joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44c0f0
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push ebx
push esi
mov esi, ecx
mov bh, dl
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne bl
test eax, eax
je 0x44c11f
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x44c11f
and eax, 0xfffffffe
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test bh, bh
je 0x44c141
test bl, bl
je 0x44c13c
push 4
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x44c13c
pop esi
mov al, 1
pop ebx
ret
pop esi
xor al, al
pop ebx
ret
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
pop esi
setne al
pop ebx
ret

Function at 0x44c770
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 8], eax
nop dword [eax + eax]
push 0
push 0x80
push 4
push dword [ebp + 0x14]
push 1
push 0x40000000
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp edi, 0xffffffff
jne 0x44c7de
cmp esi, 0x20
jne 0x44c7de
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
test eax, eax
jne 0x44c7ce
push 1
call ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
cmp eax, 0x3e8
jb 0x44c790
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44c7f0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x4a4ab0
mov esi, ecx
push 0x65
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x44c8a5
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x44c8a5
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x44c8a5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x44c8a5
sub esp, 8
mov dword [ebp - 8], 0
lea ecx, [ebp - 8]
mov dword [ebp - 4], 0
push 0x80
push 2
push 0
push 0x40000000
push dword [ebp + 0xc]
call fcn.0041c970
mov esi, dword [ebp - 8]
test eax, eax
js 0x44c88f
push 0
lea eax, [ebp - 4]
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x44c88b
call fcn.00417040
test eax, eax
js 0x44c88f
mov bl, 1
jmp 0x44c891
xor bl, bl
test esi, esi
je 0x44c89c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44f170
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x485d56
mov eax, dword fs:[0]
push eax
sub esp, 0x454
mov eax, dword [0x4b9070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x424], ecx
mov ebx, dword [ebp + 8]
mov ecx, 4
mov dword [ebp - 0x420], ebx
mov ebx, 0x100
mov eax, ebx
mov dword [ebp - 0x418], 0
mul ecx
test edx, edx
ja 0x44f40b
jb 0x44f1d8
cmp eax, 0xffffffff
ja 0x44f40b
cmp eax, 0x400
jbe 0x44f1f3
push eax
lea ecx, [ebp - 0x418]
call fcn.004271d0
mov eax, dword [ebp - 0x418]
jmp 0x44f1ff
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
lea ecx, [ebp - 0x41c]
mov dword [ebp - 4], 0
push ecx
push 0x400
push eax
call dword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x44f3d0
mov edi, dword [ebp - 0x41c]
cmp edi, 0x400
jne 0x44f319
mov eax, ebx
shr eax, 1
add ebx, eax
cmp ebx, 0x3fffffff
jae 0x44f415
mov eax, dword [ebp - 0x418]
lea esi, [ebx*4]
test eax, eax
jne 0x44f270
cmp esi, 0x400
jbe 0x44f2e3
push esi
lea ecx, [ebp - 0x418]
call fcn.004271d0
jmp 0x44f2ef
lea ecx, [ebp - 0x414]
cmp esi, 0x400
jbe 0x44f2b9
cmp eax, ecx
lea ecx, [ebp - 0x418]
push esi
jne 0x44f2b2
call fcn.004271d0
mov ecx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
push 0x400
push eax
mov edx, esi
call fcn.00416c50
push eax
call fcn.00416e10
add esp, 0xc
jmp 0x44f2ef
call fcn.004271a0
jmp 0x44f2ef
cmp eax, ecx
je 0x44f2e3
push esi
push eax
mov edx, 0x400
lea ecx, [ebp - 0x414]
call fcn.00416c50
push eax
call fcn.00416e10
add esp, 0xc
lea ecx, [ebp - 0x418]
call fcn.00427190
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
lea eax, [ebp - 0x41c]
push eax
push esi
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x44f3d0
mov edi, dword [ebp - 0x41c]
cmp edi, esi
je 0x44f233
shr edi, 2
xor esi, esi
test edi, edi
je 0x44f3c9
nop word [eax + eax]
mov eax, dword [ebp - 0x418]
cmp dword [eax + esi*4], 0
je 0x44f3c0
lea ecx, [ebp - 0x45c]
call fcn.0044ec10
push ecx
mov ecx, dword [ebp - 0x424]
lea eax, [ebp - 0x45c]
mov byte [ebp - 4], 1
push eax
mov eax, dword [ebp - 0x418]
push dword [eax + esi*4]
call fcn.0044eec0
test eax, eax
je 0x44f3b1
mov ecx, dword [ebp - 0x420]
mov ebx, dword [ecx + 4]
cmp ebx, dword [ecx + 8]
jb 0x44f38e
lea eax, [ebx + 1]
push eax
call fcn.0044f560
test al, al
je 0x44f41f
lea ecx, [ebx*8]
sub ecx, ebx
mov ebx, dword [ebp - 0x420]
mov eax, dword [ebx]
lea ecx, [eax + ecx*8]
lea eax, [ebp - 0x45c]
push eax
call fcn.0044f430
inc dword [ebx + 4]
lea ecx, [ebp - 0x45c]
mov byte [ebp - 4], 0
call fcn.0044e8b0
inc esi
cmp esi, edi
jb 0x44f330
mov esi, 1
jmp 0x44f3d2
xor esi, esi
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x44f3eb
lea ecx, [ebp - 0x418]
call fcn.00427190
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045527a
mov esp, ebp
pop ebp
ret 8
push 0x80070216
call fcn.00416dd0
push 0x80004005
call fcn.00416dd0
push 0x8007000e
call fcn.00416dd0
int3
Function at 0x44f430
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x485e83
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4b9070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov al, byte [esi + 0xc]
mov byte [edi + 0xc], al
mov ecx, dword [esi + 0x10]
sub ecx, 0x10
call fcn.0041b750
add eax, 0x10
mov dword [edi + 0x10], eax
mov dword [ebp - 4], 0
mov ecx, dword [esi + 0x14]
sub ecx, 0x10
call fcn.0041b750
add eax, 0x10
mov dword [edi + 0x14], eax
mov byte [ebp - 4], 1
mov ecx, dword [esi + 0x18]
sub ecx, 0x10
call fcn.0041b750
add eax, 0x10
mov dword [edi + 0x18], eax
mov byte [ebp - 4], 2
mov ecx, dword [esi + 0x1c]
sub ecx, 0x10
call fcn.0041b750
add eax, 0x10
mov dword [edi + 0x1c], eax
mov byte [ebp - 4], 3
mov ecx, dword [esi + 0x20]
sub ecx, 0x10
call fcn.0041b750
add eax, 0x10
mov dword [edi + 0x20], eax
mov byte [ebp - 4], 4
mov ecx, dword [esi + 0x24]
sub ecx, 0x10
call fcn.0041b750
add eax, 0x10
mov dword [edi + 0x24], eax
mov byte [ebp - 4], 5
mov ecx, dword [esi + 0x28]
sub ecx, 0x10
call fcn.0041b750
add eax, 0x10
mov dword [edi + 0x28], eax
mov byte [ebp - 4], 6
mov ecx, dword [esi + 0x2c]
sub ecx, 0x10
call fcn.0041b750
add eax, 0x10
mov dword [edi + 0x2c], eax
mov byte [ebp - 4], 7
mov ecx, dword [esi + 0x30]
sub ecx, 0x10
call fcn.0041b750
add eax, 0x10
mov dword [edi + 0x30], eax
mov byte [ebp - 4], 8
mov ecx, dword [esi + 0x34]
sub ecx, 0x10
call fcn.0041b750
add eax, 0x10
mov dword [edi + 0x34], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x44fda0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x485f6e
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4b9070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
call fcn.00452700
mov dword [ebp - 4], 0
lea edi, [ebx + 0xc]
mov dword [ebp - 0x10], edi
lea esi, [edi + 0x1c]
mov dword [ebx], vtable.logog::Node.0
mov dword [ebp - 0x10], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00450f30
mov ecx, edi
mov dword [esi], eax
call fcn.00451df0
mov dword [edi], vtable.logog::LockableNodesType.0
mov byte [ebp - 4], 1
lea edi, [ebx + 0x30]
mov dword [ebp - 0x10], edi
lea esi, [edi + 0x1c]
mov dword [ebp - 0x10], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00450f30
mov ecx, edi
mov dword [esi], eax
call fcn.00451df0
mov dword [edi], vtable.logog::LockableNodesType.0
mov byte [ebp - 4], 2
call fcn.0044fd60
push dword [ebp - 0x14]
mov dword [ebp - 0x10], ebx
lea ecx, [eax + 0x1c]
lea eax, [ebp - 0x10]
push eax
push ecx
lea eax, [ebp - 0x1c]
push eax
call fcn.00451030
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x450520
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x486010
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4b9070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [edi + 0x30]
push eax
lea ecx, [ebp - 0x14]
call fcn.00451eb0
mov dword [ebp - 4], 0
lea ecx, [edi + 0x4c]
mov esi, dword [edi + 0x4c]
push dword [esi + 4]
call fcn.00450c90
mov eax, dword [edi + 0x4c]
lea ecx, [ebp - 0x14]
mov dword [eax + 4], esi
mov eax, dword [edi + 0x4c]
mov dword [eax], esi
mov eax, dword [edi + 0x4c]
mov dword [eax + 8], esi
mov dword [edi + 0x50], 0
call fcn.00451f20
lea eax, [edi + 0xc]
push eax
lea ecx, [ebp - 0x14]
call fcn.00451eb0
mov dword [ebp - 4], 1
lea ecx, [edi + 0x4c]
mov esi, dword [edi + 0x4c]
push dword [esi + 4]
call fcn.00450c90
mov eax, dword [edi + 0x4c]
lea ecx, [ebp - 0x14]
mov dword [eax + 4], esi
mov eax, dword [edi + 0x4c]
mov dword [eax], esi
mov eax, dword [edi + 0x4c]
mov dword [eax + 8], esi
mov dword [edi + 0x50], 0
call fcn.00451f20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x472ed8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00472d4e

Function at 0x475122
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00474d9f
Function at 0x10001b00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, 0x14c
push edi
mov edx, dword [ebx + 0x3c]
lea eax, [ebx + 0x88]
add eax, edx
lea ecx, [ebx + 0x78]
add ecx, edx
cmp word [edx + ebx + 4], si
cmovne ecx, eax
mov eax, dword [ecx]
test eax, eax
je 0x10001c34
cmp dword [ebp + 0x10], 0
lea ecx, [eax + ebx]
mov dword [ebp - 8], ecx
ja 0x10001b7c
mov eax, dword [ebp + 0xc]
jb 0x10001b4b
cmp eax, 0xffff
ja 0x10001b7c
movzx edx, ax
xor eax, eax
sub edx, dword [ecx + 0x10]
sbb eax, eax
test eax, eax
ja 0x10001c34
jb 0x10001b68
cmp edx, dword [ecx + 0x14]
jae 0x10001c34
mov eax, dword [ecx + 0x1c]
pop edi
pop esi
lea eax, [eax + edx*4]
mov eax, dword [eax + ebx]
add eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x24]
mov edx, dword [ecx + 0x20]
add eax, ebx
mov dword [ebp - 0x14], eax
add edx, ebx
xor eax, eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
cmp dword [ecx + 0x18], eax
jbe 0x10001c34
nop word [eax + eax]
mov ecx, dword [edx + eax*4]
add ecx, ebx
mov esi, ecx
mov dword [ebp - 0xc], ecx
lea edx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x10001bb0
mov edi, dword [0x10004048]
sub esi, edx
push 0xeeeeeeee
push 0x7fed7fed
push edi
push 1
push esi
push ecx
call fcn.10002330
push 0xeeeeeeee
push 0x7fed7fed
push edi
push 2
push esi
push dword [ebp - 0xc]
mov ebx, eax
call fcn.10002330
xor ecx, ecx
or ecx, ebx
cmp dword [ebp + 0xc], eax
jne 0x10001bf9
cmp dword [ebp + 0x10], ecx
je 0x10001c10
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [ecx + 0x18]
jae 0x10001c34
mov ebx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
jmp 0x10001ba0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
movzx ecx, word [ecx + eax*2]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
lea eax, [eax + ecx*4]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + ecx]
add eax, ecx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10002330
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x1000238a
shl dword [ebp + 0x10], 8
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
nop word [eax + eax]
mov cl, byte [ecx]
movsx edx, cl
sub cl, 0x61
cmp cl, 0x19
mov ecx, dword [ebp + 0x10]
lea esi, [edx - 0x20]
cmova esi, edx
mov edx, dword [ebp + 0x14]
add ecx, esi
add eax, ebx
xor eax, dword [edx + ecx*4]
mov ecx, ebx
shl ecx, 5
add ecx, 3
add ecx, esi
add ebx, ecx
mov ecx, dword [ebp + 8]
inc ecx
add ebx, eax
mov dword [ebp + 8], ecx
sub edi, 1
jne 0x10002350
pop esi
pop ebx
pop edi
pop ebp
ret 0x18
Function at 0x419a20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.IaDsgWGk
lea edi, [esi - 0x10000]
push edi
or ebp, 0xffffffff
jmp 0x419a42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419a49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419a38
mov eax, 1
add ebx, ebx
jne 0x419a5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419a50
jne 0x419a6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419a50
xor ecx, ecx
sub eax, 3
jb 0x419a80
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419af2
mov ebp, eax
add ebx, ebx
jne 0x419a8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419a98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x419abc
inc ecx
add ebx, ebx
jne 0x419aa8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x419a9d
jne 0x419ab9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419a9d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x419adc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x419acd
jmp 0x419a3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x419adc
add edi, ecx
jmp 0x419a3e
pop esi
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x419b44
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x199f4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x19a74]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x419af9
mov ecx, edi
jns 0x419b28
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19a7c]
or eax, eax
je 0x419b3e
mov dword [ebx], eax
add ebx, 4
jmp 0x419b16
call dword [esi + 0x19a78]
mov ebp, dword [esi + 0x19a80]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x419b78
sub esp, 0xffffff80
jmp section.VHqxTUpa

Function at 0x79d9dc
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x79d9e2
pop ebp
sub ebp, 6
sub ebp, 0x39d9dc
jmp 0x79da40
jmp 0x79da49
mov eax, 0x39d9dc
add eax, ebp
add eax, 0x93
mov ecx, 0x629
mov edx, 0x6204e463
xor byte [eax], dl
inc eax
dec ecx
jne 0x79da60
jmp 0x79da73
add byte [eax], al
add byte [0x97a3bb8], ah
jp 0x79da7d
or dword [ebx], esp
or esp, dword [ebx + 0x73]
arpl word [ebx + 0xb], sp
and ecx, dword [ebx]
arpl word [ebx + 0x63], si
arpl word [ebx], cx
arpl word [edi - 0x6c1d9cb1], bp
dec edi
arpl dx, sp
xchg ebx, eax
aas
jo 0x79da6c
cmp esp, edx
xchg ebx, eax
aas
jo 0x79da72
cmp edx, dword [eax - 0x5d]
xor ebx, dword [esi + esi*8 + 0x6353c3a7]
xor ebp, eax
scasb al, byte es:[edi]
call 0x63dd3a86
arpl dx, sp
mov byte [0x6363639b], al
pushal
scasb al, byte es:[edi]
invalid
Function at 0x414ac0
Capabilities:
Encode data using xor

Disassembly:
hlt
loopne 0x414a69
or ecx, dword [esi]
lea eax, [eax - 0x42650be0]
mov ebp, 0xf6216507
and esi, esi
and esi, esi
out dx, al
mov dword [0x245aaf71], eax
je 0x414b48
arpl word [ebp + 0xf0b3db6], si
adc byte [edi - 0x7f755f8f], 0x5b
invalid
je 0x414b95
or esp, dword [ebp - 0x75]
xor ah, 0x9a
je 0x414b9d
or esp, dword [ebp + 0x74]
jg 0x414b2e
je 0x414ba5
or esp, dword [ebp + 0x74]
jg 0x414ab3
mov dword [eax - 0x48], esi
cmovno ebx, dword [eax + 0x7d6549d7]
test byte [ebp + ecx + 0x74], al
cmovp esp, dword [ebp + 0x3a]
cmp byte [ebx - 0x72ba0943], dh
fidivr word [ebx + 0x5d206b2e]
pop ebp
or byte [ebp - 0x24], 0x74
outsd dx, dword [esi]
dec ebx
cmc
mov eax, 0x7f74650a
mov cl, byte [ebx - 0x78fcf663]
cmc
xchg ecx, eax
or ah, byte [ebp + 0x74]
jg 0x414b14
inc ebp
aas
or esp, esp
wait
ffree st(7)
push ecx
push eax
jle 0x414b63
lea ebx, [edi + 0x7f]
or esp, dword [ebp - 0x31]
push ebp
mov si, 0x26b1
and dl, byte [ebx - 0x19d09401]
mov al, 0x7b
mov ah, byte [edx + 0x253c4ff4]
pushfd
insd dword es:[edi], dx
or esp, dword [ebp + 0x74]
jle 0x414b84
hlt
insb byte es:[edi], dx
cmp dword [esi - 0xc], 0xffffffac
aas
push esi
aam 0xa7
js 0x414c19
and dl, byte [ebx + 0x5440887d]
mov byte [eax + 0x54], al
jne 0x414b63
hlt
mov esp, 0x7f70a48a
or esp, dword [ebp + 0x55]
test byte [esi + edi - 0xb], bl
nop
ljmp 0x1b4
aad 0x51
mov ecx, 0xb951d512
adc dl, ch
push ecx
mov ecx, 0xb951d512
adc dl, ch
push ecx
mov ecx, 0xb951d512
adc dl, ch
push ecx
mov ecx, 0xb951d512
adc dl, ch
push ecx
mov ecx, 0xb951d512
adc dl, ch
push ecx
mov ecx, 0xb951d512
adc dl, ch
push ecx
mov ecx, 0xb951d512
adc dl, ch
push ecx
mov ecx, 0xb951d512
adc dl, ch
push ecx
mov ecx, 0xb951d512
adc dl, ch
push ecx
mov ecx, 0xb951d512
adc dl, ch
push ecx
mov ecx, 0xb951d512
adc dl, ch
push ecx
mov ecx, 0xb951d512
adc dl, ch
push ecx
mov ecx, 0xb951d512
adc dl, ch
push ecx
mov ecx, 0xb951d512
adc dl, ch
push ecx
mov ecx, 0xb951d512
adc dl, ch
push ecx
mov ecx, 0xb951d512
adc dl, ch
push ecx
mov ecx, 0xb951d512
adc dl, ch
push ecx
mov ecx, 0xb951d512
adc dl, ch
push ecx
mov ecx, 0xb951d512
adc dl, ch
push ecx
mov ecx, 0xb951d512
adc dl, ch
push ecx
mov ecx, 0xb951d512
adc dl, ch
push ecx
mov ecx, 0xb951d512
adc dl, ch
push ecx
mov ecx, 0xb951d512
adc dl, ch
push ecx
mov ecx, 0xb951d512
adc dl, ch
push ecx
mov ecx, 0xb951d512
adc dl, ch
push ecx
mov ecx, 0xb951d512
adc dl, ch
push ecx
mov ecx, 0xb951d512
adc dl, ch
push ecx
mov ecx, 0xb951d512
adc dl, ch
push ecx
mov ecx, 0xb951d512
adc dl, ch
push ecx
mov ecx, 0xb951d512
adc dl, ch
push ecx
mov ecx, 0xb951d512
adc dl, ch
push ecx
mov ecx, 0x143aad12
mov dword [ebx - 0x5a7de0c6], ebp
xor eax, edx
xor eax, edi
test eax, 0xc610f945
add ebx, ebp
jne 0x414cdb
ret 0xf831
Function at 0x494520
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.sect_1
lea edi, [esi - 0x5b000]
push edi
or ebp, 0xffffffff
jmp 0x494542
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x494549
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x494538
mov eax, 1
add ebx, ebx
jne 0x49455b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x49456c
jne 0x49457c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49457c
dec eax
add ebx, ebx
jne 0x494578
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x494550
xor ecx, ecx
sub eax, 3
jb 0x494594
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x494606
sar eax, 1
mov ebp, eax
jmp 0x49459f
add ebx, ebx
jne 0x49459f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4945ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4945d0
inc ecx
add ebx, ebx
jne 0x4945bc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4945b1
jne 0x4945cd
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4945b1
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4945f0
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4945e1
jmp 0x49453e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4945f0
add edi, ecx
jmp 0x49453e
pop esi
mov edi, esi
mov ecx, 0x645
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x49460e
cmp byte [edi], 0x1a
jne 0x49460e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x494613
lea edi, [esi + 0x92000]
mov eax, dword [edi]
or eax, eax
je 0x49468b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x95454]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x95490]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x494640
mov ecx, edi
jns 0x49466f
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x95494]
or eax, eax
je 0x494685
mov dword [ebx], eax
add ebx, 4
jmp 0x49465d
call dword [esi + 0x95498]
popal
jmp 0x402d50

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4025e6
Capabilities:
Query environment variable

Disassembly:
mov dword [0x40bb96], 0
push 0x40b64f
call fcn.004028d6
je 0x4027a7
or dword [0x40bb96], 1
call fcn.004027d2
je 0x402769
jb 0x402762
or dword [0x40bb96], 2
mov eax, 0x40b54b
cmp byte [eax], 0
jne 0x40277f
or dword [0x40bb96], 0x20
push 0x40b64f
push 0x40b753
call sub.KERNEL32.dll_lstrcpy
call fcn.004028a0
jne 0x402769
or dword [0x40bb96], 0x10
push 0x40b64f
push 0x40b753
call sub.KERNEL32.dll_lstrcpy
push 0x40b9c3
push 0x40b753
call sub.KERNEL32.dll_lstrcat
call fcn.004028a0
jne 0x402769
or dword [0x40bb96], 4
push 0x100
push 0x40b753
push str.APPDATA
call sub.KERNEL32.dll_GetEnvironmentVariableA
cmp eax, 0
je 0x4026f0
push 0x40bc4a
push 0x40b753
call sub.KERNEL32.dll_lstrcat
push 0x40b1c5
push 0x40b753
call sub.KERNEL32.dll_lstrcat
push 0x40bc4a
push 0x40b753
call sub.KERNEL32.dll_lstrcat
push str.HEAT_DESIGNER
push 0x40b753
call sub.KERNEL32.dll_lstrcat
push 0x40b9c3
push 0x40b753
call sub.KERNEL32.dll_lstrcat
call fcn.004028a0
jne 0x402769
or dword [0x40bb96], 8
push 0x100
push 0x40b753
push str.ALLUSERSPROFILE
call sub.KERNEL32.dll_GetEnvironmentVariableA
cmp eax, 0
je 0x402762
push 0x40bc4a
push 0x40b753
call sub.KERNEL32.dll_lstrcat
push 0x40b1c5
push 0x40b753
call sub.KERNEL32.dll_lstrcat
push 0x40bc4a
push 0x40b753
call sub.KERNEL32.dll_lstrcat
push str.HEAT_DESIGNER
push 0x40b753
call sub.KERNEL32.dll_lstrcat
push 0x40b9c3
push 0x40b753
call sub.KERNEL32.dll_lstrcat
call fcn.004028a0
jne 0x402769
mov eax, 0
clc
ret
push 0x40b753
push 0x40b54b
call sub.KERNEL32.dll_lstrcpy
mov eax, 1
clc
ret
push 0x40b9cc
push 0x40b54b
call sub.KERNEL32.dll_FindFirstFileA
cmp eax, 0xffffffff
je 0x402762
mov ecx, 0x40bb80
cmp dword [ecx], 0
je 0x4027a0
push eax
call dword [ecx]
mov eax, 1
clc
ret
mov eax, 0xff
stc
ret

Function at 0x402a14
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c144]
jne 0x402a1e
repz ret
jmp fcn.0040318e