joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404710
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
push 0
push 0
push esi
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp + 8]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x404730
push ebx
sub eax, ecx
lea ebx, [eax + 1]
push edi
push ebx
mov dword [ebp - 8], eax
call dword [sym.imp.MSVCR90.dll_malloc]
push ebx
mov edi, eax
push 0
push edi
call sub.MSVCR90.dll_memset
mov ecx, dword [ebp - 8]
add esp, 0x10
xor ebx, ebx
push ebx
lea eax, [ebp - 4]
push eax
push ecx
push edi
push esi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4048a0
mov edx, dword [ebp - 8]
cmp dword [ebp - 4], edx
jne 0x4048a0
mov eax, dword [ebp + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
push 0
push 0
test eax, eax
je 0x4047c5
inc ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [ebp - 8]
push 0
lea ecx, [ebp - 4]
push ecx
push edx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x404774
push edi
call dword [sym.imp.MSVCR90.dll_free]
mov eax, dword [ebp - 0xc]
add esp, 4
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
xor eax, eax
push esi
mov dword [ebp - 0xc], 1
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea ecx, [ebp - 4]
push ecx
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x404831
lea ecx, [ecx]
cmp dword [ebp - 4], 1
jne 0x404831
push 0x450d10
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x404829
push 0
push 0
inc ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [ebp - 4]
push edx
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4047f0
jmp 0x404831
mov ecx, dword [ebp + 0xc]
lea eax, [ebx + 1]
mov dword [ecx], eax
push 0
push 0
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [ebp - 4]
push edx
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4048a0
cmp dword [ebp - 4], 1
jne 0x4048a0
push 0x450d14
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x40489b
push 0
push 0
inc ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 4]
push eax
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x404851
push edi
call dword [sym.imp.MSVCR90.dll_free]
mov eax, dword [ebp - 0xc]
add esp, 4
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x10]
mov dword [ecx], ebx
push edi
call dword [sym.imp.MSVCR90.dll_free]
mov eax, dword [ebp - 0xc]
add esp, 4
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4048c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, eax
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
xor ebx, ebx
push edx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
call fcn.00404710
add esp, 0xc
test eax, eax
je 0x4049eb
push edi
mov edi, dword [ebp - 0x10]
push ebx
push ebx
xor eax, eax
push edi
mov byte [ebp - 4], bl
mov dword [ebp - 8], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
mov word [ebp - 3], ax
mov byte [ebp - 1], al
call ebx
push 0
lea eax, [ebp - 0x10]
push eax
push 3
lea ecx, [ebp - 4]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4049ea
cmp edi, dword [ebp - 0xc]
jge 0x4049ea
mov edx, dword [ebp + 0xc]
jmp loc.004c6270
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408580
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xcc
push ebx
mov ebx, ecx
cmp dword [ebx + 0x2be3c], 1
jne 0x4085ee
fld dword [ebx + 0x2bb68]
lea ecx, [ebx + 0x2bb74]
fstp dword [esp + 8]
mov edx, 7
fld dword [ebx + 0x2bb68]
fstp dword [esp + 0xc]
fld dword [esp + 8]
fld dword [ecx]
fcompp
fnstsw ax
test ah, 0x41
je 0x4085cc
fld dword [ecx]
fstp dword [esp + 8]
fld dword [esp + 0xc]
fld dword [ecx]
fcompp
fnstsw ax
test ah, 5
jnp 0x4085e1
fld dword [ecx]
fstp dword [esp + 0xc]
add ecx, 0xc
sub edx, 1
jne 0x4085b7
jmp 0x4086b0
fld dword [ebx + 0x2bb38]
fstp dword [esp + 8]
fld dword [esp + 8]
fld dword [ebx + 0x2bb44]
fcompp
fnstsw ax
test ah, 0x41
je 0x408615
fld dword [ebx + 0x2bb44]
fstp dword [esp + 8]
fld dword [esp + 8]
fld dword [ebx + 0x2bb50]
fcompp
fnstsw ax
test ah, 0x41
je 0x408632
fld dword [ebx + 0x2bb50]
fstp dword [esp + 8]
fld dword [esp + 8]
fld dword [ebx + 0x2bb5c]
fcompp
fnstsw ax
test ah, 0x41
je 0x40864f
fld dword [ebx + 0x2bb5c]
fstp dword [esp + 8]
fld dword [ebx + 0x2bb38]
fstp dword [esp + 0xc]
fld dword [esp + 0xc]
fld dword [ebx + 0x2bb44]
fcompp
fnstsw ax
test ah, 5
jnp 0x408676
jmp 0x4c3c28
fld dword [esp + 0xc]
fld dword [ebx + 0x2bb50]
fcompp
fnstsw ax
test ah, 5
jnp 0x408693
fld dword [ebx + 0x2bb50]
fstp dword [esp + 0xc]
fld dword [esp + 0xc]
fld dword [ebx + 0x2bb5c]
fcompp
fnstsw ax
test ah, 5
jnp 0x4086b0
fld dword [ebx + 0x2bb5c]
fstp dword [esp + 0xc]
fld dword [esp + 8]
sub esp, 0x10
fmul qword [0x451760]
lea eax, [esp + 0xa0]
fstp dword [esp + 0x18]
fld dword [esp + 0x18]
fld st(0)
fadd st(1)
fstp dword [esp + 0x18]
fld dword [esp + 0x1c]
fmul qword [0x451758]
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fstp dword [esp + 0xc]
fstp dword [esp + 8]
fld dword [esp + 0x18]
fst dword [esp + 4]
fstp dword [esp]
push eax
call fcn.0040f598
fldz
fst dword [esp + 0x48]
mov eax, dword [ebx + 0x2b820]
fst dword [esp + 0x44]
lea edx, [esp + 0x10]
fst dword [esp + 0x40]
push edx
fst dword [esp + 0x40]
push 0x100
fst dword [esp + 0x3c]
push eax
fst dword [esp + 0x3c]
fst dword [esp + 0x38]
fst dword [esp + 0x34]
fst dword [esp + 0x2c]
fst dword [esp + 0x28]
fst dword [esp + 0x24]
fst dword [esp + 0x20]
fld1
fst dword [esp + 0x58]
fst dword [esp + 0x44]
fst dword [esp + 0x30]
fst dword [esp + 0x1c]
fst dword [esp + 0x98]
fst dword [esp + 0x84]
fst dword [esp + 0x70]
fstp dword [esp + 0x5c]
fst dword [esp + 0x94]
fst dword [esp + 0x90]
fst dword [esp + 0x8c]
fst dword [esp + 0x88]
fst dword [esp + 0x80]
fst dword [esp + 0x7c]
fst dword [esp + 0x78]
fst dword [esp + 0x74]
fst dword [esp + 0x6c]
fst dword [esp + 0x68]
fst dword [esp + 0x64]
fstp dword [esp + 0x60]
mov ecx, dword [eax]
mov eax, dword [ecx + 0xb0]
call eax
mov eax, dword [ebx + 0x2b820]
mov ecx, dword [eax]
lea edx, [esp + 0x50]
push edx
push 2
push eax
mov eax, dword [ecx + 0xb0]
call eax
mov eax, dword [ebx + 0x2b820]
mov ecx, dword [eax]
lea edx, [esp + 0x90]
push edx
push 3
push eax
mov eax, dword [ecx + 0xb0]
call eax
call fcn.00406670
xor ecx, ecx
test eax, eax
setge cl
pop ebx
dec ecx
and eax, ecx
mov esp, ebp
pop ebp
ret
Function at 0x40a970
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0xc], ebx
cmp edi, ebx
je 0x40a983
mov dword [edi], ebx
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x40a98c
mov dword [eax], ebx
lea eax, [ebp - 8]
push eax
push 0x20019
push ebx
push str.SoftwareNVIDIA_CorporationGlobal_nViewKeystone
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call fcn.00403110
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40a9e3
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 4]
push edx
push ebx
push ebx
push str.KeystoneStyle
push eax
mov dword [ebp - 0x10], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40a9d9
and dword [ebp - 4], 0xf
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 1
je 0x40a9f1
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
push edx
call fcn.00403720
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x40aa73
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
jmp 0x4c4970
mov eax, dword [ebp - 0xc]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40c8d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x457880]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 5
mov ecx, dword [ebp - 4]
sbb eax, eax
xor ecx, ebp
inc eax
jmp loc.004c27d8
Function at 0x40d450
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x374
mov eax, dword [0x457880]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x457d98], eax
test eax, eax
jne 0x40d490
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044d16e
mov esp, ebp
pop ebp
ret
lea esi, [ebp - 0x350]
xor edi, edi
mov dword [ebp - 0x350], 0x348
call fcn.00401190
test eax, eax
jne 0x40d4bd
push str.DISPLAY
lea eax, [ebp - 0x34c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea ecx, [ebp - 0x34c]
lea edx, [ebp - 0x354]
push edx
mov eax, ecx
mov dword [ebp - 0x358], ecx
call fcn.0040d340
add esp, 4
test eax, eax
je 0x40d47d
mov esi, dword [ebp - 0x358]
test esi, esi
je 0x40d604
push str.DISPLAY
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40d503
call fcn.0040c410
jmp 0x40d510
push 0
push 0
push esi
push 0
call dword [sym.imp.GDI32.dll_CreateDCW]
mov esi, eax
test esi, esi
je 0x40d604
mov eax, dword [0x457d6c]
test eax, eax
je 0x40d53d
lea ecx, [ebp - 0x35c]
push ecx
push 4
push 0x457d98
push 4
push 0x7200
push esi
call eax
jmp 0x40d559
lea edx, [ebp - 0x35c]
push edx
push 4
push 0x457d98
push 4
push 0x7200
push esi
call dword [sym.imp.GDI32.dll_ExtEscape]
push esi
mov edi, eax
call dword [sym.imp.GDI32.dll_DeleteDC]
test edi, edi
jle 0x40d604
lea ebx, [ebp - 0x374]
lea esi, [ebp - 0x358]
call fcn.0040d2a0
test eax, eax
je 0x40d47d
mov esi, dword [ebp - 0x374]
xor eax, eax
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x368], eax
mov dword [ebp - 0x364], eax
mov eax, dword [ebp - 0x35c]
cdq
mov dword [ebp - 0x368], eax
mov dword [ebp - 0x364], edx
mov edx, dword [ebp - 0x358]
lea ecx, [ebp - 0x370]
mov eax, esi
mov dword [ebp - 0x370], 0x79
mov dword [ebp - 0x36c], 3
call fcn.0040d1f0
mov eax, esi
lea esi, [ebp - 0x358]
call fcn.0040d320
push 0x457d90
push 0
push 0x457d98
push 0x40d400
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x457d94], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0044d16e
mov esp, ebp
pop ebp
ret

Function at 0x411fcf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
jmp loc.004c1db0

Function at 0x44d16e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x457880]
jne 0x44d178
repz ret
jmp loc.004c03e8
Function at 0x8de1b0
Capabilities:
Encode data using xor

Disassembly:
push eax
pop ebp
wait
mov word [ebx + 0x16], fs
mov al, byte [0xf00b2011]
adc al, ch
pop es
xor eax, 0x290cc21c
add ebp, esi
insb byte es:[edi], dx
add byte [eax], al
pushal
call 0x8de1b6
pop ebp
sub ebp, 6
sub ebp, 0x4de1b0
jmp 0x8de214
mov ebx, dword [esi + 0x486ebe51]
fisub word [edx]
mov ebp, 0x77e2a302
mov byte [esi - 0x10], bh
ja 0x8de198
jle 0x8de202
shl dword [edi - 0x17], 1
add al, 0
add byte [eax], al
mov ecx, 0xb8e5b6d0
mov al, 0xe1
dec ebp
add byte [ebx], al
lds eax, [ecx + 0x93c0]
add byte [ecx + 0x623], bh
jmp 0x8de21d
mov eax, 0x4de1b0
add eax, ebp
add eax, 0x93
mov ecx, 0x623
mov edx, 0x68e1f62f
xor byte [eax], dl
inc eax
dec ecx
jne 0x8de234
jmp 0x8de247
inc ebp
outsd dx, dword [esi]
inc edi
das
aas
das
das
inc edi
das
jecxz 0x8de255
das
scasb al, byte es:[edi]
fist word [edx]
int3
adc cl, ah
sbb byte [ecx - 0x33ed2052], dh
sbb byte [ecx - 0x2f8010e4], dh
mov edx, 0x2f6b0e13
jg 0x8de20e
loop 0x8de210
cmpsb byte [esi], byte es:[edi]
adc ebp, dword [edi]
das
das
scasb al, byte es:[edi]
out dx, al
xlatb
das
das
das
sub al, 0xe2
xchg edi, eax
sub dword [edi], ebp
das
das
xchg ebp, eax
pop es
das
das
das
fmul st(5)
sub al, 0xe7
movsb byte es:[edi], byte [esi]
scasb al, byte es:[edi]
and ebp, dword [edi]
das
das
sub al, 0xea
jg 0x8de2d8
dec ecx
sbb dword [esi], esp
das
inc edi
test byte [ebx + 0x2f], ch
add ecx, dword cs:[ebx]
inc edi
das
das
das
das
invalid
daa
das
das
das
movsb byte es:[edi], byte [esi]
mov edx, 0x2f2f2f23
movsb byte es:[edi], byte [esi]
mov byte [0x2f2f2f3f], al
out dx, al
invalid
das
das
das
inc edi
dec ecx
sbb dword [esi], esp
das
inc edi
test byte [ebx + 0x2f], ch
add ecx, dword cs:[ebx]
jle 0x8de2b1
sub ch, byte [edi]
das
das
invalid
Function at 0x414ac0
Capabilities:
Encode data using xor

Disassembly:
push edi
xchg dword [eax + ecx*4 - 0x774b78a9], esi
push edi
xchg dword [eax + ecx*4 - 0x273bd8a9], esi
push ss
xchg dword [esi], edx
test al, 0x37
invalid
mov ch, 0xfc
inc esp
add al, 0x5c
mov dword [ebx], esp
cwde
pop edi
mov ecx, 0x77e927bf
test al, 0x6f
jg 0x414a81
test al, 0x78
pop edi
lodsd eax, dword [esi]
mov edi, 0xa877d683
aas
mov ah, 0x88
push edi
xchg byte [edx + 8], bl
js 0x414af1
arpl word [ebx + 0x78], ax
sbb eax, 0x60b4c60e
push reloc.ole32.dll_CoDisconnectObject
dec edx
ja 0x414a86
inc edi
ror byte [ebp + 0x77eb73bf], 0xa8
dec esi
jbe 0x414a43
push edi
sar byte [0x6482916d], cl
fst dword [esi]
xchg dword [ebp - 0x9ba7820], esi
mov byte [0x92f25c71], bh
jns 0x414b21
fdivr dword [edi - 0x57898ddd]
mov ah, 0x68
adc eax, 0xb78c0e87
lds esi, [eax + esi - 0x770a1899]
mov edi, 0xa8774bd7
outsd dx, dword [esi]
out dx, eax
ja 0x414a9c
js 0x414b02
cwde
aaa
invalid
mov byte [edi - 0x79], dl
mov ah, 0x88
push edi
xchg dword [eax + ecx*4 - 0x774b78a9], esi
push edi
js 0x414b5d
ja 0x414abc
xchg dword [eax + ecx*4 + 0x774b7857], esi
test al, 0x87
mov ah, 0x88
push edi
xchg dword [eax + ecx*4 - 0x774b78a9], esi
push edi
xchg dword [ebx + ecx - 0x738c7c45], esi
jae 0x414b9c
mov ah, 0x88
push edi
xchg dword [eax + ecx*4 + 0xbb48757], esi
mov ebx, 0x738c7383
imul ebx, dword [edx + ecx*8], 0x57
sbb al, 0xca
push edi
retf 0x8e57
mov cs, word [edi - 0x39]
aas
xchg esp, eax
leave
push edi
leave
xor byte [edi - 0x13f171fb], cl
dec eax
in eax, 0xe8
adc ch, byte [esi - 0x781131b5]
movsb byte es:[edi], byte [esi]
enter 0x657, 0x73
mov dword [edi - 0x79], edx
mov ah, 9
mov ecx, 0xb580c26e
push es
xchg dword [eax + ecx*8 - 0x768cf9a9], esp
push edi
xchg dword [ecx + ecx - 0x7f3d9147], esi
mov ch, 6
pop edx
mov dword [edi - 0x79], edx
mov ah, 0x32
ja 0x414b31
cmc
mov dh, dl
push 0xa3634416
mov ch, 0x77
mov edi, 0x5788b4ac
cmp al, 0x9e
in eax, 0x8c
inc edx
in eax, dx
mov eax, dword [0xaca00ca1]
aam 0x43
mov al, 9
nop
pop es
test byte [edi - 0x775990e9], bh
push edi
xchg dword [ebp - 0x4a8fa18a], esi
ja 0x414b32
int3
mov es, word [ebx - 0x3d]
xchg byte [edx], cl
ja 0x414be8
pop ebp
ja 0x414bb0
xchg esi, eax
xor dword [eax + ecx*4 - 0x20b059a9], 0xc
push es
pop ebx
imul ebx, esi, 0x86b1ca6f
push ecx
or dword [eax + 0x5788b486], edi
push es
ja 0x414b4c
push edi
xchg dword [ebx + ecx*2 + 0x13aa40d6], esi
xlatb
jo 0x414bd8
invalid
xchg dword [eax + ecx*4 - 0x774b78a9], esi
push edi
xchg dword [eax + ecx*4 - 0x774b78a9], esi
push edi
xchg dword [eax + ecx*4 - 0x774b78a9], esi
push edi
xchg dword [eax + ecx*4 - 0x774b78a9], esi
push edi
xchg dword [eax + ecx*4 - 0x774b78a9], esi
push edi
xor eax, 0x35ebcf89
mov edi, ecx
jmp 0x414c3e
iretd
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x4072ad
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x46bc7c], 0
jne 0x4072eb
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4072c1
mov dword [ecx*4 + 0x46bc78], eax
inc ecx
cmp ecx, 0x100
jl 0x4072bc
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407318
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x46bc78]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072f9
not eax
pop ebp
ret 0xc

Function at 0x8de020
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8de026
pop ebp
sub ebp, 6
sub ebp, 0x4de020
jmp 0x8de084
jmp 0x8de08d
mov eax, 0x4de020
add eax, ebp
add eax, 0x93
mov ecx, 0x63c
mov edx, 0x160d510a
xor byte [eax], dl
inc eax
dec ecx
jne 0x8de0a4
jmp 0x8de0b7
pushal
dec edx
bound ecx, qword [edx]
sbb cl, byte [edx]
or ah, byte [edx + 0xa]
invalid
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x3abb5e91
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x1d874a6b
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x401b46
Capabilities:
Check if file exists
Check mutex on windows
Copy file
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa24
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
push esi
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov esi, 0x104
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x218]
push esi
push eax
push ebx
call edi
lea eax, [ebp - 0x520]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004035ba
test eax, eax
je 0x401c00
lea eax, [ebp - 0x520]
push 0
push eax
call fcn.004029c0
test eax, eax
je 0x401c00
push 0x4012d4
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
mov dword [ebp - 0x10], eax
je 0x401be4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401be4
push 0x10030
push ebx
push 2
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.004038cc
mov dword [ebp - 4], 0x800700b7
jmp 0x401e79
call fcn.00403a3b
test eax, eax
jne 0x401c0c
push 0x10030
push ebx
push 9
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.004038cc
mov dword [ebp - 4], 0x80004005
jmp 0x401e79
lea eax, [ebp - 0x218]
push eax
call fcn.00403560
lea eax, [ebp - 0x218]
push 0x4013f0
push eax
call fcn.00403529
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x401ca8
lea eax, [ebp - 0x418]
push 0x200
push eax
push 3
push ebx
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
jne 0x401c66
lea eax, [ebp - 0x418]
push 0x4013d4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0xa24]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0xa24]
push 0x10030
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 4], 0x80070002
jmp 0x401e79
test byte [0x405114], 1
jne 0x401cc9
push 0x10124
push ebx
Function at 0x4021d4
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x528
push ebx
push esi
lea eax, [ebp - 0x118]
push edi
xor ebx, ebx
push eax
mov byte [ebp - 0x118], bl
mov byte [ebp - 0x21c], bl
call fcn.00403eda
test eax, eax
jl 0x40222f
lea eax, [ebp - 0x118]
push 0x40129c
push eax
call fcn.00403529
lea eax, [ebp - 0x118]
push 0x401230
push eax
call fcn.00403529
lea eax, [ebp - 0x21c]
push eax
push dword [ebp + 8]
call fcn.0040403d
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov edi, eax
cmp edi, ebx
jl 0x40235d
lea eax, [ebp - 4]
push eax
push 0x4017a0
push 0x15
push ebx
push 0x4017d0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
cmp edi, ebx
jl 0x402357
lea edx, [ebp + 8]
mov esi, 0x401860
push edx
mov eax, dword [ebp - 4]
sub esp, 0x10
mov dword [ebp + 8], ebx
mov edi, esp
mov ecx, dword [eax]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
call dword [ecx + 0x10]
mov edi, eax
cmp edi, ebx
jne 0x40229b
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x40229b
mov ecx, dword [eax]
push eax
call dword [ecx + 0x28]
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
cmp byte [ebp - 0x118], bl
je 0x40234e
cmp byte [ebp - 0x21c], bl
je 0x40234e
lea eax, [ebp - 0x118]
mov esi, 0x104
push eax
lea eax, [ebp - 0x320]
push esi
push eax
push 0x40142c
lea eax, [ebp - 0x21c]
push 0x401258
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x320], bl
je 0x40234e
lea eax, [ebp - 0x528]
push esi
push eax
lea eax, [ebp - 0x320]
push 0xffffffffffffffff
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x528]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
mov edi, eax
cmp edi, ebx
jl 0x40234e
lea edx, [ebp + 8]
lea esi, [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
sub esp, 0x10
mov dword [ebp + 8], ebx
mov edi, esp
mov ecx, dword [eax]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
call dword [ecx + 0x10]
mov edi, eax
cmp edi, ebx
jne 0x40234e
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x40234e
mov ecx, dword [eax]
push eax
call dword [ecx + 0x28]
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp byte [ebp - 0x118], bl
je 0x402437
cmp byte [ebp - 0x21c], bl
jmp 0x41d594
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4