joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130

Function at 0x401000
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0
nop
mov eax, section..data
push eax
call sub.msvcrt.dll_puts
add esp, 4
mov eax, str.pause
push eax
call sub.msvcrt.dll_system
add esp, 4
leave
ret
Function at 0x4091f2
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 0x67
push dword [0x417f80]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp byte [0x418814], 0
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov dword [ebp - 4], edi
mov ebx, 0xb1
jne 0x409254
mov ecx, dword [0x416ecc]
call fcn.00405993
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xffffffffffffffff
push 0
push ebx
push edi
call esi
push 0x410552
push 0
push 0xc2
push edi
call esi
mov byte [0x418814], 1
mov edi, 0x5f5e100
push edi
push edi
push ebx
push dword [ebp - 4]
call esi
lea eax, [ebp - 0x40]
push eax
push 0
push 0x43a
push dword [ebp - 4]
mov dword [ebp - 0x40], 0x3c
call esi
xor eax, eax
inc eax
cmp byte [ebp + 8], 0
mov byte [ebp - 0x27], 0
mov dword [ebp - 0x3c], eax
je 0x4092a4
mov ecx, dword [ebp - 0x38]
and ecx, 0xbfffffff
or ecx, eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x2c], 0xa0
mov dword [ebp - 0x3c], 0x40000001
lea ecx, [ebp - 0x40]
push ecx
push eax
push 0x444
push dword [ebp - 4]
call esi
push dword [ebp + 0xc]
push 0
push 0xc2
push dword [ebp - 4]
call esi
push edi
push edi
push ebx
push dword [ebp - 4]
call esi
cmp byte [ebp + 8], 0
je 0x4092ee
mov eax, dword [ebp - 0x38]
and eax, 0xfffffffe
or eax, 0x40000000
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x40]
push eax
push 1
push 0x444
push dword [ebp - 4]
call esi
push 0x410588
push 0
push 0xc2
push dword [ebp - 4]
call esi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x409b2a
Capabilities:
Delete file
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
lea eax, [ebp - 0x420]
push eax
push 0x400
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
cmp byte [0x418815], 0
jne 0x409bb9
push 6
push dword [0x41209c]
lea eax, [ebp - 0x420]
push eax
call fcn.004068e9
push eax
call fcn.00408a69
test eax, eax
jne 0x409bb9
push 0x4102f4
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
lea eax, [ebp - 0x420]
push eax
call fcn.00408830
push 0x1e
mov byte [ebp + eax - 0x41f], 0
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.00408786
push 0x14
pop eax
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x420]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x1c], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
leave
ret

Function at 0x409c78
Capabilities:
Delete file
Get common file path
Set current directory

Disassembly:
push ebx
push esi
xor esi, esi
inc esi
xor ebx, ebx
mov dword [0x417f70], esi
cmp dword [0x417f80], ebx
je 0x409ca2
push 0x7d
call fcn.00408670
push eax
push esi
push dword [0x417f80]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov eax, dword [0x417f80]
invalid
invalid
Function at 0x4073e2
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461134], 0
jne 0x407420
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4073f6
mov dword [ecx*4 + 0x461130], eax
inc ecx
cmp ecx, 0x100
jl 0x4073f1
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x40744d
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461130]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x40742e
not eax
pop ebp
ret 0xc

Function at 0x41abcb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x41abda
pop dword [ebp - 0x24]
mov eax, 0x73efeb4e
add eax, 0x8c51c08c
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x3e05c
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x4e3a
mov esi, eax
mov edx, 0x3d1a6e2a
sub edx, 0x3cd7402a
add edx, dword [ebp - 0x24]
mov edi, 0x1291e8a2
add edi, 0xaf0b522
xor dword [ebp - 4], eax
mov ebx, dword [edx]
add dword [ebp - 0x1c], edi
sub ebx, edi
add dword [ebp - 0x20], 0x1f7504a4
mov dword [esi], ebx
xor dword [ebp - 0x10], 0x8535b173
add esi, 0x7082cbf6
sub esi, 0x7082cbf2
add edx, 4
loop 0x41ac2e
add eax, 0x12bbb
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x1005b41
Capabilities:
Parse pe header

Disassembly:
add byte [eax], cl
add byte [ecx], cl
add byte [edx], cl
add byte [ebx], cl
add byte [eax + eax], cl
or eax, 0xf000e00
add byte [eax], dl
add byte [ecx], dl
add byte [edx], dl
add byte [ebx], dl
add byte [eax + eax], dl
adc eax, 0x17001600
add byte [eax], bl
add byte [ecx], bl
add byte [edx], bl
add byte [ebx], bl
add byte [eax + eax], bl
sbb eax, 0x1f001e00
add byte [eax], ah
add byte [ecx], ah
add byte [edx], ah
add byte [ebx], ah
add byte [eax + eax], ah
and eax, 0x27002600
add byte [eax], ch
add byte [ecx], ch
add byte [edx], ch
add byte [ebx], ch
add byte [eax + eax], ch
sub eax, 0x2f002e00
add byte [eax], dh
add byte [ecx], dh
add byte [edx], dh
add byte [ebx], dh
add byte [eax + eax], dh
xor eax, 0x37003600
add byte [eax], bh
add byte [ecx], bh
add byte [edx], bh
add byte [ebx], bh
add byte [eax + eax], bh
cmp eax, 0x3f003e00
add byte [eax], al
inc ecx
add byte [edx], al
inc ebx
add byte [eax + eax + 0x45], al
add byte [esi], al
inc edi
add byte [eax], cl
dec ecx
add byte [edx], cl
dec ebx
add byte [eax + eax + 0x4d], cl
add byte [esi], cl
dec edi
add byte [eax], dl
push ecx
add byte [edx], dl
push ebx
add byte [eax + eax + 0x55], dl
add byte [esi], dl
push edi
add byte [eax], bl
pop ecx
add byte [edx], bl
pop ebx
add byte [eax + eax + 0x5d], bl
add byte [esi], bl
Function at 0x89f693
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x89f6c1
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x89f6b8
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x89f6b0
mov eax, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x89f6e2
mov esp, ebp
pop ebp
ret

Function at 0x89f6e6
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0x10]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x89f752
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x89f77f
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x89f76e
xor ecx, eax
xor edx, ebx
dec edi
jne 0x89f75f
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x89f7a5
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x89f746
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
pop ecx
pop edx
pop edi
pop ebx
pop esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x89f7d1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x46b925
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x46b925
lcall 0x5de5, 0x8b10c483
jmp fcn.013970ac
Function at 0x454dcc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x454cd6
test edi, edi
jmp 0x454dea
mov dl, cl
lea ebx, [ecx - 0x84]
jmp 0x454d11
movzx edx, byte [ebx]
pop ebx
lea ebx, [ebx*4]
call fcn.00454dcc
add al, 0xb7
sahf
jmp 0x8b98f81b
push ebx
mov ebx, eax
add ebx, 1
jmp 0x454cfb
or edx, ebx
mov bl, 0xb3
xor bx, 0xf2bc
mov bx, di
jmp 0x454d64
movzx ebx, byte [eax - 1]
pushfd
mov byte [esp + 2], dh
shl edx, 8
jmp 0x454d39
movzx ebx, byte [eax - 2]
cmc
shl edx, 8
jmp 0x454da4
shl edx, 8
push bx
sub esp, 0x1e
or edx, ebx
jmp 0x454d56
lea esp, [esp + 0x2c]
inc ecx
jmp 0x454db1
or edx, ebx
cmc
mov dword [ebp + ecx*4 - 0x40], edx
sub esp, 4
stc
jmp 0x454d8e
add eax, 4
sub esp, 6
mov word [esp + 2], cx
lea esp, [esp + 2]
jmp 0x454fda
not bx
movzx ebx, byte [eax]
jmp 0x454d82
mov bx, 0x4a5c
lea ebx, [edi*4]
jmp 0x454e24
jne 0x4107ab
lea ebx, [ebx - 0xa4]
mov bh, 0x6a
jmp 0x454dd4
call 0x42b415
xor eax, eax
jmp 0x410828
pop ebx
jmp 0x410743
lea ecx, [esi + 8]
lea eax, [ebp - 0x40]
push ebx
lea esp, [esp + 4]
jmp 0x454e01
lea esp, [esp + 4]
cmp ecx, 0x10
jb 0x4107ed
jmp 0x454e6e

Function at 0x4d8464
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push edi
mov edi, dword [esi]
mov edx, 0xc6ef3720
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x18], edi
mov edi, dword [esi + 4]
mov dword [esp + 0x14], edi
mov edi, dword [esi + 8]
mov esi, dword [esi + 0xc]
mov dword [esp + 0x10], edi
mov dword [esp + 0x24], esi
mov edi, 0x20
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x10]
mov esi, ecx
shr esi, 5
add esi, ebx
mov ebx, ecx
shl ebx, 4
add ebx, ebp
mov ebp, dword [esp + 0x18]
xor esi, ebx
lea ebx, [edx + ecx]
xor esi, ebx
mov ebx, dword [esp + 0x14]
sub eax, esi
mov esi, eax
shr esi, 5
add esi, ebx
mov ebx, eax
shl ebx, 4
add ebx, ebp
xor esi, ebx
lea ebx, [edx + eax]
xor esi, ebx
sub ecx, esi
add edx, 0x61c88647
dec edi
jne 0x4d849d
mov edx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [edx], ecx
mov dword [edx + 4], eax
pop ebx
add esp, 0xc
ret

Function at 0x4dce64
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
mov ecx, 0x10
xor eax, eax
mov edi, ebx
xor esi, esi
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x18]
test edi, edi
jle 0x4dceb0
push ebp
mov ebp, dword [esp + 0x18]
xor eax, eax
lea ecx, [esp + 0x14]
mov al, byte [esi + ebp]
push eax
push 0x6cc0dc
push ecx
call fcn.004c1864
xor dword [ebx + reloc.MSVCR71.dll___p__commode], eax
and al, 0x14
push edx
push ebx
call fcn.006f184a
out 0x46, eax
cmp esi, edi
jl 0x4dce85
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x7047bc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
xor esi, esi
push edi
mov edi, dword [esp + 0x10]
test ebx, ebx
jle 0x4ddcbe
cmp byte [0x6de034], 0x20
jne 0x4ddc93
call fcn.007043be
mov eax, dword [0x6de034]
and eax, 0xff
mov cl, byte [eax + 0x6ddf2c]
mov al, byte [esi + edi]
xor al, cl
mov byte [esi + edi], al
mov dl, byte [0x6de034]
inc dl
inc esi
cmp esi, ebx
mov byte [0x6de034], dl
jl 0x4ddc85
push ebx
push edi
push 0x6dde44
call fcn.004de1a4
add esp, 0xc
pop edi
pop esi
pop ebx
ret
lea esp, [esp + 4]
jmp 0x4ddc74

Function at 0x729758
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 0x21], ah
mov bx, word [esp + 0xb]
xchg bp, bx
pop ebp
rdtsc
mov di, 0xf326
jmp 0x729779
std
mov ah, cl
sub dl, bh
cpuid
bswap esi
jmp 0x72973e
cld
mov dword [esp + 0x16], ebx
pop word [esp + 5]
mov eax, dword [esp + 0x23]
jmp 0x729825
std
mov si, 0xa292
not cx
xchg word [esp + 0xc], ax
rdtsc
cpuid
jmp 0x729763
bts edx, ebx
xchg byte [esp + 0xf], ch
mov dx, 0x42de
mov dx, 0x548
call fcn.007297bb
bsr si, bp
mov eax, dword [esp]
bsr si, di
bts esi, esp
mov ebx, edi
jmp 0x72991f
xchg dh, bh
call fcn.007298e3
pop esp
rol byte [eax + 0x27], cl
sar byte [esi + ebx*8], cl
push edi
invalid
stc
lea ecx, [esp + eax]
mov dx, di
mov ax, word [esp + 3]
xchg bh, al
xchg bh, bl
jmp 0x729877
pop word [esp]
xchg ch, cl
lea ebx, [edx + 0xd9]
lea ebx, [eax*4]
cpuid
bswap eax
jmp 0x72988d
push bp
not si
ror si, 8
pushfd
clc
inc si
jmp 0x7298a9

Function at 0x7299b5
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp + 3], cx
pop ebp
rcl cl, cl
btc edx, ebx
cmp ch, dl
jmp 0x72999f
Function at 0x729c7a
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop edi
rdtsc
pop dword [esp + 7]
push word [esp + 0xd]
push ebp
jmp 0x729ce6
xchg word [esp], di
mov word [esp], dx
mov edi, dword [esp]
xchg byte [esp + 1], cl
pushfd
xchg esi, ebp
jmp 0x729cff
mov edx, eax
bsr di, sp
push dword [esp + 0xf]
lea esi, [edx*4]
add esp, 0x15
rol si, cl
jmp 0x729cc2
setae ah
add esp, 0
push word [esp + 2]
push dword [esp]
pop esi
jmp 0x729e1c
mov esi, esp
lea edx, reloc.MSVCR71.dll___p__commode
rdtsc
call fcn.00729db9
setbe al
mov dword [esp + 4], esp
xchg byte [esp + 0xe], cl
bts ecx, esp
pushfd
jmp 0x729e71
add al, 0xf6
bswap esi
xchg dword [esp + 0xa], ecx
rcl ecx, cl
btc edx, esp
setl ah
jmp 0x729e9c
xchg ah, bl
mov cx, dx
xchg dx, si
bswap ebp
lea edx, [eax + 0xb0]
xchg dx, bp
jmp 0x729e5b
rdtsc
rdtsc
not al
mov bh, 0x51
mov al, dh
mov byte [esp + 0xe], bh
jmp 0x729eea
xchg byte [esp + 0x19], al
cmc
push word [esp + 3]
xchg ebx, esi
mov dword [esp + 0x12], eax
mov edx, dword [esp + 0x17]
jmp 0x729e86
mov word [esp + 2], cx
xchg word [esp], si
cmc
mov dword [esp], ebp
jmp 0x729f22
pop cx
add esp, 0x12
mov word [esp + 6], ax
pop ebx
xchg cx, bx
mov byte [esp + 6], ah
jmp 0x729ed4
lea edi, [edx*4]
stc
mov bp, word [esp + 6]
neg ch
push dword [esp]
mov ax, si
jmp 0x729f3b
mov dword [esp + 1], edi
neg di
mov bx, 0xd0d8
xchg byte [esp + 5], bl
pop word [esp]
mov ax, 0x3b0b
jmp 0x729efe
neg ax
bsr si, bp
setp bh
cmp bh, 0x69
sub esp, 0x19
xchg ecx, esi
jmp 0x729fb8
push dword [esp + 0x15]
mov edi, 0xa3ed9790
pop dword [esp + 4]
sets ah
jmp 0x729fe8
xchg dword [esp + 0x10], eax
cpuid
inc cx
pop si
pop ebx
mov word [esp + 0xf], ax
jmp 0x729f7b
xchg word [esp + 3], dx
not bh
mov ecx, dword [esp + 2]
mov bp, word [esp + 0x22]
push word [esp + 0x14]
lea esi, [esi + edi]
jmp 0x729f91
mov bp, cx
pushal
lea esp, [esp + 7]
mov eax, dword [esp + 0x15]
xchg bx, di
jmp 0x72b1c8
xchg dword [esp + 1], ebp
mov ebx, 0x4b2519d0
inc eax
popal
lea edx, [edi + ebp]
neg si
jmp 0x729fd2
pop bp
not dx
mov ecx, dword [esp + 1]
mov bh, byte [esp + 2]
lea esp, [esp + 7]
mov dx, 0xfc2c
pop dword [esp + 0xc]
xchg edi, eax
clc
lea esp, [esp + 0xc]
mov dword [esp + 4], eax
jmp 0x72aa37
push word [esp + 7]
mov ah, bh
dec edi
lea esi, [ecx + ebp]
cpuid
bsf bx, bp
jmp 0x72af91

Function at 0x729e59
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop edx
cld
sub esp, 0x1b
add esp, 0x1a
mov ax, dx
push word [esp + 0xa]
jmp 0x729e2b
jmp 0x729e41
Function at 0x72a011
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
pop esi
pop word [esp + 4]
pop word [esp + 1]
mov dword [esp], esi
jmp 0x72a03c
not edx
shl ax, cl
xchg byte [esp + 8], ah
jmp 0x729ffb
bswap ecx
mov edx, dword [esp + 3]
pop ax
mov bp, word [esp + 1]
mov edi, dword [esp + 3]
cpuid
jmp 0x72a176
setp ah
lea edi, reloc.MSVCR71.dll___p__commode
mov dx, 0xc361
inc ecx
mov si, 0xbb2
mov dword [esp], ebx
jmp 0x72a01c
xchg byte [esp], dh
sbb esi, 0xeb8366ab
cpuid
mov dl, byte [esp + 1]
jmp 0x72a117
pop ecx
xchg word [esp], ax
mov bp, word [esp]
xchg dx, si
mov ecx, dword [esp]
mov bl, 1
jmp 0x72a074
push dword [esp + 1]
lea esp, [esp + 2]
pop word [esp + 3]
cpuid
lea ebp, [edx + esi]
xchg ebx, edx
jmp 0x72a08a
push dword [esp + 4]
xchg dword [esp + 5], ecx
xchg word [esp + 0x12], dx
jmp 0x72a0ed
mov byte [esp + 1], bh
neg cx
sub esp, 0xf
std
cpuid
inc bl
jmp 0x72a0c6
push dword [esp + 6]
pop word [esp + 6]
mov word [esp + 0xa], sp
pop dword [esp + 3]
bsr edi, esp
mov ecx, 0xdba5a9da
jmp 0x72a144
push word [esp + 1]
xchg ecx, esi
std
mov bx, word [esp + 1]
bsr si, cx
mov dx, word [esp]
jmp 0x72a0dc
push word [esp + 1]
xchg bx, dx
mov bp, 0xd210
neg ebx
bswap esi
jmp 0x72a158
lea esp, [esp + 7]
rdtsc
mov dh, cl
mov word [esp + 4], bx
mov ah, bh
xchg dword [esp], ebp
jmp 0x72a12e
lea esi, [ecx*4]
dec cl
mov edi, 0xe4170fea
mov word [esp + 4], di
pop word [esp + 5]
jmp 0x72a1ff
xchg byte [esp + 2], ch
pop ax
dec edx
lea eax, [ecx + 0x4c]
push word [esp + 1]
push word [esp + 2]
jmp 0x72a0b0
cld
not al
xchg byte [esp + 0xa], dl
mov ah, ch
add esp, 0xc
mov edx, ecx
jmp 0x72a1ce
mov bx, dx
mov edi, esi
push dword [esp + 6]
bsr dx, cx
mov edx, esi
neg ebp
jmp 0x72a18f
lea esi, reloc.MSVCR71.dll___p__commode
mov bl, byte [esp]
mov byte [esp + 6], ah
jmp 0x72a1e4
xchg byte [esp + 4], al
push bp
lea ebx, [ecx*4]
bsf ecx, edx
mov dh, bh
mov ch, cl
jmp 0x72a1b8
mov dx, 0x97a6
lea edi, [edx*4]
push dword [esp + 5]
bt ebp, esp
xchg bx, ax
jmp 0x72a227
cld
not ah
bsr edi, edx
sub cx, ax
mov bl, byte [esp + 9]
lea ebp, [edi + ebp]
jmp 0x72a1a5
sub esp, 9
not dh
pop dword [esp + 0xa]
pop dword [esp + 2]
mov ah, 0xb6
jmp 0x72a297
xchg esi, edi
mov word [esp + 3], dx
mov dx, 0x3b3c
xchg dword [esp], eax
mov word [esp + 3], dx
mov bx, 0xb571
jmp 0x72a211
not ch
push ax
pop word [esp + 8]
pop ax
rdtsc
pop si
jmp 0x72a2c6
bsr bp, ax
xchg si, bx
push word [esp + 1]
not esi
push word [esp + 8]
lea ecx, [ecx + edx]
jmp 0x72a255
ror si, cl
pop dword [esp + 3]
xchg word [esp], ax
mov bh, 0x8a
pop word [esp + 1]
mov word [esp + 3], dx
jmp 0x72a26b
not ax
lea esp, [esp + 1]
mov al, byte [esp]
bts si, ax
jmp 0x72a6d8
xchg dword [esp], edi
mov eax, dword [esp + 1]
mov dword [esp], ebp
mov ebp, ecx
pop bx
xchg dword [esp], eax
jmp 0x72a2b0
cpuid
mov si, 0xcdd
btr eax, eax
inc bh
rdtsc
sub esp, 0x18
jmp 0x72a2f4
lea esp, [esp]
xchg si, dx
std
pop ebp
cmp al, cl
cld
jmp 0x72a30a
push word [esp + 3]
bsr bp, bp
mov esi, ebp
pop bx
mov bl, byte [esp + 1]
lea edx, [esp - 9]
jmp 0x72a37c
Function at 0x72c364
Capabilities:
Access peb ldr_data

Disassembly:
push dword [esp + 2]
lea esp, [esp + 2]
mov dword [esp + 0x1c], edi
lea esp, [esp + 0x1c]
jmp 0x72c3b1
mov eax, dword [eax]
jmp 0x72c397
mov eax, dword [eax + 8]
push eax
jmp 0x72c025
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x72c376

Function at 0x4011c0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [0x43dba0], 0x24e1
mov eax, dword [0x43dba0]
sub eax, 0x24e1
mov dword [0x43dba0], eax
mov ecx, 1
test ecx, ecx
je 0x40126b
mov edx, dword [0x43dba0]
cmp edx, dword [ebp + 0xc]
jb 0x4011f7
jmp 0x40126b
cmp dword [0x43dba0], 0
jne 0x401215
push 0x263
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x401215
xor eax, eax
jmp 0x40126b
mov eax, dword [ebp + 8]
add eax, dword [0x43dba0]
mov ecx, dword [eax]
add ecx, dword [0x43dba0]
mov edx, dword [ebp + 8]
add edx, dword [0x43dba0]
mov dword [edx], ecx
mov dword [ebp - 4], 0x7d06f
mov eax, dword [0x43dba0]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 2]
push edx
mov eax, dword [ebp + 8]
add eax, dword [0x43dba0]
push eax
call fcn.00401270
add esp, 8
mov ecx, dword [0x43dba0]
add ecx, 4
mov dword [0x43dba0], ecx
jmp 0x4011dd
mov esp, ebp
pop ebp
ret

Function at 0x4014d0
Capabilities:
Get common file path
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa00
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x79c], 4
mov dword [ebp - 0x784], 0x80000000
mov dword [ebp - 0x798], 0x20019
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x72c], eax
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x1c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
cmp dword [ebp - 0x1c], 0
jne 0x40152c
xor eax, eax
jmp 0x401908
pushal
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x790], 0x64
mov dword [ebp - 0x28], 0x1f
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x790], 0x64
mov dword [ebp - 0x28], 0x1f
mov dword [ebp - 0x7ec], str.SOFTWAREmmasses
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x790], 0x64
mov dword [ebp - 0x28], 0x1f
call fcn.004014a0
mov edx, 0x43
mov eax, dword [ebp - 0x7ec]
mov word [eax + 0x12], dx
mov ecx, 0x6c
mov edx, dword [ebp - 0x7ec]
mov word [edx + 0x14], cx
lea eax, [ebp - 0x34]
push eax
push 1
push 0
mov ecx, dword [ebp - 0x7ec]
push ecx
push 0x80000002
call dword [0x43dba8]
test eax, eax
je 0x4015f1
xor eax, eax
jmp 0x401908
lea edx, [ebp - 0x34]
push edx
push 1
push 0
push str.clsid083863f1_70de_11d0_bd40_00a0c911ce86instance129d7e40_c10d_11d0_afb9_00aa00b67a42
push 0x80000000
call dword [0x43dba8]
test eax, eax
je 0x401614
xor eax, eax
jmp 0x401908
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
jne 0x40162c
xor eax, eax
jmp 0x401908
push 1
mov eax, dword [0x43dba4]
push eax
call fcn.00401ae0
add esp, 8
mov dword [0x43dbb4], eax
mov ecx, dword [0x43dbb4]
push ecx
jmp 0x45be18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret