c]
push str.Cstring
mov esi, dword [eax + 0x14]
mov ecx, esi
call dword [0x2a35835c]
call esi
mov esi, dword [edi + 0xd0]
pop ecx
movzx eax, ax
mov ecx, esi
push eax
push 0
call dword [0x2a35835c]
call esi
add esp, 0x10
lea ecx, [ebp - 0x18]
push 0
push eax
call fcn.2a322a52
cmp dword [ebp - 0x14], 0
je 0x2a30debf
lea ecx, [ebp - 0x18]
call fcn.2a322a52
test al, al
je 0x2a30debf
lea ecx, [ebp - 0x18]
call fcn.2a33ed32
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.2a322a52
xor ecx, ecx
cmp dword [ebx + 0x34], 0
je 0x2a30def1
mov eax, dword [0x2a36b7ac]
push dword [ebx + 0x34]
mov esi, dword [eax + 0x284]
mov ecx, esi
call dword [0x2a35835c]
call esi
pop ecx
xor ecx, ecx
mov dword [ebx + 0x34], ecx
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x2a30df25
push eax
mov eax, dword [0x2a36bb38]
cmp word [ebx + 0x196], cx
je 0x2a30df0f
mov esi, dword [eax + 0x124]
jmp 0x2a30df15
mov esi, dword [eax + 0x11c]
mov ecx, esi
call dword [0x2a35835c]
call esi
xor eax, eax
pop ecx
mov dword [ebx + 0x20], eax
mov dword [ebx], 2
call fcn.2a302bc2
ret
Function at 0x2a322a52
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x2a322a61
pop dword [ebp - 0x2c]
mov eax, 0xa229754d
add eax, 0x8808b514
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x2fa0afe7
sub dword [ebp - 0x3c], 0xe14e6a9c
mov dword [ebp - 0x38], 0xf4edec52
sub dword [ebp - 0x38], 0xc2baa00d
mov dword [ebp - 0x34], 0x62cbebb4
sub dword [ebp - 0x34], 0x167fa786
mov dword [ebp - 0x30], 0xf6fe8789
add dword [ebp - 0x30], 0x9017877
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x686599aa
sub eax, 0x3e301926
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xc461a728
sub dword [ebp - 0x3c], 0x4fef3dd2
mov dword [ebp - 0x38], 0x43b029f3
add dword [ebp - 0x38], 0xfdbc3782
mov dword [ebp - 0x34], 0x6eb0f4ee
sub dword [ebp - 0x34], 0xb418882
mov dword [ebp - 0x30], 0xe55f5eb
sub dword [ebp - 0x30], 0xe55f5eb
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x4a7e3e21
add eax, 0xdfb7426b
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x4c665
push 0
call eax
mov ecx, 0x4fc5
mov edx, eax
mov esi, 0xdf36a94f
add esi, 0x4b014cb1
add esi, dword [ebp - 0x2c]
mov ebx, 0x554e091d
sub ebx, 0xd9e08865
sub dword [ebp - 4], eax
mov edi, dword [esi]
xor dword [ebp - 4], 0x89dabf9a
sub edi, ebx
sub dword [ebp - 0x18], edi
mov dword [edx], edi
xor dword [ebp - 0x1c], ebx
add edx, 0xf155c2a0
add edx, 0xeaa3d64
add esi, 0x8f424020
sub esi, 0x8f42401c
loop 0x2a322b7d
add eax, 0x60b6fa83
add eax, 0x9f4a3764
mov ebx, eax
add eax, 5
mov ecx, 0x91a7ecbd
add ecx, 0x98881343
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x2a32caab
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x2a35572a
call fcn.2a304215
mov edx, dword [ebp + 0xc]
xor ebx, ebx
mov eax, dword [ebp + 8]
mov esi, ebx
mov dword [ebp - 0x42c], edx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test eax, eax
je 0x2a32cccc
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc eax
push 2
push eax
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x420]
push eax
call fcn.2a322a52
add esp, 0x10
test eax, eax
js 0x2a32ccc6
mov edi, dword [ebp - 0x420]
cmp edi, 0x400
jg 0x2a32cb4f
push edi
call fcn.2a32df9a
pop ecx
test al, al
je 0x2a32cb4f
mov eax, edi
call fcn.2a352aa0
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x2a32cb61
push edi
lea ecx, [ebp - 0x424]
call fcn.2a322a52
mov esi, dword [ebp - 0x424]
push 3
push edi
push dword [ebp - 0x41c]
push eax
call fcn.2a322a52
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x2a32ccc6
push 0x60
push ebx
push eax
call fcn.2a32e256
mov edi, eax
mov dword [ebp - 0x420], edi
test edi, edi
jne 0x2a32cbb9
push 2
push ebx
push dword [ebp - 0x41c]
call fcn.2a32e256
mov edi, eax
mov dword [ebp - 0x420], eax
test edi, edi
jne 0x2a32cbb9
call fcn.2a32b317
mov ebx, eax
jmp 0x2a32cc95
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov dword [ebp - 0x42c], eax
test eax, eax
jne 0x2a32cbe0
call fcn.2a32b317
jmp 0x2a32cc88
push eax
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x2a32cbd6
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x41c], eax
lea ecx, [eax + 1]
cmp ecx, eax
jae 0x2a32cc13
mov ebx, 0x8007000e
jmp 0x2a32cc8a
push ecx
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.2a322a52
jmp 0x2a32cc39
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x2a32cc0c
mov eax, dword [ebp - 0x41c]
push eax
push dword [ebp - 0x428]
push eax
push dword [ebp - 0x418]
call fcn.2a322a52
mov eax, dword [ebp - 0x418]
add esp, 0x10
mov ecx, dword [ebp - 0x41c]
push dword [ebp + 0x14]
mov byte [eax + ecx], bl
lea ecx, [ebp - 0x434]
push dword [ebp - 0x418]
call fcn.2a322a52
mov ebx, eax
test edi, edi
je 0x2a32cc95
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x2a32ccae
lea ecx, [ebp - 0x418]
call fcn.2a32b98d
or dword [ebp - 4], 0xffffffff
jmp 0x2a32ccbe
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x2a32ccb4
mov eax, ebx
jmp 0x2a32ccfa
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x2a32cce1
lea ecx, [ebp - 0x418]
call fcn.2a32b98d
or dword [ebp - 4], 0xffffffff
jmp 0x2a32ccf1
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x2a32cce7
mov eax, 0x8007000e
lea esp, [ebp - 0x444]
call fcn.2a30424f
ret 0x10
Function at 0x1000b6d5
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
mov eax, dword [0x1001ff00]
xor eax, esp
mov dword [esp + 0x104], eax
push ebp
push esi
push edi
mov edi, dword [esp + 0x118]
lea eax, [esp + 0xc]
mov ebp, 0x104
xor esi, esi
push ebp
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1000b738
lea eax, [esp + 0xc]
push 0x10017e60
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
lea eax, [esp + 0x14]
push edi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
add esp, 0x10
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x1000b772
push ebp
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1000b772
lea eax, [esp + 0xc]
push 0x10017e60
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
lea eax, [esp + 0x14]
push edi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
add esp, 0x10
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov esi, eax
mov ecx, dword [esp + 0x110]
mov eax, esi
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.10014785
add esp, 0x108
ret

Function at 0x1000df50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1000df5f
pop dword [ebp - 0x28]
mov eax, 0x9eedd76b
add eax, 0x711307f4
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x54497771
sub dword [ebp - 0x38], 0x5f73226
mov dword [ebp - 0x34], 0xbc9ca9e0
sub dword [ebp - 0x34], 0x8a695d9b
mov dword [ebp - 0x30], 0x926f2d35
add dword [ebp - 0x30], 0xb9dd16f9
mov dword [ebp - 0x2c], 0xb7b0cfda
sub dword [ebp - 0x2c], 0xb7b0cfda
lea eax, [ebp - 0x38]
push eax
mov eax, 0x27639983
sub eax, 0x17623923
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xa96031b1
sub dword [ebp - 0x38], 0x34edc85b
mov dword [ebp - 0x34], 0xbd6c23aa
add dword [ebp - 0x34], 0x84003dcb
mov dword [ebp - 0x30], 0x9023c308
add dword [ebp - 0x30], 0xd34ba964
mov dword [ebp - 0x2c], 0xe0e67ffb
add dword [ebp - 0x2c], 0x1f198005
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xe89f290d
sub eax, 0xd89dc8a9
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3fcad
push 0
call eax
mov ecx, 0xb676fc0e
add ecx, 0x49896cc2
xor edx, edx
add edx, eax
mov ebx, 0x78e28b8e
add ebx, 0x971faa72
add ebx, dword [ebp - 0x28]
mov esi, 0x74063dc3
add esi, 0xa47875b5
xor dword [ebp - 0x24], ebx
mov edi, dword [ebx]
mov dword [ebp - 4], 0xc54e9622
xor edi, esi
add dword [ebp - 4], 0x3c77c166
mov dword [edx], edi
sub dword [ebp - 0x10], 0x13d6788
add edx, 4
add ebx, 0x26d856f2
add ebx, 0xd927a912
loop 0x1000e083
add eax, 0xdd4938b9
sub eax, 0xdd47a2a6
mov ebx, eax
add eax, 5
mov ecx, 0x503a97a8
add ecx, 0xbfc56858
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..retplne
nop
mov ebx, 0x40de38
nop
mov ecx, 0x4caf6c3e
nop
nop
nop
nop
test eax, eax
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x731a703f
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x404492
Capabilities:
Get common file path

Disassembly:
push 0x38
mov eax, 0x420b27
call fcn.00412428
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x40], eax
mov eax, 0x104
lea esi, [ebp - 0x3c]
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
call fcn.00404717
mov dword [ebp - 4], ebx
mov esi, dword [ebp - 0x38]
push dword [ebp - 0x3c]
sub esi, dword [ebp - 0x3c]
mov edi, dword [sym.imp.KERNEL32.dll_GetTempPathA]
push esi
call edi
cmp eax, esi
jbe 0x4044ec
lea esi, [ebp - 0x3c]
call fcn.00404717
mov eax, dword [ebp - 0x38]
push dword [ebp - 0x3c]
sub eax, dword [ebp - 0x3c]
push eax
call edi
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x2c]
call fcn.00402200
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00406e0d
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00402dcc
lea esi, [ebp - 0x3c]
call fcn.00402f11
mov eax, dword [ebp - 0x40]
call fcn.004124ab
ret

Function at 0x4063c8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x4063ec
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.004060fe
or eax, 0x8d81246e
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid
Function at 0x406464
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and dword [ebp + 0x5d88e845], ecx
call 0xe99decbf
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.0040610e
push eax
push esi
push dword [ebp + 8]
call fcn.004060c3
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0040610e
push eax
push esi
push dword [ebp + 8]
call fcn.004060c3
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0040610e
push eax
push esi
push dword [ebp + 8]
call fcn.004060c3
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.004060fe
add dword [0x9d885d10], 0x7c
invalid