joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4014a5
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
enter 4, 0
mov esi, eax
mov cl, byte [0x407060]
mov edx, eax
mov ebx, eax
shl edx, cl
mov eax, 0x407064
add edx, dword [0x407060]
call fcn.004013e1
lea edx, [ebp - 4]
push edx
mov edx, esi
or dl, 0x40
mov edi, 0x401ec3
push edx
sub edi, fcn.0040168e
push edi
xor eax, eax
push fcn.0040168e
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp - 4], 0
je 0x401517
mov eax, fcn.0040168e
mov ebx, esi
mov edx, edi
call fcn.004013e1
mov edx, 0x1be00
mov eax, 0x407064
mov ebx, esi
call fcn.004012cc
leave
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x4015ba
Capabilities:
Encode data using base64 via winapi
Get common file path
Initialize winsock library

Disassembly:
push ecx
push edx
enter 0x4d4, 0
lea eax, [ebp - 0x2cc]
push eax
push 2
call dword [sym.imp.WS2_32.DLL_WSAStartup]
push 0x104
lea eax, [ebp - 0x4d4]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
xor eax, eax
push eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push 0x7f00
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x1c], 6
push eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.USER32.DLL_LoadIconA]
push 0x7f00
push 0
mov dword [ebp - 0x24], eax
call dword [sym.imp.USER32.DLL_LoadCursorA]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.DLL_RegisterClassW]
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.USER32.DLL_LoadAcceleratorsA]
mov dword [ebp - 4], 0xa
mov byte [ebp - 0x13c], 0
call dword [sym.imp.WS2_32.DLL_WSACleanup]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 1
push 1
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.CRYPT32.DLL_CryptBinaryToStringA]
movzx eax, byte [ebp - 0x10]
sub eax, 0x47
add eax, dword [ebp - 4]
leave
pop edx
pop ecx
ret
Function at 0x4020f0
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push ecx
push esi
push edi
mov edi, eax
mov esi, ebx
mov dword [0x425282], eax
mov dword [0x4242d6], edx
call fcn.00402790
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentStringsA]
mov dword [0x424370], eax
xor eax, eax
mov dword [0x4258a2], eax
call dword [sym.imp.KERNEL32.DLL_GetVersion]
mov edx, eax
mov byte [0x424376], al
shr eax, 0x10
push 0x104
mov word [0x424378], ax
xor eax, eax
mov ebx, 0x208
mov ax, word [0x424378]
and edx, 0xffff
mov dword [0x42437a], eax
xor eax, eax
sar edx, 8
mov al, byte [0x424376]
and edx, 0xff
mov dword [0x42437e], eax
xor eax, eax
mov byte [0x424377], dl
mov al, dl
mov edx, dword [0x42437e]
push 0x425286
shl edx, 8
push 0
or edx, eax
mov dword [0x424382], eax
mov dword [0x424386], edx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov edx, 0x42538a
xor eax, eax
mov dword [0x42433e], 0x425286
call fcn.004028c0
mov dword [0x42434a], 0x42538a
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
call fcn.00402960
mov edx, eax
mov bl, byte [eax]
mov dword [0x42527e], eax
cmp bl, 0x22
je 0x4021e4
xor edx, edx
mov dl, byte [eax]
test byte [edx + 0x4029a1], 2
je 0x4021fc
xor edx, edx
mov dl, byte [eax]
test byte [edx + 0x4029a1], 2
je 0x402203
inc eax
jmp 0x4021d4
inc eax
cmp bl, byte [eax]
je 0x4021f4
cmp byte [eax], 0
je 0x4021f4
inc eax
cmp byte [eax], 0x22
jne 0x4021e9
cmp byte [eax], 0
je 0x4021d4
inc eax
jmp 0x4021d4
test dl, dl
je 0x4021d4
inc eax
jmp 0x4021c7
mov dword [0x42433a], eax
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
test eax, eax
je 0x402277
call fcn.00402aa1
mov edx, eax
mov bx, word [eax]
mov dword [0x42527a], eax
cmp bx, 0x22
je 0x40224a
xor edx, edx
mov dl, byte [eax]
test byte [edx + 0x4029a1], 2
je 0x40226c
xor edx, edx
mov dl, byte [eax]
test byte [edx + 0x4029a1], 2
je 0x40227c
add eax, 2
jmp 0x402238
add eax, 2
cmp bx, word [eax]
je 0x402261
cmp word [eax], 0
je 0x402261
add eax, 2
cmp word [eax], 0x22
jne 0x402252
cmp word [eax], 0
je 0x402238
add eax, 2
jmp 0x402238
cmp word [eax], 0
je 0x402238
add eax, 2
jmp 0x40222b
mov eax, 0x4020b0
mov dword [0x424346], eax
test edi, edi
jne 0x40228e
mov eax, 1
pop edi
pop esi
pop ecx
ret
push 0x104
push 0x425592
push esi
mov ebx, 0x208
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov edx, 0x425696
mov eax, esi
mov dword [0x424342], 0x425592
call fcn.004028c0
mov dword [0x42434e], 0x425696
mov eax, 1
pop edi
pop esi
pop ecx
ret
Function at 0x404660
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push edx
sub esp, 4
mov dword [esp], eax
mov eax, dword [0x424492]
test eax, eax
je 0x40467c
cmp dword [0x424336], 0xfffffffe
jne 0x404682
xor eax, eax
add esp, 4
pop edx
pop ecx
ret
mov eax, esp
call fcn.00404610
test eax, eax
je 0x40467c
push 0x40
push 0x1000
mov ecx, dword [esp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov edx, eax
test eax, eax
je 0x40467c
mov eax, dword [esp]
sub eax, 4
cmp eax, dword [esp]
ja 0x40467a
mov dword [esp], eax
cmp eax, 0x38
jb 0x40467a
mov dword [edx], eax
mov eax, edx
call fcn.00404590
mov ecx, eax
mov eax, dword [eax]
mov dword [esp], eax
or al, 1
mov dword [ecx], eax
mov dword [edx + 0x14], 0
lea eax, [ecx + 4]
inc dword [edx + 0x18]
call fcn.00402ad0
mov eax, 1
add esp, 4
pop edx
pop ecx
ret

Function at 0x404fe0
Capabilities:
Set environment variable

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
push ebp
sub esp, 0x14
mov ebp, eax
mov dword [esp], 2
mov edx, 0x3d
mov dword [esp + 4], 1
call fcn.00405550
mov ebx, eax
test eax, eax
je 0x40500e
cmp eax, ebp
jne 0x40501d
mov eax, 0xffffffff
add esp, 0x14
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
sub eax, ebp
mov dword [esp + 0xc], eax
inc eax
call fcn.004039d0
mov edx, eax
mov dword [esp + 8], eax
test eax, eax
je 0x40500e
mov ecx, dword [esp + 0xc]
mov esi, ebp
mov edi, eax
push edi
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov cl, al
and cl, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, dword [esp + 0xc]
lea esi, [ebx + 1]
mov byte [edx + eax], 0
mov eax, esi
call fcn.004055b0
mov ebx, eax
test eax, eax
je 0x4050e3
inc eax
call fcn.004039d0
mov dword [esp + 0x10], eax
test eax, eax
je 0x4050cd
mov ecx, ebx
mov edi, eax
push edi
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov cl, al
and cl, 3
rep movsb byte es:[edi], byte [esi]
pop edi
add ebx, edi
mov byte [ebx], 0
mov edx, dword [esp + 0x10]
push edx
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableA]
mov edx, eax
mov eax, dword [esp + 8]
call fcn.00402ad0
mov eax, dword [esp + 0x10]
call fcn.00402ad0
test edx, edx
jne 0x4050e9
cmp dword [esp + 0x10], 0
jne 0x40500e
xor eax, eax
add esp, 0x14
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
mov eax, edx
call fcn.00402ad0
mov eax, 0xffffffff
add esp, 0x14
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
mov dword [esp + 0x10], eax
jmp 0x40508e
mov eax, ebp
call fcn.00405270
test eax, eax
jne 0x40500e
cmp dword [0x4258a6], 0
je 0x405013
mov eax, ebp
call fcn.004055b0
lea ebx, [eax + 1]
mov eax, dword [esp]
imul eax, ebx
call fcn.004039d0
mov ecx, eax
test eax, eax
je 0x405151
imul ebx, dword [esp + 4]
mov edx, ebp
call fcn.004055e0
cmp eax, 0xffffffff
jne 0x40516a
mov eax, ecx
call fcn.00402ad0
mov eax, 0xe
call fcn.00403aca
mov eax, 0xffffffff
add esp, 0x14
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
mov eax, 5
call fcn.00403aca
mov eax, 0xffffffff
add esp, 0x14
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
mov eax, ecx
call fcn.00405880
add esp, 0x14
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
Function at 0x4053e0
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ecx
push esi
push edi
sub esp, 8
mov esi, eax
mov edi, edx
xor edx, edx
mov ecx, eax
inc eax
cmp byte [ecx], 0
je 0x4053f7
inc edx
jmp 0x4053ec
push 0
lea eax, [esp + 4]
push eax
push edx
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push 0
lea eax, [esp + 4]
push eax
push 2
lea eax, [esp + 0x10]
push eax
push 0xfffffffffffffff4
mov word [esp + 0x18], 0xa0d
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, edi
jmp 0x402390
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..pdata
mov ebx, 0x408f6c
nop
mov ecx, 0x242e14c9
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..pdata_1
mov ebx, 0x42e3d0
nop
mov ecx, 0x1a271d90
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x401000
Capabilities:
Execute command

Disassembly:
push str.start
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
xor eax, eax
ret

Function at 0x401817
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401856
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401856
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401856
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401856
cmp dword [ecx + 0x74], 0xe
jbe 0x401856
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x432002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
mov ecx, 0x2f43325
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data_1
mov ebx, 0x42f314
nop
mov ecx, 0x16335863
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x427e1e
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0x3c244434
xor al, 0xc7
and al, 0x3c
xor al, 0x6c
mov cl, 0x35
xor al, 0xc7
and al, 0x3c
xor al, 0xe5
and al, 0x3c
xor al, 0xac
mov cl, 0x35
xor al, 0xf4
and al, 0x3c
xor al, 0x22
and al, 0x3c
xor al, 0xbc
mov cl, 0x35
xor al, 0x22
and al, 0x3c
xor al, 0x3e
and eax, 0xb1e4343c
xor eax, 0x3c253e34
xor al, 0x5a
and eax, 0xb1f0343c
xor eax, 0x3c255a34
xor al, 0x79
and eax, 0xb1fc343c
xor eax, 0x3c258434
xor al, 0x6d
sub bh, byte [esp + esi]
or byte [ecx + 0x2a6d3435], dh
cmp al, 0x34
xchg esp, eax
sub bh, byte [esp + esi]
push esp
mov bl, 0x35
xor al, 0x94
sub bh, byte [esp + esi]
mov ebx, 0x70343c2a
mov bl, 0x35
xor al, 0xbb
sub bh, byte [esp + esi]
sbb byte [edx], ch
cmp al, 0x34
invalid
Function at 0x572c80
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push edx
push eax
call sub.ws2_32.dll_connect
mov esp, ebp
pop ebp
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
mov ecx, 0x593c0072
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x7c0745e4
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x4023c0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x402868
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov eax, dword [esp + 0x18]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
je 0x402439
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 4]
push 0
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.00402600
mov al, 1
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.00402600
mov ecx, dword [esp + 8]
xor al, al
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x402460
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x402890
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
and ecx, 0xffff
push eax
push ecx
push 0
mov dword [esp + 0x24], 1
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x402509
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x402509
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
je 0x402509
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, ebx
mov esi, eax
mov edx, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
push ebp
rep movsb byte es:[edi], byte [esi]
push ecx
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call sub.MFC42.DLL_CString::CString
call fcn.004023c0
add esp, 0xc
test al, al
push ebp
jne 0x40253d
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 0
call fcn.00402600
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], 0xffffffff
call fcn.00402600
xor al, al
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 0
call fcn.00402600
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], 0xffffffff
call fcn.00402600
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov al, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00431219
Function at 0x4017e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4017f9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x40180d
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x40182e
cmp esi, eax
jae 0x401807
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401820
cmp esi, eax
jae 0x401807
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x407250
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x444f88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov ecx, dword [0x457824]
mov eax, 0x77c150d
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x9ad70599
imul ecx
add edx, ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x457838]
imul edx, edx, 0x1685
sub esi, ecx
mov ecx, dword [0x45781c]
add esi, edx
mov eax, 0xb7fe3405
imul ecx
add edx, ecx
mov ecx, dword [0x457830]
sar edx, 0xc
imul ecx, ecx, 0x10e6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x56db8c]
sub esi, eax
add esi, ecx
mov ecx, 0x56db8c
mov dword [str._r_____r____], esi
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 8], eax
mov ecx, dword [0x45782c]
mov esi, dword [str._r_____r____]
mov eax, 0x9ad70599
imul esi, esi, 0x1a74
imul ecx
add edx, ecx
mov ecx, dword [0x457820]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x77826bf5
imul ecx
mov eax, dword [0x457834]
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x457818]
imul edx, edx, 0x59b
sub esi, ecx
mov ecx, dword [esp + 0x1c]
add esi, edx
sub esi, eax
lea eax, [esp + 0x20]
push eax
push ecx
sub esi, 0x2220
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
mov dword [0x457820], esi
call fcn.00406fc0
mov ecx, dword [0x457820]
mov esi, dword [0x45782c]
mov eax, 0x9ad70599
imul esi, esi, 0x2220
imul ecx
add edx, ecx
sar edx, 0xc
mov edi, edx
add esi, edx
imul ecx, ecx, 0x1643
mov edx, dword [0x457830]
imul edx, edx, 0xe4e
shr edi, 0x1f
add edi, esi
mov esi, dword [esp + 8]
add edi, ecx
mov ecx, dword [0x45781c]
add edi, edx
mov eax, 0xb6adc247
imul ecx
add edx, ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
push esi
mov dword [0x45782c], edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [esi - 0x10]
mov dword [esp + 0x14], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop edi
pop esi
jg 0x4073f1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x40dc60
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
push ebp
push esi
push edi
mov ecx, dword [0x457824]
mov eax, 0x77c150d
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x9ad70599
imul ecx
add edx, ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x457838]
imul edx, edx, 0x1685
sub esi, ecx
mov ecx, dword [0x45781c]
add esi, edx
mov eax, 0xb7fe3405
imul ecx
add edx, ecx
mov ecx, dword [0x457830]
sar edx, 0xc
imul ecx, ecx, 0x10e6
mov eax, edx
shr eax, 0x1f
mov edi, dword [esp + 0x1c]
add eax, edx
lea edx, [esp + 0x10]
sub esi, eax
push edx
add esi, ecx
xor ebp, ebp
push edi
mov dword [esp + 0x18], ebp
mov dword [str._r_____r____], esi
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebp
je 0x40deae
mov ecx, dword [0x457838]
mov eax, 0x77c150d
imul ecx
imul ecx, ecx, 0x1685
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
push ebx
mov ebx, eax
sub ebx, ecx
mov ecx, dword [0x45781c]
mov eax, 0x17eb125
imul ecx
sar edx, 5
mov ecx, edx
add ebx, edx
mov edx, dword [0x457830]
imul edx, edx, 0x10e6
shr ecx, 0x1f
add ecx, ebx
add ecx, edx
sub ecx, dword [str._r_____r____]
add ecx, 0x1123
push esi
mov dword [0x45781c], ecx
call fcn.0043c372
add esp, 4
mov ebx, eax
push ebx
push esi
push ebp
push edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x40dea4
mov ecx, dword [0x45782c]
mov esi, dword [str._r_____r____]
mov eax, 0x17eb125
imul esi, esi, 0x2234
imul ecx
mov ecx, dword [0x457818]
sar edx, 5
imul ecx, ecx, 0x10e6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x457828]
imul edx, edx, 0x59b
sub esi, eax
add ecx, dword [0x457830]
add ecx, esi
lea eax, [edx + ecx - 0x2220]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
push 0x4481f4
push ebx
mov dword [0x457824], eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], ebp
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40de46
mov ecx, dword [0x457828]
mov esi, dword [0x457834]
mov eax, 0x77c150d
imul ecx
sar edx, 8
mov edi, ecx
mov eax, edx
imul edi, edi, 0x2234
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x9ad70599
imul esi
add edx, esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0xb7fe3405
imul ecx
mov eax, dword [esp + 0x10]
add edx, ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x457818]
imul edx, edx, 0x1568
sub edi, ecx
add edi, edx
mov dword [0x457834], edi
mov bp, word [eax + 0x14]
mov ecx, dword [0x457820]
mov esi, dword [0x45782c]
mov eax, 0x9ad70599
imul esi, esi, 0x2220
imul ecx
add edx, ecx
imul ecx, ecx, 0x1643
sar edx, 0xc
mov edi, edx
add esi, edx
shr edi, 0x1f
add edi, esi
add edi, ecx
mov ecx, dword [0x457830]
imul ecx, ecx, 0xe4e
add edi, ecx
mov ecx, dword [0x45781c]
mov eax, 0xb6adc247
imul ecx
add edx, ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov dword [0x45782c], edi
push ebx
call fcn.0043c377
add esp, 4
pop ebx
pop edi
pop esi
mov ax, bp
pop ebp
add esp, 0xc
ret