joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408600
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x424bc0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x477b80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x20], esi
mov eax, dword [esi]
mov eax, dword [eax]
cmp eax, 1
je 0x408641
mov byte [ebp - 0x11], 1
test eax, eax
jne 0x408645
mov byte [ebp - 0x11], 0
push dword [ebp + 0xc]
mov dword [ebp - 4], 0
push dword [ebp + 8]
push 8
push 0x20
call dword [0x429348]
mov edi, eax
add esp, 0x10
mov dword [ebp - 0x24], edi
test edi, edi
jne 0x40866e
call dword [0x42934c]
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [edi + 4], eax
mov ecx, dword [esi]
mov eax, dword [ecx + 0xc]
mov ebx, dword [ecx + 4]
shl ebx, 5
add ebx, eax
lea edx, [eax + ecx]
add ebx, ecx
mov eax, dword [edi + 0xc]
add eax, edi
cmp byte [ebp - 0x11], 0
je 0x408719
cmp edx, ebx
je 0x40872b
nop
mov edi, eax
mov esi, edx
add eax, 0x20
add edx, 0x20
push esi
mov ecx, edi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
call dword [0x4290d0]
mov edx, dword [esi + 4]
xor edx, dword [edi + 4]
and edx, 1
xor edx, dword [edi + 4]
mov dword [edi + 4], edx
mov ecx, dword [esi + 4]
xor ecx, edx
and ecx, 2
xor ecx, edx
mov dword [edi + 4], ecx
mov eax, dword [esi + 4]
xor eax, ecx
and eax, 4
xor eax, ecx
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [edi + 0x10], eax
lea eax, [esi + 0x18]
mov dword [edi + 0x14], ecx
lea ecx, [edi + 0x18]
push eax
call dword [0x42927c]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
cmp edx, ebx
jne 0x4086a0
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp - 0x24]
jmp 0x408729
sub ebx, edx
and ebx, 0xffffffe0
push ebx
push edx
push eax
call fcn.00423ee2
add esp, 0xc
mov ecx, dword [esi]
mov eax, dword [edi + 8]
xor eax, dword [ecx + 8]
and eax, 0x7fffffff
xor eax, dword [ecx + 8]
mov dword [edi + 8], eax
mov ecx, dword [esi]
mov eax, dword [ecx]
test eax, eax
je 0x408758
cmp eax, 0xffffffff
je 0x40877e
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
setne al
test al, al
jne 0x40877e
cmp dword [ebp + 8], 0
je 0x408775
cmp byte [ebp - 0x11], 0
jne 0x408775
push 8
push 0x20
push dword [esi]
call dword [0x4290ac]
add esp, 0xc
jmp 0x40877e
push dword [esi]
mov ecx, esi
call fcn.004085a0
mov dword [esi], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41f682
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x429080]
test eax, eax
je 0x41f6c1
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41f6c1
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41f6c1
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41f6c1
cmp dword [ecx + 0x74], 0xe
jbe 0x41f6c1
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x5341e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xce000]
push edi
jmp 0x5341fa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x534201
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5341f0
mov eax, 1
add ebx, ebx
jne 0x534213
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x534224
jne 0x534243
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x534243
dec eax
add ebx, ebx
jne 0x534230
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x534208
add ebx, ebx
jne 0x53423f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x534295
xor ecx, ecx
sub eax, 3
jb 0x53425b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5342ca
sar eax, 1
mov ebp, eax
jmp 0x534266
add ebx, ebx
jne 0x534266
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x534234
inc ecx
add ebx, ebx
jne 0x534274
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x534234
add ebx, ebx
jne 0x534281
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x534276
jne 0x534292
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x534276
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5342b4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5342a6
jmp 0x5341f6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5342b4
add edi, ecx
jmp 0x5341f6
pop esi
lea edi, [esi + 0x12f000]
mov ecx, 8
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5342d6
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5342db
lea edi, [esi + 0x131000]
mov eax, dword [edi]
or eax, eax
je 0x53434c
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x138fc4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1390e8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x534301
mov ecx, edi
jns 0x534330
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1390f0]
or eax, eax
je 0x534346
mov dword [ebx], eax
add ebx, 4
jmp 0x53431e
call dword [esi + 0x1390ec]
mov ebp, dword [esi + 0x1390f4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x534380
sub esp, 0xffffff80
jmp 0x49add5
Function at 0x41d2fc
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x2c], edi
push dword [esp + 4]
lea esp, [esp + 0x30]
call fcn.00425fab
rdtsc
mov eax, dword [ebp + 0x18]
bts cx, 0xa
mov ecx, dword [ebp + 0x10]
or dl, dl
bswap dx
mov edx, dword [ebp + 0xc]
stc
pushfd
jmp 0x474a39
add esp, 0x14
pushal
mov dword [esp + 0x1c], eax
pushal
mov word [esp + 8], bp
call fcn.0041e87e
sar dword [eax], 1
xor dword [eax + 0x71e711f6], 0xffffffbd
js 0x474a39
add dword [0x445568bf], edi
jns 0x474aa0
fnstsw word [eax]
add eax, 0x25181528
and al, 0xb9
jo 0x474a72
jle 0x474ac5
sal dword [edx], 1
enter 0x31f9, 0x76
dec ebx
jbe 0x474abf
jae 0x474ae4
xchg esi, eax
dec esp
mov dword [edi], esi
sti
mov dl, 0x85
xor al, 0x18
adc dword [ebp + 0x27], edx
adc dl, byte [esi + 0x24]
and dword [ecx], ebx
mov ebx, 0xcb707548
invalid
outsb dx, byte [esi]
aad 0xa9
movsb byte es:[edi], byte [esi]
dec esp
fidivr dword [ebp - 0x3a]
leave
invalid
rcr dword [ecx + esi*4 - 0x3a], cl
mov ebx, 0x208c8dff
ret 0xe1c7
lea ecx, [eax + 0x68e1c7c2]
mov edx, ecx
adc byte [ebx + 0x144c394e], ah
adc edx, esi
or byte [0x7ce7b4d9], bh
ljmp 0x3cfa
test dword [edx + 0x36], esi
inc esp
imul ebx, dword [esi], 0x848bb06f
out 0x1b, al
mov al, byte [0xceb27994]
mov bl, 0
stosb byte es:[edi], al
cmove ebp, dword [ebx + 0x58f0c5b1]
sub al, 0xc1
popfd
invalid
Function at 0x443f9a
Capabilities:
Encode data using xor

Disassembly:
add byte [edi], cl
mov esi, dword [ebp + 0x60ffffe5]
mov ch, 0xe5
invalid
push 0x7d5447f1
pushal
lea esp, [esp + 0x44]
jne 0x450747
call fcn.00420c40
pushfd
mov dword [esp + 0x3c], eax
bswap eax
not al
call fcn.0048dc43
xor cl, ch
jbe 0x443ff1
adc dword [edx], 0xffffffe7
je 0x443fe2
inc bl
salc
jmp 0x443f80
pop eax
push cs
imul dword [edx - 0x4c84d1a7]
mov bl, 0xe6
pop ebx
and al, 0x89
fcom dword [edi]
push ebx
and dword [eax], edi
mov byte [0xff657449], al
cmp byte [edx + 0x1c21cc51], ah
add eax, 0x60a33938
test byte [edi + 0x7eac6a8a], dl
mov ebx, 0x18210efa
sbb al, 5
cmp byte [ecx], bh
mov dword [0x8a978460], eax
push 0xffffffffffffffac
jle 0x443faa
cli
push cs
and dword [eax], ebx
sbb byte [edx - 0x78], dh
jb 0x443f7d
jno 0x443fc6
mov bh, byte [esi + edx - 0x35]
inc eax
xchg dword [edi], ebp
mov byte [esi + 0xc], dh
push ss
lds esi, [edx]
push 0xffffffffffffffab
sar ecx, 1
pop ecx
xor dl, al
leave
stosd dword es:[edi], eax
outsb dx, byte [esi]
push es
cmpsb byte [esi], byte es:[edi]
mov ebx, 0xbc4d9bb3
out 0x26, al
out dx, eax
fimul dword [ecx + edi*4 + 0x6b193dfa]
in eax, dx
inc ebp
sal byte [edx], 1
cmp esi, dword [0xede496d2]
mov ch, 0xb0
mov edi, 0xf534a96a
cmc
inc edi
cmp ch, byte [0x3b457ae4]
push es
movsb byte es:[edi], byte [esi]
jle 0x443ff2
xlatb
and edx, esi
and ebx, dword [ebp + esi - 0x10]
cmp dh, byte [ebp - 0x73b00432]
jnp 0x44402f
test al, 0x1a
dec ebp
ljmp 0x3610
push ebp
push dword [esp]
bsr ax, si
mov eax, dword [ebp + 8]
stc
mov dword [esp + 4], ebx
cmc
stc
cmc
mov dword [esp], edi
clc
clc
cmc
push ebp
cmp eax, dword [esi]
pushfd
pushal
pushfd
lea esp, [esp + 0x2c]
jne 0x49a43c
test ch, al
lahf
mov edi, dword [esi + 0x2c]
mov al, 0xfa
cmc
bsr ax, bx
mov dword [ebp - 4], 0
cwde
setp ah
mov edi, edi
clc
or ax, 0xb08d
cmp dword [ebp - 4], 0
not al
mov eax, dword [ebp + 0xc]
call fcn.0048e6e5

Function at 0x45fb44
Capabilities:
Execute anti-debugging instructions

Disassembly:
setp cl
mov ecx, 0x40e291
lea esp, [esp + 0x4c]
jnp 0x41fe7f
pushfd
push dword [esp]
mov ecx, dword [ecx + 0x5ce5e]
jmp 0x48085e
pushal
call fcn.00486521
Function at 0x47340f
Capabilities:
Execute anti-debugging instructions

Disassembly:
shr ah, cl
aam 0x78
mov eax, dword [edi + esi*8 + 4]
push 0x32132fb2
stc
pushal
test eax, eax
pushfd
call fcn.0041d253
push ebp
cmc
rol ecx, 0x11
clc
call fcn.00484fbe
mov byte [esp + 4], 0xd
pushal
mov dword [esi + 0x34], ebx
jmp 0x45cd9f
push dword [esp]
jmp 0x49800a
mov dword [esp + 0x24], 0x1c
call fcn.0046bd29
pop ds
inc byte [ebp + 0x76]
jno 0x45cdc5
out 0xb7, eax
cmc
hlt
inc ebp
mov ebp, 0xa471fecf
pop ds
jmp 0x61b795c2
call fcn.0047fe21
call fcn.0041f7d2
lahf
bswap esi
movsx si, al
pop esi
call fcn.0044bd42
mov al, 0x97
rdtsc
bswap cx
lea ecx, [edx - 0xed6a058]
mov ecx, dword [esi + 0x30]
rdtsc
cdq
mov eax, dword [ecx]
mov dl, bh
jmp 0x492220
cmc
cmp cl, 0xd8
add eax, ecx
bt di, di
cmp esi, eax
push 0x8cb350e7
jmp 0x456b7b
mov edx, dword [eax + 8]
push ebx
mov dword [esp], 0x45ecb2
jmp 0x45ecfa
jmp 0x47f726
mov dword [ebp - 8], esi
pushfd
jmp 0x4a0972
lea esp, [esp + 0x18]
jl 0x421040
lahf
seta ah
not di
movsx di, cl
pop edi
jo 0x473402
push 0x975d7dd4
movzx bx, bl
mov esi, dword [esp + 4]
xchg bx, ax
xchg bl, al
lahf
mov eax, 1
bswap bx
mov ebx, dword [esp + 8]
jmp 0x471135

Function at 0x48680f
Capabilities:
Encode data using xor

Disassembly:
call fcn.00458d98
sub dword [edi], ebx
xchg esp, eax
aam 0x1e
out 0x5a, eax
add edi, dword cs:[esi]
xor ebp, dword [esi - 0x39a489b5]
cmp eax, dword [esi]
add edi, dword [esi]
and ebx, dword [esi]
aaa
lodsd eax, dword [esi]
jle 0x486812
std
jmp [ecx]
sub dh, byte [eax + 0xf32d14b]
push ss
popal
add byte [edi + 0x13643146], cl
dec esi
cmp dword [edi + esi*8 + 0x7e], ecx
in eax, dx
iretd

Function at 0x496236
Capabilities:
Execute anti-debugging instructions

Disassembly:
push eax
push dword [esp]
mov esi, dword [esi + 0x6e35e]
pushal
call fcn.00464eba
jmp 0x4aed1b
mov dword [esp + 0x2c], ecx
mov byte [esp + 0xc], dl
mov byte [esp], 0xe7
call fcn.004a9cbb
lea eax, [eax + 1]
pushfd
call fcn.0041d488
jmp 0x4863e9
mov dword [esp], 0xf495b195
pushal
mov dword [ebp - 4], ebx
push dword [esp + 0x20]
lea esp, [esp + 0x28]
jl 0x4a44b1
cdq
setl bl
cdq
pop edi
lea ecx, [esi*4 - 0xb6e0021]
push edi
mov esi, dword [esp + 4]
mov byte [esp], ah
movzx bx, cl
movsx bx, cl
pushfd
mov ebx, dword [esp + 0xc]
rdtsc
lea ecx, [ecx + 0x36044f22]
pushfd
cdq
mov ecx, dword [ebp + 0x14]
rdtsc
pop eax
cdq
pushal
mov edx, dword [ebp + 0x10]
bswap ax
mov byte [esp], bl
movsx ax, cl
mov eax, dword [ebp + 0xc]
jmp 0x4a63bc

Function at 0x4ab585
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp ebx, edx
pushal
mov dword [esp], esp
mov dword [ebp - 4], ebx
pushal
push ebp
lea esp, [esp + 0x48]
jl 0x4a44b1
movzx si, cl
cwde
mov di, bx
setb bh
pop edi
rdtsc
not bx
lahf
movzx si, cl
pop esi
rdtsc
movzx bx, cl
jmp 0x454f70
Function at 0x17db910
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x5d9000]
push edi
or ebp, 0xffffffff
jmp 0x17db932
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x17db939
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x17db928
mov eax, 1
add ebx, ebx
jne 0x17db94b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x17db95c
jne 0x17db97b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x17db97b
dec eax
add ebx, ebx
jne 0x17db968
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x17db940
add ebx, ebx
jne 0x17db977
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x17db9cd
xor ecx, ecx
sub eax, 3
jb 0x17db993
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x17dba02
sar eax, 1
mov ebp, eax
jmp 0x17db99e
add ebx, ebx
jne 0x17db99e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x17db96c
inc ecx
add ebx, ebx
jne 0x17db9ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x17db96c
add ebx, ebx
jne 0x17db9b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x17db9ae
jne 0x17db9ca
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x17db9ae
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x17db9ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x17db9de
jmp 0x17db92e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x17db9ec
add edi, ecx
jmp 0x17db92e
pop esi
mov edi, esi
mov ecx, 0x325c02
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0x17dba27
cmp byte [edi], 0x9f
jne 0x17dba0c
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0x17dba0a
lea edi, [esi + 0x8d7000]
mov eax, dword [edi]
or eax, eax
je 0x17dba6f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x957f80]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x958070]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x17dba2d
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x958074]
or eax, eax
je 0x17dba69
mov dword [ebx], eax
add ebx, 4
jmp 0x17dba4a
call dword [esi + 0x958084]
mov ebp, dword [esi + 0x958078]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x17dbaa3
sub esp, 0xffffff80
jmp 0x127bb18
Function at 0x9e7130
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push eax
push 0x40
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp + 0xc]
add esp, 0x10
test eax, eax
jne 0x9e7153
mov eax, 1
jmp 0x9e725e
mov edx, dword [ebp + 8]
movzx eax, word [edx]
cmp eax, 0x5a4d
jne 0x9e7169
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x3c], 0
jne 0x9e7173
mov eax, 2
jmp 0x9e725e
mov edx, dword [ebp + 0x10]
push edx
push 0xf8
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x40
push edx
call dword [ebp + 0xc]
add esp, 0x10
test eax, eax
jne 0x9e719e
mov eax, 1
jmp 0x9e725e
mov eax, dword [ebp + 8]
cmp dword [eax + 0x40], 0x4550
jne 0x9e71c4
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + 0x58]
cmp edx, 0x10b
jne 0x9e71c4
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0x46]
test ecx, ecx
jne 0x9e71ce
mov eax, 2
jmp 0x9e725e
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0x46]
imul eax, eax, 0x28
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x140], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x140]
push eax
call fcn.009f9610
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x138], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 0x138], 0
jne 0x9e720f
mov eax, 3
jmp 0x9e725e
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0x54]
lea ecx, [ecx + eax + 0x18]
mov edx, dword [ebp + 8]
mov dword [edx + 0x13c], ecx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x140]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x13c]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
push eax
call dword [ebp + 0xc]
add esp, 0x10
test eax, eax
jne 0x9e725c
mov eax, 1
jmp 0x9e725e
xor eax, eax
pop ebp
ret

Function at 0x9e7c00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
je 0x9e7c16
xor eax, eax
jmp 0x9e7c56
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x3c]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0x4550
jne 0x9e7c3b
mov edx, dword [ebp - 4]
movzx eax, word [edx + 0x18]
cmp eax, 0x10b
je 0x9e7c3f
xor eax, eax
jmp 0x9e7c56
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x78]
push ecx
call fcn.009e7c60
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x9fa350
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x9fa380
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 8], 0
jne 0x9fa393
xor eax, eax
jmp 0x9fa451
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x9fa3ae
xor eax, eax
jmp 0x9fa451
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0x4550
je 0x9fa3cc
xor eax, eax
jmp 0x9fa451
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x78]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x20]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x1c], 0
jmp 0x9fa40e
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [eax + 0x18]
jae 0x9fa44f
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax*4]
push edx
call fcn.009f9630
add esp, 8
test eax, eax
jne 0x9fa44d
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x9fa451
jmp 0x9fa405
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4023c0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x402868
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov eax, dword [esp + 0x18]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
je 0x402439
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 4]
push 0
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.00402600
mov al, 1
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.00402600
mov ecx, dword [esp + 8]
xor al, al
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x402460
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x402890
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
and ecx, 0xffff
push eax
push ecx
push 0
mov dword [esp + 0x24], 1
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x402509
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x402509
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
je 0x402509
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, ebx
mov esi, eax
mov edx, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
push ebp
rep movsb byte es:[edi], byte [esi]
push ecx
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call sub.MFC42.DLL_CString::CString
call fcn.004023c0
add esp, 0xc
test al, al
push ebp
jne 0x40253d
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 0
call fcn.00402600
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], 0xffffffff
call fcn.00402600
xor al, al
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 0
call fcn.00402600
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], 0xffffffff
call fcn.00402600
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov al, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219