joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a2b41
Capabilities:
Encode data using xor

Disassembly:
inc edi
stosb byte es:[edi], al
leave
salc
xor eax, 0x2d654b4f
test eax, 0xe827e621
lea esp, [edx]
sbb eax, 0x82196a7b
sub esp, esi
out 0x27, al
call 0x7b674de0
push 0x19
sub byte [ecx], 0xf4
push 0x686c2807
push eax
xor dword [ecx - 0x22], eax
das
mov dword [eax + 0x34ff3e1c], ebx
insd dword es:[edi], dx
movsb byte es:[edi], byte [esi]
inc edi
mov edi, 0x9694c86c
adc byte [ebx - 0x4f], bh
rcl byte [edi + 3]
jl 0x4a2b4c
loop 0x4a2bd3
xor cl, byte [edx]
fadd st(0), st(0)
jns 0x4a2b55
sub eax, ebx
movsd dword es:[edi], dword [esi]
add al, 0xb2
movsb byte es:[edi], byte [esi]
push ss
invalid
rcl ch, 0xec
mov edi, 0x409760d
mul dword [esp + ebx - 0x18]
aam 0x17
sub dh, dl
test eax, 0xd48017c
fdivrp st(5)
sbb ch, byte [ebp + 0x7f5c9389]
out dx, al
cmc
call [ebp + ebp*4 + 0x6b]
jne 0x4a2c6d
mov esi, 0x67d42346
push edi
adc al, 0x1c
mul byte [esi]
xor esp, dword [0x4cd2e99]
push ebp
push edx
sbb bh, byte [edi]
rol edx, cl
mov ebx, 0x62253f95
and eax, 0xf5108062
adc al, 8
imul eax, dword [esi - 0x64dd46f7], 0xc394f16e
sahf
lodsb al, byte [esi]
pop edx
js 0x4a2c95
ret
and al, byte [ebx + 0x79]
out 0x24, eax
jle 0x4a2c7d
sti
fnsave dword [ebp + 0x1fc38360]
and edx, dword [ecx + 0x22b9b8f9]
fisub dword [edi + 0x58]
mov eax, 0x67da22b9
pop eax
jnp 0x4a2c3a
xor byte [eax - 0x4e], al
ficomp word [0x3690f984]
xchg esp, eax
jecxz 0x4a2c22
or al, 0x7b
std
pop ebp
fsubr dword [eax + 0x2c]
insb byte es:[edi], dx
mov bl, 0x62
int1
cmp al, ch
mov ah, 0x1f
xchg edx, eax
pop ecx
invalid
invalid
mov ebp, 0xd6c39861
xchg ebx, eax
mov byte [0x5fc8343a], al
push eax
xchg byte [edi], ch
mov word [esi + 0xb], cs
mov dl, byte [ebp - 0x53]
bound ecx, qword [edx - 0x5f]
mov eax, dword [0xbfd7e926]
enter 0x6c0, 0xffffffffffffffba
or al, 0x60
leave
call dword [eax - 0x28]
cli
aas
mov dh, 0xc7
pop ebp
sti
test al, 0x12
adc dword [0x4de64142], eax
fist word [ebx + 0x539c1565]
or esi, ebx
add cl, byte [eax - 0x38c01348]
cdq
aad 0x3f
adc ah, ah
in eax, 0x83
mov edx, 0x734e903a
mov bl, 0x82
fldcw word [eax + ecx*8 - 0x57]
stc
push ebp
pop edx
mov byte [edx + eax*8 - 0x997f1bf], bl
sbb dword [edx - 0x26080b35], edi
mov ch, byte [edx - 0x69]
push cs
mov al, byte [0x28add8d5]
out dx, al
cmp byte [edi + 0x7f], bh
popfd
xor cl, byte [eax]
adc byte [ebx + eax*8 + 0x39], dh
sub al, byte [eax]
jg 0x4a2ce1
hlt
or byte [eax], dl
je 0x4a2cba
cmp dword [edx], ebp
add byte [edi - 0x1b], bh
popfd
adc esi, eax
sub byte [ecx - 0x57f8092], al
fbld tbyte [edx - 0xe2c1e3e]
mov ecx, 0x5f92e582
jp 0x4a2d49
idiv dword [ebx*2 - 0x5a7777dd]
lodsd eax, dword [esi]
sbb byte [ebp + eax*2 - 0x41], 0x7e
push esp
cwde
cmpsb byte cs:[esi], byte es:[edi]
sbb esp, dword [edx]
fidiv word [eax - 0x62f73810]
inc ebx
mov ss, esp
dec esi
xor dl, byte [edx + 0xe]
sub ebp, dword [eax - 0x2393c202]
inc esi
sbb dword [ebx + ebp*2 - 1], esp
in al, dx
dec eax
xchg edi, eax
in eax, 0xe2
and eax, 0x8f6501a1
dec eax
js 0x4a2cf3
sti
invalid
Function at 0x4a2c12
Capabilities:
Encode data using xor

Disassembly:
inc edi
stosb byte es:[edi], al
leave
salc
xor eax, 0x2d654b4f
test eax, 0xe827e621
lea esp, [edx]
sbb eax, 0x82196a7b
sub esp, esi
out 0x27, al
call 0x7b674de0
push 0x19
sub byte [ecx], 0xf4
push 0x686c2807
push eax
xor dword [ecx - 0x22], eax
das
mov dword [eax + 0x34ff3e1c], ebx
insd dword es:[edi], dx
movsb byte es:[edi], byte [esi]
inc edi
mov edi, 0x9694c86c
adc byte [ebx - 0x4f], bh
rcl byte [edi + 3]
jl 0x4a2b4c
loop 0x4a2bd3
xor cl, byte [edx]
fadd st(0), st(0)
jns 0x4a2b55
sub eax, ebx
movsd dword es:[edi], dword [esi]
add al, 0xb2
movsb byte es:[edi], byte [esi]
push ss
invalid
rcl ch, 0xec
mov edi, 0x409760d
mul dword [esp + ebx - 0x18]
aam 0x17
sub dh, dl
test eax, 0xd48017c
fdivrp st(5)
sbb ch, byte [ebp + 0x7f5c9389]
out dx, al
cmc
call [ebp + ebp*4 + 0x6b]
jne 0x4a2c6d
mov esi, 0x67d42346
push edi
adc al, 0x1c
mul byte [esi]
xor esp, dword [0x4cd2e99]
push ebp
push edx
sbb bh, byte [edi]
rol edx, cl
mov ebx, 0x62253f95
and eax, 0xf5108062
adc al, 8
imul eax, dword [esi - 0x64dd46f7], 0xc394f16e
sahf
lodsb al, byte [esi]
pop edx
js 0x4a2c95
ret
and al, byte [ebx + 0x79]
out 0x24, eax
jle 0x4a2c7d
sti
fnsave dword [ebp + 0x1fc38360]
and edx, dword [ecx + 0x22b9b8f9]
fisub dword [edi + 0x58]
mov eax, 0x67da22b9
pop eax
jnp 0x4a2c3a
xor byte [eax - 0x4e], al
ficomp word [0x3690f984]
xchg esp, eax
jecxz 0x4a2c22
or al, 0x7b
std
pop ebp
fsubr dword [eax + 0x2c]
insb byte es:[edi], dx
mov bl, 0x62
int1
cmp al, ch
mov ah, 0x1f
xchg edx, eax
pop ecx
invalid
invalid
mov ebp, 0xd6c39861
xchg ebx, eax
mov byte [0x5fc8343a], al
push eax
xchg byte [edi], ch
mov word [esi + 0xb], cs
mov dl, byte [ebp - 0x53]
bound ecx, qword [edx - 0x5f]
mov eax, dword [0xbfd7e926]
enter 0x6c0, 0xffffffffffffffba
or al, 0x60
leave
call dword [eax - 0x28]
cli
aas
mov dh, 0xc7
pop ebp
sti
test al, 0x12
adc dword [0x4de64142], eax
fist word [ebx + 0x539c1565]
or esi, ebx
add cl, byte [eax - 0x38c01348]
cdq
aad 0x3f
adc ah, ah
in eax, 0x83
mov edx, 0x734e903a
mov bl, 0x82
fldcw word [eax + ecx*8 - 0x57]
stc
push ebp
pop edx
mov byte [edx + eax*8 - 0x997f1bf], bl
sbb dword [edx - 0x26080b35], edi
mov ch, byte [edx - 0x69]
push cs
mov al, byte [0x28add8d5]
out dx, al
cmp byte [edi + 0x7f], bh
popfd
xor cl, byte [eax]
adc byte [ebx + eax*8 + 0x39], dh
sub al, byte [eax]
jg 0x4a2ce1
hlt
or byte [eax], dl
je 0x4a2cba
cmp dword [edx], ebp
add byte [edi - 0x1b], bh
popfd
adc esi, eax
sub byte [ecx - 0x57f8092], al
fbld tbyte [edx - 0xe2c1e3e]
mov ecx, 0x5f92e582
jp 0x4a2d49
idiv dword [ebx*2 - 0x5a7777dd]
lodsd eax, dword [esi]
sbb byte [ebp + eax*2 - 0x41], 0x7e
push esp
cwde
cmpsb byte cs:[esi], byte es:[edi]
sbb esp, dword [edx]
fidiv word [eax - 0x62f73810]
inc ebx
mov ss, esp
dec esi
xor dl, byte [edx + 0xe]
sub ebp, dword [eax - 0x2393c202]
inc esi
sbb dword [ebx + ebp*2 - 1], esp
in al, dx
dec eax
xchg edi, eax
in eax, 0xe2
and eax, 0x8f6501a1
dec eax
js 0x4a2cf3
sti
invalid
Function at 0x4b454b
Capabilities:
Encode data using xor

Disassembly:
sbb eax, 0xaf0cacd4
invalid
mov cs, word [eax + ecx*8]
and ebp, dword [ecx + 0x520c700]
jne 0x4b447e
mov al, byte [0x4f13e714]
pop edx
inc eax
and al, 0xa0
imul edi, esp, 3
pop ds
sub al, 0x14
js 0x4b4490
add eax, 0x6e59e949
xchg esp, eax
fcomp dword es:[0x8de98b04]
test al, bh
stc
wait
push ebx
cmp eax, 0x6e899050
pop eax
mov byte [ecx], al
and edx, edi
adc byte [0xeb405141], bl
test al, 0x81
stosb byte es:[edi], al
push eax
mov ebp, 0x3d04edd4
jmp 0x99ba29dc
js 0x4b44cf
popal
movsd dword es:[edi], dword [esi]
invalid

Function at 0x4f64e1
Capabilities:
Encode data using xor

Disassembly:
fsubr qword [ebp + 0x27e603cb]
pop esp
mov ebx, 0x18a2fc2b
add eax, 0xc40822b3
lea edx, [eax - 4]
wait
cmp eax, 0xaa4162ad
xchg ecx, eax
mov dword [edi + 0x64bd46c3], eax
pop ebp
call 0xa8c577d5
adc ah, bh
mov dword [edi], ecx
neg cl
xchg ebp, eax
push 7
invalid
or byte [eax + 0x1095ce36], al
dec esi
mov dh, 0x8b
jge 0x4f645c
inc ecx
xchg esp, eax
xchg esp, eax
loop 0x4f64e0
push ebx
int1
fldenv [eax]
fild dword [edx + 0x41]
pop esi
or dword [ebx + 0x26], ebp
sub al, 0xc4
out dx, al
mov eax, 0x3d39a026
lcall 0x40a8, 0x1f65213e
pop ds
test al, 0x40
and dword [ebp + 0x1f], esp
pop ds
test al, 0x40
push edi
lodsb al, byte [esi]
xchg ebx, eax
mov bh, byte [ebx + 0x995786e]
jne 0x4f6552
fmul dword [ebx]
adc byte [ebp - 0x1a59f7f3], cl
add al, 0x5e
add dword [ecx + 0x3e], edx
xlatb
int1
pop esi
xchg ebp, eax
mov bl, 0x2e
adc ch, byte [edx + 0x540bd840]
pushfd
bound ebp, qword [ebx + 0x239f9887]
enter 0xfffffffffffff256, 0x77
mov dword [eax + 0x69], 0x5e44e75f
sbb ecx, dword [ebp + 0x44]
pop edx
mov ebp, 0xbae99109
xchg ebp, eax
aaa
js 0x4f64bb
push cs
fisttp dword [edx]
invalid
lea esi, [ebx - 0x11]
pop ds
jo 0x4f6571
sbb ebp, dword [edx + 0x2af3caef]
lock or dword [edi - 0x3adf21a3], 0x3bcafe50
lea ebp, [0x92057c67]
lds edx, [ebx + eax*4]
sbb byte [esi], ah
lds edx, [eax - 2]
retf 0x8d3b
sbb dword [eax], 0x26
mov byte [0xa02d68a5], al
clc
push eax
and eax, dword [ebx - 0x5691106b]
rcl byte [edx - 0x562daa23], 0xe4
fadd dword [edi + 0x7a]
scasd eax, dword es:[edi]
cmp bl, byte [esi + 9]
sbb esp, 0x4f
pop edi
jns 0x4f6564
aam 0x78
mov eax, dword [0x1623a42c]
mov esp, dword [edx - 0x70]
mov edi, 0xba256014
xor al, 0x1f
cli
aas
das
invalid

Function at 0x5285e2
Capabilities:
Encode data using xor

Disassembly:
lea edx, [esp + ebx*4 + 0x3e]
mov ecx, esi
mov bh, byte [ecx - 0x39b82c3]
xchg ecx, edx
sbb al, 0x70
not byte [edi]
mov byte ds:[eax + ebp*4 + 0x1a17254e], al
adc bh, byte [ebx + 0x59]
adc ebp, dword [edx]
invalid
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x433072
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x41561889
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x37546248
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x10874058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x108741a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1087407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1087406a
add dl, dl
jne 0x10874089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x108740dc
xor eax, eax
add dl, dl
jne 0x10874096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1087417d
add dl, dl
jne 0x108740a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x108740b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x108740bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x108740c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x108740d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10874075
mov eax, 1
add dl, dl
jne 0x108740ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x108740f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x108740e1
sub eax, ebx
mov ebx, 1
jne 0x10874128
mov ecx, 1
add dl, dl
jne 0x1087410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10874119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10874105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10874075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1087413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1087414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10874136
cmp eax, 0x7d00
jae 0x1087416d
cmp eax, 0x500
jb 0x10874168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10874075
cmp eax, 0x7f
ja 0x10874170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10874075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1087419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10874075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4037d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], ecx
push 0x10
push 0
push 0x4651f0
call fcn.00408490
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.00404240
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x403806
xor al, al
jmp 0x4038f4
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.00402620
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40382d
xor al, al
jmp 0x4038f4
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
call fcn.00402ac0
test eax, eax
jne 0x403844
xor al, al
jmp 0x4038f4
mov ecx, dword [ebp - 4]
call fcn.00402870
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40386b
push 0
mov ecx, dword [0x4651f0]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor al, al
jmp 0x4038f4
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
call fcn.004031b0
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.004042a0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4038a3
push 0
mov edx, dword [0x4651f0]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor al, al
jmp 0x4038f4
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 4]
call fcn.00403680
movzx edx, al
test edx, edx
jne 0x4038ca
xor al, al
jmp 0x4038f4
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
call fcn.004026b0
movzx ecx, al
test ecx, ecx
jne 0x4038f2
push 0
mov edx, dword [0x4651f0]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor al, al
jmp 0x4038f4
mov al, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x40cb3d
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x463090]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0040aac2
mov dword [ebp - 0x14], eax
cmp dword [0x4650fc], edi
jne 0x40cc2e
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x40cbbb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40cd0e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x40cd0e
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40cd0e
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x4650fc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x465100], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x465104], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x46510c], eax
test eax, eax
je 0x40cc2b
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x465108], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40cc53
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40cc46
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x40cc68
push 4
pop eax
jmp 0x40cd10
cmp dword [ebp - 0x14], edi
je 0x40cc68
push dword [0x4650fc]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40cc4d
mov eax, dword [0x465108]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x40ccc6
cmp dword [0x46510c], esi
je 0x40ccc6
push eax
call ebx
push dword [0x46510c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40ccc6
test eax, eax
je 0x40ccc6
call ecx
test eax, eax
je 0x40ccbb
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40ccbb
test byte [ebp - 8], 1
jne 0x40ccc6
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x40ccf6
mov eax, dword [0x465100]
cmp eax, esi
je 0x40ccf3
push eax
call ebx
test eax, eax
je 0x40ccf3
call eax
mov edi, eax
test edi, edi
je 0x40ccf3
mov eax, dword [0x465104]
cmp eax, esi
je 0x40ccf3
push eax
call ebx
test eax, eax
je 0x40ccf3
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x4650fc]
call ebx
test eax, eax
je 0x40cd0e
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x40cd10
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406bf9
leave
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x401070
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [ecx + 0x50]
test eax, eax
jne 0x40107d
mov eax, 2
ret
jmp fcn.0043ccf0

Function at 0x403930
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
sub esp, 0x108
push str.compress.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x403954
push str.compress.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x403960
mov eax, 1
add esp, 0x108
ret
push ebx
call fcn.00459080
mov eax, dword [eax + 0xc]
push 0x46001c
push 0x91
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
jne 0x40398a
xor eax, eax
pop ebx
add esp, 0x108
ret
call fcn.00459080
mov eax, dword [eax + 0xc]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x403980
push ebp
push edi
push eax
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x403a5b
call fcn.00459080
mov eax, dword [eax + 4]
mov ecx, dword [eax + 0x8c]
lea edx, [esp + 0x10]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x4039c5
lea eax, [esp + 0x10]
push 0x5c
push eax
call fcn.0042dae0
add esp, 8
test eax, eax
je 0x403a5b
mov ecx, str.compress.dll
lea edx, [eax + 1]
sub edx, ecx
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x4039f0
push esi
push 0
push pe_nt_image_headers32
push 1
push 0
push 2
push 0x1f01ff
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x403a5a
call fcn.00459080
mov eax, dword [eax + 0xc]
push 0
lea edx, [esp + 0x14]
push edx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x403a5a
mov ebp, 1
pop esi
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x108
ret

Function at 0x403af0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
test esi, esi
je 0x403b26
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0
lea eax, [esp + 0x14]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403b1b
cmp dword [esp + 0x10], esi
je 0x403b26
push 0
push 0xffffffffffffffff
push 1
call fcn.00443f90
pop esi
ret 0xc

Function at 0x403b70
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
test esi, esi
je 0x403bae
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0
lea eax, [esp + 0x14]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403ba3
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x403bae
cmp dword [esp + 0x10], esi
je 0x403bae
push 0
push 0xffffffffffffffff
push 1
call fcn.00443f90
pop esi
ret 0x10