joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c1a4
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x4122e4], 0
jne 0x40c225
cmp dword [0x412304], 0
jne 0x40c1d4
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x412304], eax
test eax, eax
jne 0x40c1d4
push str.GetEnvironmentStrings_failed
call fcn.0040b214
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x412304]
jmp 0x40c1e8
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.0040512c
pop ecx
mov edi, eax
test eax, eax
jne 0x40c1e0
lea edi, [ebp + 1]
push edi
call fcn.00404260
pop ecx
mov ebx, eax
mov dword [0x4122e8], ebx
test ebx, ebx
jne 0x40c212
xor eax, eax
jmp 0x40c2e8
push edi
mov edx, dword [0x412304]
push edx
push ebx
call fcn.00404fdc
add esp, 0xc
jmp 0x40c245
xor esi, esi
mov ebx, dword [0x4122e4]
jmp 0x40c23f
push eax
call fcn.0040512c
pop ecx
test eax, eax
jne 0x40c23b
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40c22f
lea ebx, [esi + 4]
push 4
mov dword [0x4122ec], ebx
inc ebx
push ebx
call fcn.00404060
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x40c268
xor eax, eax
jmp 0x40c2e8
cmp dword [0x4122e4], 0
jne 0x40c299
xor esi, esi
mov ebx, dword [0x4122e8]
mov eax, dword [esp]
mov ebp, eax
jmp 0x40c28a
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.0040512c
pop ecx
mov edi, eax
test eax, eax
jne 0x40c280
jmp 0x40c2ca
xor esi, esi
mov ebx, dword [0x4122e4]
mov eax, dword [esp]
mov edi, eax
jmp 0x40c2c4
push eax
call fcn.0040512c
pop ecx
test eax, eax
je 0x40c2b9
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x40c2bd
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40c2a8
mov eax, dword [0x4122e4]
test eax, eax
je 0x40c2da
push eax
call fcn.00404270
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x4122e4], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4153e0
Capabilities:
Encode data using xor

Disassembly:
or dword [eax], eax
cmc
pop ebx
pop ecx
imul esi, dword [ecx - 0x24], 0x4d78885c
faddp st(2)
adc bh, dh
stosb byte es:[edi], al
popal
dec edx
and dword [edx - 0x278abf8a], esp
xor al, 0xee
invalid
Function at 0x43d4d2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x84
mov eax, 0x476cbe
call fcn.00476acd
mov eax, edx
mov dword [ebp - 0x44], eax
mov esi, ecx
xor ebx, ebx
xor ecx, ecx
push 7
mov dword [ebp - 0x48], ebx
pop edx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], edx
mov word [ebp - 0x28], cx
mov dword [ebp - 4], ebx
mov word [ebp - 0x40], cx
lea ecx, [ebp - 0x40]
push eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], edx
call fcn.0043fbb3
inc ebx
lea eax, [ebp - 0x40]
mov byte [ebp - 4], bl
cmp dword [ebp - 0x2c], 8
mov dword [ebp - 0x48], ebx
jb 0x43d525
mov eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x43d5f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x43d628
lea edx, [ebp - 0x28]
call fcn.0043d481
test al, al
je 0x43d552
xor bl, bl
and dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00440d4a
test bl, bl
jne 0x43d610
mov ebx, 0x8000
cmp dword [esi + 0x14], ebx
ja 0x43d573
mov ebx, dword [esi + 0x14]
push ecx
push ebx
mov ecx, esi
call fcn.0043f9f2
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x43d586
mov eax, dword [esi]
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
jb 0x43d592
mov ecx, dword [ebp - 0x28]
push 0
push eax
lea eax, [ebx + 1]
push eax
push 0
push dword [ebp - 0x44]
push ecx
call dword [sym.imp.KERNEL32.dll_SearchPathW]
mov edi, eax
cmp edi, ebx
jbe 0x43d5df
push ecx
lea ebx, [edi - 1]
mov ecx, esi
push ebx
call fcn.0043f9f2
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x43d5c1
mov ecx, dword [esi]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
jb 0x43d5cd
mov eax, dword [ebp - 0x28]
push 0
push ecx
push edi
push 0
push dword [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_SearchPathW]
mov edi, eax
test edi, edi
je 0x43d610
cmp edi, ebx
ja 0x43d610
push ecx
push edi
mov ecx, esi
call fcn.0043f9f2
jmp 0x43d61a
test al, 0x10
je 0x43d552
push 0x57
lea ecx, [ebp - 0x90]
call fcn.0043d331
push 0x47eab4
mov eax, ecx
jmp 0x43d638
push dword [ebp - 0x44]
mov ecx, esi
call fcn.0043fbb3
lea ecx, [ebp - 0x28]
call fcn.00440d4a
call fcn.00476a77
ret
push eax
lea ecx, [ebp - 0x6c]
call fcn.0043d331
push 0x47eab4
mov eax, ecx
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
int3
Function at 0x4424b4
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ecx, esi
call fcn.004423d1
movzx edx, word [esi + 0xc]
mov ecx, 0x12c
mov bl, al
push 0x6e
pop eax
cmp edx, ecx
ja 0x442667
je case.0x4424f6.22
cmp edx, 0x19
ja case.0x4424f6.24
jmp dword [edx*4 + 0x44272c]
mov al, bl
xor al, 1
movzx eax, al
shl ax, 5
add ax, 0x45
jmp 0x4426e0
xor bl, 1
movzx ecx, bl
shl cx, 5
add cx, 0x5a
push edi
push dword [ebp - 4]
mov edx, esi
call fcn.004423e2
jmp 0x442720
xor bl, 1
movzx ecx, bl
shl cx, 5
add cx, 0x53
jmp 0x44251f
mov al, bl
xor al, 1
movzx eax, al
shl ax, 5
add ax, 0x55
jmp 0x4426e0
mov al, bl
xor al, 1
movzx eax, al
shl ax, 5
add ax, 0x4c
jmp 0x4426e0
mov al, bl
xor al, 1
movzx eax, al
shl ax, 5
add ax, 0x44
jmp 0x4426e0
mov al, bl
xor al, 1
movzx eax, al
shl ax, 5
add ax, 0x51
jmp 0x4426e0
mov al, bl
xor al, 1
movzx eax, al
shl ax, 5
add ax, 0x49
jmp 0x4426e0
mov al, bl
xor al, 1
movzx eax, al
shl ax, 5
add ax, 0x58
jmp 0x4426e0
mov al, bl
xor al, 1
movzx eax, al
shl ax, 5
add ax, 0x46
jmp 0x4426e0
mov al, bl
xor al, 1
movzx eax, al
shl ax, 5
add ax, 0x47
jmp 0x4426e0
mov al, bl
xor al, 1
movzx eax, al
shl ax, 5
add ax, 0x54
jmp 0x4426e0
xor bl, 1
movzx ecx, bl
shl cx, 5
add cx, 0x42
jmp 0x44251f
mov al, bl
xor al, 1
movzx eax, al
shl ax, 5
add ax, 0x4a
jmp 0x4426e0
mov al, bl
xor al, 1
movzx eax, al
shl ax, 5
add ax, 0x4d
jmp 0x4426e0
mov al, bl
xor al, 1
movzx eax, al
shl ax, 5
add ax, 0x59
jmp 0x4426e0
mov al, bl
xor al, 1
movzx eax, al
shl ax, 5
add ax, 0x4e
jmp 0x4426e0
mov al, bl
xor al, 1
movzx eax, al
shl ax, 5
add ax, 0x57
jmp 0x4426e0
sub edx, 0x12d
je case.0x4424f6.23
sub edx, 5
je case.0x4424f6.6
sub edx, 1
je case.0x4424f6.3
sub edx, 1
je case.0x4424f6.16
dec edx
sub edx, 1
je case.0x4424f6.19
mov dword [ebp - 8], 0x57
jmp 0x4426e3
mov al, bl
xor al, 1
movzx eax, al
shl ax, 5
add ax, 0x4b
jmp 0x4426e0
mov al, bl
xor al, 1
movzx eax, al
shl ax, 5
add ax, 0x50
jmp 0x4426e0
mov al, bl
xor al, 1
movzx eax, al
shl ax, 5
add ax, 0x43
jmp 0x4426e0
mov al, bl
xor al, 1
movzx eax, al
shl ax, 5
add ax, 0x48
jmp 0x4426e0
mov al, bl
xor al, 1
movzx eax, al
shl ax, 5
add ax, 0x41
movzx eax, ax
movzx edx, ax
test bl, bl
je 0x44270e
test byte [esi], 4
mov ecx, 0x416e48
movzx eax, word [esi + 0x10]
jne 0x4426fd
mov ecx, 0x416e20
push eax
push edx
push ecx
push edi
push dword [ebp - 4]
call fcn.0044ac06
add esp, 0x14
jmp 0x442720
push edx
push 0x416e40
push edi
push dword [ebp - 4]
call fcn.0044ac06
add esp, 0x10
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x44adae
Capabilities:
Hash data via bcrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
mov edi, ecx
mov eax, dword [edi + 8]
test eax, eax
js 0x44ae06
and dword [edi + 8], 0
xor eax, eax
push esi
mov esi, dword [ebp + 0xc]
mov dword [edi + 4], 0x4227e0
test esi, esi
je 0x44ae05
mov ecx, dword [ebp + 8]
push ebx
mov ebx, SysReAllocString
cmp esi, 0x80000000
ja 0x44ade5
mov ebx, esi
push 0
push ebx
push ecx
push dword [edi]
call dword [sym.imp.bcrypt.dll_BCryptHashData]
mov dword [edi + 8], eax
test eax, eax
js 0x44ae04
mov ecx, dword [ebp + 8]
add ecx, ebx
mov dword [ebp + 8], ecx
sub esi, ebx
jne 0x44add6
pop ebx
pop esi
shr eax, 0x1f
xor al, 1
pop edi
pop ebp
ret 8

Function at 0x45170f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push esi
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45172f
test al, 0x20
je 0x45172f
and eax, 0xffffffdf
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop esi
ret

Function at 0x451731
Capabilities:
Check if file exists
Delete file

Disassembly:
cmp dword [0x49433c], 0
push ebx
push esi
push 8
mov bl, cl
pop esi
je 0x451782
mov ecx, 0x49433c
call fcn.0043d288
test bl, bl
jne 0x45176a
mov eax, 0x47f380
cmp dword [0x47f394], esi
jb 0x451761
mov eax, dword [0x47f380]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x451782
mov ecx, 0x47f380
cmp dword [0x47f394], esi
jb 0x45177d
mov ecx, dword [0x47f380]
call fcn.0045170f
cmp dword [0x49432c], 0
je 0x4517cc
mov ecx, 0x49432c
call fcn.0043d288
test bl, bl
jne 0x4517b4
mov eax, 0x47f2c0
cmp dword [0x47f2d4], esi
jb 0x4517ab
mov eax, dword [0x47f2c0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4517cc
mov ecx, 0x47f2c0
cmp dword [0x47f2d4], esi
jb 0x4517c7
mov ecx, dword [0x47f2c0]
call fcn.0045170f
cmp dword [0x494334], 0
je 0x4517fc
mov ecx, 0x494334
call fcn.0043d288
test bl, bl
jne 0x4517ff
mov eax, 0x47f340
cmp dword [0x47f354], esi
jb 0x4517f5
mov eax, dword [0x47f340]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
pop ebx
ret
mov ecx, 0x47f340
cmp dword [0x47f354], esi
jb 0x451812
mov ecx, dword [0x47f340]
pop esi
pop ebx
jmp fcn.0045170f
Function at 0x455d7c
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x47f200]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x105
xor esi, esi
mov byte [ebp - 0x211], cl
lea eax, [ebp - 0x210]
mov dword [ebp - 0x218], esi
push eax
push esi
mov edi, esi
mov ebx, esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x455e45
cmp eax, 0x105
je 0x455e45
push esi
lea eax, [ebp - 0x210]
push eax
push 2
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeExW]
mov ebx, eax
test ebx, ebx
je 0x455e43
push ebx
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_malloc]
mov edi, eax
pop ecx
test edi, edi
je 0x455e43
push edi
push ebx
push esi
lea eax, [ebp - 0x210]
push eax
push 2
call dword [sym.imp.VERSION.dll_GetFileVersionInfoExW]
test eax, eax
je 0x455e43
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x220]
push eax
push 0x42790c
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x455e43
cmp dword [ebp - 0x21c], 0x34
jb 0x455e43
mov eax, dword [ebp - 0x220]
movzx esi, word [eax + 0xa]
movzx ebx, word [eax + 8]
movzx eax, word [eax + 0xe]
mov dword [ebp - 0x218], eax
jmp 0x455e45
mov ebx, esi
push edi
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_free]
push 2
call sub.api_ms_win_crt_private_l1_1_0.dll__o___acrt_iob_func
push eax
push 0x427910
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_fputs]
add esp, 0x10
cmp byte [ebp - 0x211], 0
jne 0x455e89
push dword [ebp - 0x218]
push ebx
push esi
push 0x427930
push 2
call sub.api_ms_win_crt_private_l1_1_0.dll__o___acrt_iob_func
pop ecx
push eax
call fcn.00476657
add esp, 0x14
push 2
call sub.api_ms_win_crt_private_l1_1_0.dll__o___acrt_iob_func
push eax
push 0x427948
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_fputs]
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00475a10
leave
ret
Function at 0x458241
Capabilities:
Check if file exists
Set file attributes

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x40], ebx
jbe 0x458254
call fcn.0045820c
mov eax, dword [esi + 0x18]
mov ecx, esi
push ebx
mov dword [esi + 0x38], eax
call fcn.0045b872
push 0x10
lea eax, [esi + 0x34]
mov ecx, esi
push eax
call fcn.0045b828
push dword [esi + 8]
mov edi, dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esi + 4]
mov dword [esi + 4], ebx
lea eax, [ecx + 1]
cmp eax, 1
jbe 0x458290
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebx
lea eax, [edi + 2]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ecx, dword [esi]
mov dword [esi], ebx
lea eax, [ecx + 1]
cmp eax, 1
jbe 0x4582b9
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esi + 0x1c]
pop edi
pop esi
pop ebx
jmp fcn.0045170f

Function at 0x45ac26
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x38
mov eax, 0x47813a
call fcn.00476acd
mov edi, edx
mov eax, ecx
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x30], ecx
mov ecx, eax
push 0
call fcn.004582c4
push ecx
mov esi, eax
lea eax, [ebp - 0x1c]
push ecx
push eax
push esi
lea ecx, [ebp - 0x44]
call fcn.004583da
and dword [ebp - 4], 0
mov ecx, edi
mov dword [ebp - 0x1c], 0x4c56454c
call fcn.0045afa9
push esi
mov ecx, edi
mov dword [ebp - 0x14], eax
call fcn.0045aff2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.00458411
mov ecx, dword [ebp - 0x2c]
push 1
call fcn.004582c4
push ecx
mov esi, eax
lea eax, [ebp - 0x1c]
push ecx
push eax
push esi
lea ecx, [ebp - 0x44]
call fcn.004583da
mov dword [ebp - 4], 1
mov ecx, ebx
mov dword [ebp - 0x1c], 0x4b534154
call fcn.0045afa9
push esi
mov ecx, ebx
mov dword [ebp - 0x14], eax
call fcn.0045ae93
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.00458411
mov ecx, dword [ebp - 0x2c]
push 3
call fcn.004582c4
push ecx
mov esi, eax
lea eax, [ebp - 0x28]
push ecx
push eax
push esi
lea ecx, [ebp - 0x44]
call fcn.004583da
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 4], 2
mov dword [ebp - 0x28], 0x5759454b
call fcn.0045ae4a
mov ecx, dword [ebp - 0x30]
push esi
mov dword [ebp - 0x20], eax
call fcn.0045ad3a
lea ecx, [ebp - 0x44]
call fcn.00458411
call fcn.00476a77
ret 8

Function at 0x45b8cd
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
xor edx, edx
mov ecx, 0x811c9dc5
cmp dword [ebp + 0xc], edx
je 0x45b8f5
push esi
mov esi, dword [ebp + 8]
movzx eax, word [esi + edx*2]
xor eax, ecx
imul ecx, eax, 0x1000193
inc edx
cmp edx, dword [ebp + 0xc]
jne 0x45b8e2
pop esi
mov eax, ecx
pop ebp
ret 8
Function at 0x45c8a2
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x18], eax
cmp eax, 0xffffffff
jne 0x45c8d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x45c910
push edi
push edi
push edi
push 2
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 0x1c], eax
test eax, eax
je 0x45c8ce
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi], eax
test eax, eax
je 0x45c8ce
push edi
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0xc], eax
cmp eax, 0xffffffff
je 0x45c8ce
xor eax, eax
pop edi
pop esi
pop ebp
ret 4

Function at 0x45c916
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
push ecx
push ecx
push dword [ebp + 8]
mov edi, ecx
call fcn.0045d6b0
mov dword [edi + 0x14], eax
test eax, eax
jne 0x45c937
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x45c994
push esi
push 0
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov esi, eax
test esi, esi
je 0x45c97e
push esi
push dword [edi + 0x14]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [edi + 0x10], eax
test eax, eax
je 0x45c97e
push esi
push dword [edi + 0x14]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [edi + 0xc], eax
test eax, eax
je 0x45c97e
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [edi], eax
test eax, eax
jne 0x45c991
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, edi
mov esi, eax
call fcn.0045c999
mov eax, esi
jmp 0x45c993
xor eax, eax
pop esi
pop edi
pop ebp
ret 0xc

Function at 0x45db6c
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov edi, edi
push ebx
mov ebx, edx
shr edx, 2
push esi
push edi
xor edi, edi
lea ecx, [ecx + edx*4]
mov esi, edi
neg edx
je 0x45dba4
imul eax, dword [ecx + edx*4], 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor eax, esi
rol eax, 0xd
imul esi, eax, 5
sub esi, 0x19ab949c
add edx, 1
jne 0x45db81
mov eax, ebx
and eax, 3
sub eax, 1
je 0x45dbc8
sub eax, 1
je 0x45dbbf
sub eax, 1
jne 0x45dbde
movzx edi, byte [ecx + 2]
shl edi, 0x10
movzx eax, byte [ecx + 1]
shl eax, 8
or edi, eax
movzx eax, byte [ecx]
or eax, edi
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor esi, eax
xor esi, ebx
mov eax, esi
shr eax, 0x10
xor eax, esi
imul ecx, eax, 0x85ebca6b
pop edi
pop esi
pop ebx
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
ret
Function at 0x45f770
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
je 0x45f788
push dword [esi]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [esi + 0x18], 0
je 0x45f797
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 8]
lea ecx, [ebp - 4]
sub eax, dword [esi]
push 0
pop edi
push edi
cdq
add eax, 2
push ecx
push eax
push dword [esi + 0x14]
adc edx, edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x45f7d7
mov eax, dword [eax]
jmp 0x45f7d9
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45f7fd
test al, 0x20
je 0x45f7fd
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x45f7f2
mov edi, dword [ecx]
and eax, 0xffffffdf
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop edi
pop esi
leave
ret

Function at 0x47392c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
xor edx, edx
movzx eax, byte [edx + edi]
xor eax, esi
imul esi, eax, 0x1000193
inc edx
cmp edx, 8
jb 0x47393d
mov eax, dword [ecx + 0x18]
pop edi
and eax, esi
pop esi
pop ebp
ret 4

Function at 0x473ac0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
xor edx, edx
movzx eax, byte [edx + edi]
xor eax, esi
imul esi, eax, 0x1000193
inc edx
cmp edx, 2
jb 0x473ad1
mov eax, dword [ecx + 0x18]
pop edi
and eax, esi
pop esi
pop ebp
ret 4

Function at 0x475a62
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
cmp edx, esi
je 0x475a9f
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [edx + 0xc]
jb 0x475a98
mov eax, dword [edx + 8]
add eax, dword [edx + 0xc]
cmp ecx, eax
jb 0x475aa4
add edx, 0x28
cmp edx, esi
jne 0x475a89
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x475aa1
Function at 0x419760
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40f015
lea edi, [esi - 0xe015]
push edi
or ebp, 0xffffffff
jmp 0x419782
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419789
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419778
nop
push 1
nop
pop eax
add ebx, ebx
jne 0x41979b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419790
jne 0x4197ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419790
sub ecx, ecx
sub eax, 3
jb 0x4197c0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419832
mov ebp, eax
add ebx, ebx
jne 0x4197cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4197d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4197fc
inc ecx
add ebx, ebx
jne 0x4197e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4197dd
jne 0x4197f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4197dd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41981c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41980d
jmp 0x41977e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41981c
add edi, ecx
jmp 0x41977e
pop esi
push esi
pop edi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41983a
cmp byte [edi], 5
jne 0x41983a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41983f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x4198b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41986c
push edi
pop ecx
jns 0x41989b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x4198b1
mov dword [ebx], eax
add ebx, 4
jmp 0x419889
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4198eb
sub esp, 0xffffff80
jmp 0x404c20

Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43100c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
jl 0x431030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219