joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d7b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x445850]
mov edi, dword [ebp + 8]
test eax, eax
je 0x40d844
mov esi, dword [eax + 0x30]
test esi, esi
js 0x40d860
mov ebx, dword [eax + 0x30]
test ebx, ebx
jne 0x40d880
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
mov ecx, dword [edi + 0xc]
mov dword [ebp - 0x14], eax
test ecx, ecx
jne 0x40d838
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.0040d340
cmp eax, 7
jne 0x40d8ff
mov eax, dword [0x445850]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x40d8d6
mov edx, dword [eax + 0x30]
test edx, edx
js 0x40d8f0
mov edi, dword [eax + 0x30]
test edi, edi
jne 0x40d8b0
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.0040d560
jmp 0x40d7f5
call fcn.0040cda0
mov eax, dword [0x445850]
mov esi, dword [eax + 0x30]
test esi, esi
jns 0x40d7d0
lea esi, [esi]
call fcn.0040d040
mov eax, dword [0x445850]
mov ebx, dword [eax + 0x30]
test ebx, ebx
je 0x40d7db
lea esi, [esi]
lea edi, [edi]
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x40d7de
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x40d827
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40d827
call fcn.0040cda0
mov eax, dword [0x445850]
mov edx, dword [eax + 0x30]
test edx, edx
jns 0x40d819
nop
lea esi, [esi]
call fcn.0040d040
mov eax, dword [0x445850]
jmp 0x40d819
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]
Function at 0x40d910
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov esi, dword [edi + 0xc]
test esi, esi
je 0x40d9a2
mov eax, dword [0x445850]
test eax, eax
je 0x40d996
mov ebx, dword [eax + 0x30]
test ebx, ebx
js 0x40da11
mov ecx, dword [eax + 0x30]
test ecx, ecx
jne 0x40d9b7
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, edi
call fcn.0040d560
cmp eax, 7
jne 0x40da2f
mov eax, dword [0x445850]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x40da02
mov edx, dword [eax + 0x30]
test edx, edx
js 0x40da20
mov edi, dword [eax + 0x30]
test edi, edi
jne 0x40d9e3
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call fcn.0040cda0
mov eax, dword [0x445850]
jmp 0x40d932
mov dword [esp], edi
call fcn.0040d3d0
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x40d947
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x40d985
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40d985
call fcn.0040cda0
mov eax, dword [0x445850]
jmp 0x40d970
call fcn.0040d040
mov eax, dword [0x445850]
jmp 0x40d93d
call fcn.0040d040
mov eax, dword [0x445850]
jmp 0x40d97b
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x4010c1
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x164
push ebx
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x163]
push ebx
push eax
mov byte [ebp - 0x164], bl
call fcn.004074c0
push 0x40
lea eax, [ebp - 0x58]
push ebx
push eax
mov dword [ebp - 0x5c], ebx
call fcn.004074c0
mov dword [ebp - 0x14], ebx
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
add esp, 0x18
push dword [0x40ff14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xa
pop eax
mov word [ebp - 0x2c], ax
push 0x104
lea eax, [ebp - 0x164]
push eax
push ebx
mov dword [ebp - 0x5c], 0x44
mov dword [ebp - 0x30], 1
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x5c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x401163
cmp dword [ebp + 8], ebx
je 0x401163
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop ebx
leave
ret
Function at 0x401271
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x12c
push ebx
push esi
xor ebx, ebx
push edi
mov dword [esp + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
push str.zz_gv_253
push ebx
push ebx
mov dword [0x40ff0c], eax
call esi
mov dword [0x40ff14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4012b9
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x401167
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call fcn.00402dda
lea eax, [esp + 0xc]
call fcn.004031cc
push 0xbf8e4
push ebx
push dword [0x40fef4]
call fcn.004074c0
add esp, 0xc
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jge 0x4012fc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call fcn.0040120d
lea eax, [esp + 0x30]
push eax
mov edi, 0x104
call fcn.00402548
mov dword [esp], str.DDE_Server
push str.SysOleClass
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x40132b
call fcn.00401989
call dword [sym.imp.gamevancelib32.dll_void___cdecl_DeleteRecoveryModule_void_]
call dword [sym.imp.gamevancelib32.dll_struct__FILETIME___stdcall_GetClientInstallDate_void_]
or eax, edx
jne 0x401354
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.gamevancelib32.dll_void___stdcall_SetClientInstallDate_struct__FILETIME_]
cmp dword [ebp + 0x10], ebx
je 0x401376
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x401376
push 0x32
push dword [ebp + 0x10]
push str.unknown
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
call fcn.00401b8a
push str.hdmtx_115100
push ebx
push ebx
call esi
mov esi, 0xff
push esi
push 0x40f9d0
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call fcn.00402605
call fcn.004025b2
push esi
push 0x40fad0
call dword [sym.imp.gamevancelib32.dll_int___stdcall_GetCfgFilePath_char___int_]
call fcn.004011a9
push esi
push 0x40fdd0
call dword [sym.imp.gamevancelib32.dll_int___stdcall_GetWindowsProductId_char___unsigned_long_int_]
push esi
push 0x40fcd0
call dword [sym.imp.gamevancelib32.dll_int___stdcall_GetUniqueClientId_char___unsigned_long_int_]
call fcn.00402fd4
push dword [ebp + 8]
call fcn.00401419
mov eax, dword [ebp + 8]
pop ecx
call fcn.00401479
push ebx
test eax, eax
je 0x4012b3
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
jmp 0x401407
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
lea eax, [esp + 0x20]
push eax
call esi
test eax, eax
jne 0x4013f0
jmp 0x4012b2
Function at 0x401ea2
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
push esi
call dword [sym.imp.gamevancelib32.dll_struct_HWND______stdcall_FindBrowserWindow_unsigned_long_int_]
cmp eax, esi
je 0x401f81
cmp dword [0x40ed7c], esi
je 0x401ed6
push esi
push esi
push 0x400
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov dword [0x40ed7c], esi
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0xa]
cmp dword [0x40ffac], eax
je 0x401ef7
mov dword [0x40ffa8], esi
mov dword [0x40ffac], eax
cmp dword [0x40ffa8], 0xc8
jae 0x401f81
cmp dword [0x40ffb0], 2
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
jbe 0x401f19
call esi
mov dword [0x40ffa4], eax
inc dword [0x40ff9c]
inc dword [0x40ffb0]
push ebx
push edi
call esi
mov ebx, dword [0x40ed44]
mov edi, dword [0x40ff10]
call esi
sub eax, edi
cmp eax, ebx
jae 0x401f41
test edi, edi
ja 0x401f7f
cmp dword [0x40fef8], 0
jne 0x401f69
cmp dword [0x40ff9c], 5
jb 0x401f69
inc dword [0x40ffa0]
cmp dword [0x40ffa0], 2
jb 0x401f7f
and dword [0x40ffa0], 0
call esi
push dword [ebp + 8]
call fcn.00402a63
inc dword [0x40ffa8]
pop ecx
mov dword [0x40ff04], eax
pop edi
pop ebx
xor eax, eax
pop esi
leave
ret 4

Function at 0x402548
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push 0
push str.ProgramFilesDir
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.SHLWAPI.dll_StrNCatA]
push edi
push 0x40b598
push dword [ebp + 8]
call esi
push edi
push str.Gamevance
push dword [ebp + 8]
call esi
xor eax, eax
pop esi
leave
ret
Function at 0x402658
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push ebx
mov edi, eax
mov eax, dword [ebp + 0x18]
push ebx
push str.gv_253
mov dword [ebp - 8], ebx
xor esi, esi
mov dword [ebp - 0x18], 4
mov dword [eax], ebx
call dword [0x40ff20]
push ebx
push ebx
push 3
push ebx
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
push dword [ebp + 8]
push eax
call dword [0x40ff3c]
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x402726
push ebx
push 0x84000300
push 0x40eca0
push ebx
push ebx
push dword [ebp + 0x10]
push 0x40b538
push eax
call dword [0x40ff30]
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp + 0x1c]
mov dword [ebp - 4], eax
push eax
call dword [0x40ff34]
push ebx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x20000013
push dword [ebp - 4]
call dword [0x40ff38]
mov ecx, dword [ebp + 0x20]
mov edx, dword [ebp - 0x1c]
cmp ecx, ebx
je 0x4026f6
mov dword [ecx], edx
cmp eax, 1
jne 0x402703
cmp edx, 0x190
jb 0x40276b
push dword [ebp - 4]
call dword [0x40ff1c]
push dword [ebp - 0x10]
call dword [0x40ff1c]
push dword [ebp - 0x14]
call dword [0x40ff1c]
mov eax, dword [ebp + 0x18]
mov dword [eax], esi
mov byte [esi + edi], bl
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [ebp - 8]
cmp eax, ebx
jbe 0x402703
lea eax, [esi + eax + 1]
push eax
push edi
push 8
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edi, eax
cmp edi, ebx
je 0x402703
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
lea eax, [esi + edi]
push eax
push dword [ebp - 4]
call dword [0x40ff28]
test eax, eax
je 0x402780
cmp dword [ebp - 0xc], ebx
je 0x402703
add esi, dword [ebp - 0xc]
push ebx
push ebx
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
call dword [0x40ff2c]
test eax, eax
jne 0x40272d
jmp 0x402703
push dword [ebp - 4]
call dword [0x40ff1c]
push dword [ebp - 0x10]
call dword [0x40ff1c]
push dword [ebp - 0x14]
call dword [0x40ff1c]
jmp 0x402726
Function at 0x402d6f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x32
pop eax
push eax
push 0
push dword [ebp + 8]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 1
call fcn.004074c0
add esp, 0xc
call dword [sym.imp.gamevancelib32.dll_int___cdecl_IsWindowsVista_void_]
test eax, eax
mov eax, str.SoftwareAppDataLowgvtl
jne 0x402da4
mov eax, str.Softwaregvtl
lea ecx, [ebp - 4]
push ecx
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push 0
push 0x40b6f4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret

Function at 0x40321b
Capabilities:
Check mutex on windows

Disassembly:
push esi
push str.hdmtx_115100
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, esi
pop esi
ret

Function at 0x4053c3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004042b1
and dword [ebp - 4], 0
cmp dword [0x40f380], 0
mov ebx, eax
jne 0x405474
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x405525
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x405525
push eax
call fcn.0040423f
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40f380], eax
call esi
push eax
call fcn.0040423f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40f384], eax
call esi
push eax
call fcn.0040423f
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40f388], eax
call esi
push eax
call fcn.0040423f
pop ecx
mov dword [0x40f390], eax
test eax, eax
je 0x405474
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040423f
pop ecx
mov dword [0x40f38c], eax
mov eax, dword [0x40f38c]
cmp eax, ebx
je 0x4054cc
cmp dword [0x40f390], ebx
je 0x4054cc
push eax
call fcn.004042ba
push dword [0x40f390]
mov esi, eax
call fcn.004042ba
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4054cc
test edi, edi
je 0x4054cc
call esi
test eax, eax
je 0x4054c3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4054c3
test byte [ebp - 0xc], 1
jne 0x4054cc
or dword [ebp + 0x10], 0x200000
jmp 0x405505
mov eax, dword [0x40f384]
cmp eax, ebx
je 0x405505
push eax
call fcn.004042ba
pop ecx
test eax, eax
je 0x405505
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405505
mov eax, dword [0x40f388]
cmp eax, ebx
je 0x405505
push eax
call fcn.004042ba
pop ecx
test eax, eax
je 0x405505
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40f380]
call fcn.004042ba
pop ecx
test eax, eax
je 0x405525
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x405527
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40722e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40e9f8]
jne 0x407238
repz ret
jmp fcn.00408955

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x5e37f6
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5e3811
add esi, 0x1000
lea eax, [ebp - 0x2bc]
push edx
push 0x1c
push eax
push esi
call dword [edx + 0x124a8a36]
pop edx
test eax, eax
je 0x5e38e3
cmp dword [ebp - 0x2ac], 0x1000
jne 0x5e38d2
test dword [ebp - 0x2a8], 1
jne 0x5e38d2
and dword [ebp - 0x2a8], 0x100
jne 0x5e38d2
push esi
push edx
push 4
push esi
call dword [edx + 0x122d3a46]
pop edx
pop esi
test eax, eax
je 0x5e3875
jmp 0x5e38d2
cmp word [esi], 0x5a4d
jne 0x5e38d2
mov eax, esi
push ebx
mov ebx, dword [esi + 0x3c]
add eax, ebx
pop ebx
cmp dword [eax], 0x4550
jne 0x5e38d2
lea eax, [ebp - 0x28c]
push edx
push 0x28a
push eax
push esi
call dword [edx + 0x122d3af6]
pop edx
test eax, eax
je 0x5e38d2
lea eax, [ebp - 0x28c]
push eax
call fcn.005e3752
test eax, eax
jne 0x5e38cb
jmp 0x5e38d2
mov eax, esi
jmp 0x5e38e3
mov esi, dword [ebp - 0x2b0]
add esi, dword [ebp - 0x2bc]
jmp 0x5e3811
pop esi
leave
ret 4
Function at 0x4835a0
Capabilities:
Get disk size

Disassembly:
sub esp, 0x1c
push esi
push edi
mov edi, 0x555114
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x34]
push ecx
call fcn.00483560
add esp, 8
mov byte [esp + 8], al
or esi, 0xffffffff
push str.GetDiskFreeSpaceExA
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48364a
lea edx, [esp + 0xc]
lea ecx, [esp + 0x1c]
push edx
push ecx
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x10]
push edx
push ecx
call eax
test eax, eax
je 0x4836ab
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x48362c
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
jmp 0x483634
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ecx, 0xa
call fcn.00503450
mov edx, dword [esp + 0x28]
pop edi
pop esi
mov dword [edx], eax
add esp, 0x1c
ret
lea eax, [esp + 0x30]
lea ecx, [esp + 0xc]
push eax
lea edx, [esp + 0x20]
push ecx
lea eax, [esp + 0x1c]
push edx
lea ecx, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x48369f
mov eax, dword [esp + 0x34]
test eax, eax
mov eax, dword [esp + 0x30]
je 0x48367d
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
push 0x400
imul edx, dword [esp + 0x20]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov dword [ecx], eax
add esp, 0x1c
ret
mov edx, dword [esp + 0x28]
pop edi
mov dword [edx], esi
pop esi
add esp, 0x1c
ret
mov eax, dword [esp + 0x28]
pop edi
mov dword [eax], esi
pop esi
add esp, 0x1c
ret