joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5f1830
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x194000]
push edi
jmp 0x5f184a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5f1851
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5f1840
mov eax, 1
add ebx, ebx
jne 0x5f1863
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5f1874
jne 0x5f1893
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5f1893
dec eax
add ebx, ebx
jne 0x5f1880
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5f1858
add ebx, ebx
jne 0x5f188f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5f18e5
xor ecx, ecx
sub eax, 3
jb 0x5f18ab
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5f191a
sar eax, 1
mov ebp, eax
jmp 0x5f18b6
add ebx, ebx
jne 0x5f18b6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5f1884
inc ecx
add ebx, ebx
jne 0x5f18c4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5f1884
add ebx, ebx
jne 0x5f18d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5f18c6
jne 0x5f18e2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5f18c6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5f1904
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5f18f6
jmp 0x5f1846
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5f1904
add edi, ecx
jmp 0x5f1846
pop esi
mov edi, esi
mov ecx, 0x40f0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5f1922
cmp byte [edi], 0x11
jne 0x5f1922
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5f1927
lea edi, [esi + 0x1ea000]
mov eax, dword [edi]
or eax, eax
je 0x5f199f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2fd2e4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2fd460]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5f1954
mov ecx, edi
jns 0x5f1983
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2fd464]
or eax, eax
je 0x5f1999
mov dword [ebx], eax
add ebx, 4
jmp 0x5f1971
call dword [esi + 0x2fd474]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x5f19d0
cmp al, 0xef
ja 0x5f19c3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x5f19a5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x5f19b2
mov ebp, dword [esi + 0x2fd468]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5f1a04
sub esp, 0xffffff80
jmp 0x420577
Function at 0x57dcad
Capabilities:
Initialize winsock library

Disassembly:
mov eax, 0x5b6f90
call fcn.00562c0c
sub esp, 0x198
mov eax, dword [0x63c8b0]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, ebp
push 0x57bbd5
mov ecx, 0x7e3758
mov dword [ebp - 0x10], eax
call fcn.0057c842
mov edi, eax
xor ebx, ebx
cmp dword [edi + 0xc], ebx
jne 0x57dd11
cmp esi, ebx
jne 0x57dcef
lea esi, [ebp - 0x1a0]
push esi
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, ebx
jne 0x57dd43
cmp byte [esi], 1
jne 0x57dd3d
cmp byte [esi + 1], 1
jne 0x57dd3d
mov dword [edi + 0xc], 0x57dc7a
call fcn.0057b347
mov esi, eax
cmp dword [esi + 0x30], ebx
jne 0x57dd50
push 0x1c
call fcn.005719e2
pop ecx
mov ecx, eax
mov dword [ebp - 0x1a4], ecx
cmp ecx, ebx
mov dword [ebp - 4], ebx
je 0x57dd47
push 0xa
call fcn.00571840
jmp 0x57dd49
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x57ddb3
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0x30], eax
cmp dword [esi + 0x34], ebx
jne 0x57dd82
push 0x1c
call fcn.005719e2
pop ecx
mov ecx, eax
mov dword [ebp - 0x1a4], ecx
cmp ecx, ebx
mov dword [ebp - 4], 1
je 0x57dd79
push 0xa
call fcn.00571840
jmp 0x57dd7b
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0x34], eax
cmp dword [esi + 0x38], ebx
jne 0x57ddb0
push 0x1c
call fcn.005719e2
pop ecx
mov ecx, eax
mov dword [ebp - 0x1a4], ecx
cmp ecx, ebx
mov dword [ebp - 4], 2
je 0x57ddab
push 0xa
call fcn.00571388
jmp 0x57ddad
xor eax, eax
mov dword [esi + 0x38], eax
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.00562b6e
leave
ret 4

Function at 0x4012b6
Capabilities:
Hide graphical window

Disassembly:
push ebp
push 0x10000
push 0x1000
push 1
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x403eb4], eax
push 0x64
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, 0x30
push eax
mov dword [eax], ecx
add eax, 0x4c
mov ebp, eax
mov eax, 0x400000
mov dword [0x403eb0], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x44], 0x401191
mov dword [ebp - 0x24], str.resiliency
call dword [sym.imp.USER32.dll_RegisterClassExA]
xor eax, eax
push eax
push dword [0x403eb0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.abasement
push str.resiliency
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x403eb8], eax
push eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401380
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401367
mov eax, dword [0x403eb4]
push eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
pop ebp
ret 0x10
Function at 0x40115f
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esp
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [esp + 0x2c], 1
je 0x401178
movzx esi, word [esp + 0x30]
xor eax, eax
mov edi, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x402660], eax
mov dword [ebp - 0x4c], 0x30
call fcn.0040114f
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x44], 0x401050
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], str.Lyrik
mov dword [ebp - 0x20], eax
call fcn.00401142
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
test eax, eax
je 0x40124c
mov eax, 0x80000000
push edi
push dword [ebp - 0x38]
push edi
push edi
push eax
push eax
push eax
push eax
push 0x80
push str.Dindom
push str.Lyrik
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0
push eax
mov dword [0x402668], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x402668]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push edi
push edi
push edi
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
je 0x40124c
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [ebp - 0x1c]
push eax
call edi
lea ecx, [ebp - 0x1c]
push ecx
call ebx
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
jne 0x401230
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x403e59
pop dword [ebp - 0x10]
mov eax, 0xabf5f722
sub eax, 0xabb5b8c9
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xbd994ec2
sub dword [ebp - 0x20], 0x6f470977
mov dword [ebp - 0x1c], 0x9beb2c22
add dword [ebp - 0x1c], 0x96482023
mov dword [ebp - 0x18], 0x9e382211
add dword [ebp - 0x18], 0xae14221d
mov dword [ebp - 0x14], 0x736e19ef
add dword [ebp - 0x14], 0x8c91e611
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x81929292
sub dword [ebp - 0x20], 0xd20293c
mov dword [ebp - 0x1c], 0x4374558b
sub dword [ebp - 0x1c], 0x207f416
mov dword [ebp - 0x18], 0xe54041d3
sub dword [ebp - 0x18], 0x81d0d567
mov dword [ebp - 0x14], 0x60a7b754
sub dword [ebp - 0x14], 0x60a7b754
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x35619
push 0
call eax
mov ecx, 0xe2cbd46b
add ecx, 0x1d346e1e
xor edi, edi
add edi, eax
mov edx, 0x68350773
sub edx, 0x67f3f773
add edx, dword [ebp - 0x10]
mov esi, 0xbc8081f2
add esi, 0x930124c6
xor dword [ebp - 0xc], ebx
mov ebx, dword [edx]
xor dword [ebp - 4], 0x14623b5f
sub ebx, esi
add dword [ebp - 0xc], ecx
mov dword [edi], ebx
add edi, 0x693838f9
add edi, 0x96c7c70b
add edx, 0xda3ae3a3
sub edx, 0xda3ae39f
loop 0x403f73
add eax, 0x8fa0631c
sub eax, 0x8f9f6625
mov ebx, eax
add eax, 0xa8df1e05
add eax, 0x5720e200
mov ecx, 0x400000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x419b43
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x419b52
pop dword [ebp - 0x1c]
mov eax, 0xb7e0af56
add eax, 0x4860ebfc
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x4f3fd
push 0
mov eax, 0x744e49fa
sub eax, 0x7409973e
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0xfe32fccd
add ecx, 0x1cd48a5
xor ebx, ebx
add ebx, eax
mov esi, 0xa14cdc9
add esi, 0xf633b037
add esi, dword [ebp - 0x1c]
mov edi, 0x4f9db0c2
add edi, 0x1bd962a6
sub dword [ebp - 0xc], 0x9cbd17f4
mov edx, dword [esi]
xor dword [ebp - 0x14], ebx
xor edx, edi
sub dword [ebp - 0x14], eax
mov dword [ebx], edx
add dword [ebp - 0xc], 0xb91deab5
add ebx, 0xd4bddf68
sub ebx, 0xd4bddf64
add esi, 0xbb2553d9
add esi, 0x44daac2b
loop 0x419bb3
add eax, 0x60c5b05f
sub eax, 0x60c4a7c4
mov ebx, eax
add eax, 0x54b94dbd
sub eax, 0x54b94db8
mov ecx, 0x400000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x43fcae
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46b5d8
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x43fcf1
push str.SystemFunction040
push dword [0x46b5d8]
call edi
push str.SystemFunction041
push dword [0x46b5d8]
mov dword [0x46b5e0], eax
call edi
mov dword [0x46b5e4], eax
jmp 0x43fcf6
mov eax, dword [0x46b5e4]
cmp dword [0x46b5e0], 0
je 0x43fd07
test eax, eax
jne 0x43fdae
push 0x46b5dc
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x43fdb8
push str.CryptProtectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e0], 0
mov dword [0x46b5e8], eax
jne 0x43fd6c
test eax, eax
jne 0x43fd6c
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fd56
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fd5d
mov esi, 0x80004005
push esi
push 0x28
push str.cryputil.cpp
call fcn.00403821
jmp 0x43fdb8
push str.CryptUnprotectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e4], 0
mov dword [0x46b5ec], eax
jne 0x43fdae
test eax, eax
jne 0x43fdae
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fda2
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fda9
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x43fd60
mov dword [0x46b5f0], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x444153
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 4]
push esi
push eax
push dword [ebp + 8]
xor esi, esi
call main
test eax, eax
je 0x4441dc
test byte [ebp - 4], 7
push ebx
mov ebx, 0x80070000
je 0x4441a9
push 0x80
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
test eax, eax
jne 0x4441a9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x44419f
movzx esi, si
or esi, ebx
test esi, esi
jns 0x4441a9
push esi
push 0x5c4
jmp 0x4441d1
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_DeleteFileW]
test eax, eax
jne 0x4441db
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4441c9
movzx esi, si
or esi, ebx
test esi, esi
jns 0x4441db
push esi
push 0x5ca
push str.fileutil.cpp
call fcn.00403821
pop ebx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x8003b3f
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x80043b4], 0x30
mov dword [0x80043bc], 0x8003351
mov dword [0x80043b8], 2
mov dword [0x80043c0], 0
mov dword [0x80043c4], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b82
mov dword [0x80043c8], eax
mov dword [0x80043dc], 0x80041e0
mov dword [0x80043d4], 0xf
mov dword [0x8004102], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043cc], eax
mov dword [0x80043e0], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x800410a], ebp
mov dword [0x80043d0], eax
push 0x80043b4
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x8004434], eax
push 0
push dword [0x8004102]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x800442c], eax
push 1
push dword [0x800442c]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x800442c]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c40
xor edi, edi
lea ebx, [0x80043e4]
jmp 0x8003c58
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c4a
jmp 0x8003c6c
mov eax, dword [0x80043ec]
call fcn.08002ae4
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
mov esi, 0x3dd15bc9
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x3fbe0cd1
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x4ead0971
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x40cb5f5e
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x414ac0
Capabilities:
Encode data using xor

Disassembly:
cwde
pushal
add al, byte [ebx - 0x7cfd9fa5]
pop ebx
pushal
add al, byte [eax + 0x5b]
pushal
add al, byte [ebx - 0x7cfd9fa5]
pop ebx
pushal
add al, byte [ebx + 0x4002605b]
pop ebx
pushal
add al, byte [ebx - 0x7cfd9fa5]
pop ebx
pushal
add al, byte [ebx + 0x2302605b]
sub esi, dword [eax]
inc ebx
cmp ecx, 0x40
invalid
jmp 0x414aaf
jecxz 0x414a66
sub byte [edi], 0x6c
sub dword [ebx + 0x5a], 0xb3001114
popal
jbe 0x414a25
mov al, 0x51
ljmp 0x906b
aas
inc esp
movsd dword es:[edi], dword [esi]
lahf
xchg dword [ebx + 0x2f], eax
ljmp 0x994a
salc
rol byte [ebp + 0x318b86c4], cl
inc ebx
sbb dword [edx + 8], 0xffffffd2
push ecx
sbb eax, 0xb3756860
sbb al, bh
jge 0x414a7a
xor dl, ch
daa
popfd
sahf
std
cmp bl, byte [ebx - 0x70]
inc esp
and ecx, 0x64
lds ebx, [ebx - 0x28]
xor ah, bl
sbb ah, byte [eax - 0x16]
shl dword [edi + ebx*4 - 0x60ff9403], cl
std
jl 0x414ad9
jo 0x414b5a
ret 0x885b
mov al, byte [edi]
insd dword es:[edi], dx
mov cl, 0xb8
add edx, dword [ebx + esi + 0x40]
dec ecx
ret 0x395b
Function at 0x402077
Capabilities:
Delete file
Get file size
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x98
mov eax, dword [0x42f180]
xor eax, ebp
mov dword [ebp + 0x70], eax
mov eax, dword [ebp + 0x7c]
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
mov dword [ebp - 0x20], eax
call fcn.004240fc
pop ecx
pop ecx
push ebx
push 0x80000080
push 2
push ebx
push 1
push 0xc0000000
push eax
mov dword [ebp - 0x24], eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov esi, dword [sym.imp.kernel32.dll_GetStdHandle]
push 0xfffffffffffffff5
mov dword [ebp - 0x14], eax
call esi
push 0xfffffffffffffff4
mov dword [ebp - 0x1c], eax
call esi
push dword [ebp - 0x14]
mov esi, dword [sym.imp.kernel32.dll_SetStdHandle]
push 0xfffffffffffffff5
mov dword [ebp - 0x18], eax
call esi
push dword [ebp - 0x14]
push 0xfffffffffffffff4
call esi
mov ecx, 0x431440
call fcn.00401a9d
mov edi, eax
cmp edi, ebx
jne 0x40211f
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
lea eax, [ebp - 0x10]
push str.Cant_load_Python_for_pre_install_script___d_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x10]
push eax
call fcn.00401654
add esp, 0x10
or eax, 0xffffffff
jmp 0x4021f7
push dword [ebp - 0x20]
call fcn.00422a7d
pop ecx
push edi
mov dword [ebp - 0x20], eax
call dword [sym.imp.kernel32.dll_FreeLibrary]
push dword [ebp - 0x1c]
push 0xfffffffffffffff5
call esi
push dword [ebp - 0x18]
push 0xfffffffffffffff4
call esi
cmp dword [ebp - 0x20], ebx
je 0x4021e2
mov eax, str.Running_the_pre_installation_script_failed_r_n
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402151
push ebx
push dword [ebp - 0x14]
sub eax, edx
mov edi, eax
call dword [sym.imp.kernel32.dll_GetFileSize]
mov dword [ebp - 0x18], eax
cmp eax, 0xffffffff
jne 0x402175
mov dword [ebp - 0x18], 0x1000
mov eax, dword [ebp - 0x18]
lea eax, [eax + edi + 1]
push eax
call fcn.00422a7d
mov esi, eax
pop ecx
cmp esi, ebx
je 0x4021d7
mov eax, str.Running_the_pre_installation_script_failed_r_n
mov edx, esi
mov dword [ebp - 0x1c], ebx
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x402195
push ebx
push ebx
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_SetFilePointer]
push ebx
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x18]
lea eax, [esi + edi]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_ReadFile]
mov eax, dword [ebp - 0x1c]
add eax, esi
push esi
mov byte [eax + edi], bl
call fcn.00401654
push esi
call fcn.00407f30
pop ecx
jmp 0x4021e1
push str.Out_of_memory_
call fcn.00401654
pop ecx
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_CloseHandle]
push dword [ebp - 0x24]
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + 0x70]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407875
add ebp, 0x74
leave
ret
Function at 0x4024ca
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x42f180]
xor eax, ebp
mov dword [ebp + 0x90], eax
mov eax, dword [ebp + 0x9c]
mov dword [ebp - 0x78], ecx
lea ecx, [edx + eax - 0x16]
sub eax, dword [ecx + 0x10]
push esi
sub eax, dword [ecx + 0xc]
push edi
mov edi, dword [ebp + 0xa0]
sub eax, 0x22
lea esi, [edx + eax]
xor edx, edx
mov dword [edi], edx
mov dword [ebx], edx
cmp dword [ecx], 0x6054b50
mov dword [ebp - 0x80], edi
jne 0x40260f
cmp dword [esi], 0x1234567b
je 0x402534
push edx
mov edi, str.Invalid_cfgdata_magic_number__see_bdist_wininst.py_
call fcn.00422a7d
pop ecx
jmp 0x402611
cmp eax, edx
jl 0x40260f
mov ecx, dword [esi + 8]
cmp ecx, edx
je 0x402550
mov edx, esi
sub edx, dword [esi + 4]
sub edx, ecx
mov dword [0x431560], edx
sub eax, dword [esi + 4]
mov ecx, dword [ebp - 0x78]
sub eax, dword [esi + 8]
mov edi, esi
mov dword [ecx], eax
sub edi, dword [esi + 4]
push 0x104
call fcn.00422a7d
pop ecx
mov dword [ebp - 0x7c], eax
test eax, eax
je 0x40260f
lea eax, [ebp - 0x74]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x4025fd
push dword [ebp - 0x7c]
lea eax, [ebp - 0x74]
push 0
push 0x4259a8
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
test eax, eax
je 0x4025fd
xor eax, eax
push eax
push eax
push eax
push dword [esi + 4]
push eax
push dword [ebp - 0x7c]
push 2
call fcn.00422a7d
add esp, 0x1c
mov dword [ebp - 0x78], eax
test eax, eax
je 0x40260f
push dword [esi + 4]
push edi
push eax
call fcn.00408be0
mov eax, dword [ebp - 0x78]
add esp, 0xc
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4025d1
sub eax, esi
lea eax, [eax + edi + 1]
push eax
call fcn.00422a7d
pop ecx
mov ecx, dword [ebp - 0x80]
push dword [ebp - 0x78]
mov dword [ecx], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebx], eax
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
xor eax, eax
inc eax
jmp 0x402611
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
mov edi, str.Could_not_create_temporary_file
call fcn.00422a7d
pop ecx
xor eax, eax
mov ecx, dword [ebp + 0x90]
pop edi
xor ecx, ebp
pop esi
call fcn.00407875
add ebp, 0x94
leave
ret