joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6be109
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x6a34bf
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x6a34d9
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x6a34c8
pop esi
jmp 0x6a34e4
ret 4
jmp 0x6a34b2

Function at 0x6beaf1
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov ebx, 0xe0da77e6
lea esp, [esp + 1]
mov al, byte [esp + 1]
mov ebx, dword [esp]
jmp 0x6beaf5
xchg bh, bl
jmp 0x6beadb
lea esp, [esp + 3]
pop ecx
mov ah, byte [esp]
setl bl
bswap eax
mov ebx, 0xc7909a32
jmp 0x6beb32
pop ebx
call fcn.006beb1c
lea esp, [esp]
lea esp, [esp + 3]
pop eax
jmp fcn.006a16fb

Function at 0x6beb1c
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
not eax
xchg dword [esp], eax
lea esp, [esp + 1]
setp al
mov ah, byte [esp + 1]
jmp 0x6beb38

Function at 0x6f0ba4
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], cx
mov edx, dword [esp + 1]
push dword [esp + 1]
mov dword [esp], eax
pop dx
lea esp, [esp + 2]
jmp 0x6f0b1b
lea edx, reloc.MSVFW32.dll_DrawDibDraw
setg al
not ax
mov dl, 0xf6
push ecx
push edx
jmp 0x6f0b31
xchg byte [esp + 2], ah
mov dword [esp], edx
rdtsc
mov edx, 0xa29b4bb2
jmp 0x6f0b66

Function at 0x7be66f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, word [esp + 4]
add esp, 4
jmp 0x7be6ce
xchg byte [esp], dl
xchg esi, ecx
lea esp, [esp]
lea ecx, reloc.MSVFW32.dll_DrawDibDraw
pushfd
jmp 0x7be709
mov edx, 0xf5711138
lea edx, reloc.MSVFW32.dll_DrawDibDraw
xchg word [esp], dx
not ah
std
mov bp, dx
jmp 0x7be6b8
xchg byte [esp + 3], ah
pop word [esp + 2]
mov dh, byte [esp + 1]
mov dword [esp], ebp
rcl dl, cl
mov di, 0xa7b7
jmp 0x7be6f3

Function at 0x7bec2c
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub bh, 0xf
mov dl, 0x3b
xchg byte [esp], dl
xchg byte [esp], dl
xchg bp, si
jmp 0x7bec0c
xchg ecx, ebx
mov bx, bp
mov esi, dword [esp]
xchg ebp, ecx
lea esi, [esp + esi]
bsr edi, eax
jmp 0x7bebc5
pop word [esp]
btr bp, cx
neg ax
add esp, 0
mov bp, 0x21de
add esp, 2
jmp 0x7bebdb
not di
sbb bp, cx
stc
cld
rdtsc
sub esp, 0x1d
jmp 0x7bec47
mov eax, dword [esp]
jmp 0x7bebf5
xchg cl, ch
xchg dword [esp + 0x12], ecx
lea ecx, [edx*4]
jmp 0x7bec6f
neg dl
seto al
rdtsc
xchg word [esp + 0x10], ax
pop esi
neg cx
jmp 0x7bec31
mov di, cx
push word [esp + 0x1b]
inc dx
cmc
cmp di, di
jmp 0x7beca6
push word [esp + 0xc]
bswap ebx
xchg ecx, edi
lea esi, [eax + ecx]
mov cl, byte [esp + 0xa]
mov cl, 0xfd
jmp 0x7bec59
Function at 0x7becc8
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dh, bh
mov bh, byte [esp + 8]
cld
pop ecx
mov word [esp + 0x14], sp
lea ebx, [ebx*4]
jmp 0x7bebb4
pop word [esp + 0x18]
xchg dword [esp + 7], ecx
neg esi
mov ebx, 0x41a46b82
mov bl, byte [esp + 0x14]
bts cx, di
jmp 0x7beb09
pop dx
xchg word [esp + 2], ax
rdtsc
push word [esp + 3]
rdtsc
jmp 0x7beb93
mov si, word [esp + 1]
mov word [esp + 2], dx
btr dx, bx
push word [esp + 4]
and ebx, edi
mov dl, byte [esp + 2]
jmp 0x7beb4c
xchg dword [esp + 0x19], ebx
popal
pop word [esp + 1]
add esp, 4
mov ah, 0x97
jmp 0x7bec93
mov ax, si
mov dx, 0x8c40
rdtsc
pushal
mov dx, ax
mov dx, 0x41be
jmp 0x7beb7d
pop dword [esp + 3]
sub esp, 8
pop cx
lea esp, [esp + 0x10]
cmc
pop ebp
jmp 0x7beb62
lea esi, reloc.MSVFW32.dll_DrawDibDraw
bswap ecx
stc
shl cx, cl
neg eax
call fcn.007bec2c
btr si, bx
mov dh, 0x77
xchg dword [esp + 6], eax
push esp
pop word [esp + 0x10]
mov si, word [esp + 0x13]
jmp 0x7bed3b
push word [esp + 3]
setg bl
pop ebx
sub esp, 0x1b
jmp 0x7beb32
cmc
cld
rdtsc
mov dword [esp + 9], ebp
pop word [esp + 9]
cpuid
jmp 0x7bed24
xchg dword [esp + 0x1c], edx
push word [esp + 0x1a]
bsr ecx, ebx
mov di, word [esp + 0x17]
bswap edi
dec eax
jmp 0x7becd9
rcl ebx, 2
not dx
pop dword [esp + 0x12]
pop dword [esp + 0x11]
mov ch, 0x91
call fcn.007bed0e
fnstcw word [eax]
push dword [esp + 0x1d]
xchg al, ch
cld
lea ecx, [ecx*4]
pop ax
std
jmp 0x7becf8

Function at 0x7bf536
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.007bf0de
mov dword [esp + 0x2c], edi
lea esp, [esp + 0x2c]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x7bf552
lea esp, [esp + 2]
jmp 0x7bf511
push eax
jmp 0x7bf0d9
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x7bf53c
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x53892f52
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0xdfd7a25
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401106
Capabilities:
Hide graphical window

Disassembly:
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x403100], eax
call sub.kernel32.dll_GetCommandLineA
mov dword [0x403104], eax
push 0xa
push dword [0x403104]
push 0
push dword [0x403100]
call 0x401106
push eax
call sub.kernel32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xffffffb4
mov dword [ebp - 0x30], 0x30
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x28], 0x40172b
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
push dword [0x403100]
pop dword [ebp - 0x1c]
mov dword [ebp - 0x10], 0x10
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0x403000
push 0x7f00
push 0
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassExA
push 0
push dword [ebp + 8]
push 0
push 0
push 0x1e0
push 0x258
push 0
push 0
push 0xcf0000
push str.Farabi_Arabic_Converter
push section..data
push 0
call sub.user32.dll_CreateWindowExA
mov dword [0x403108], eax
push 1
push dword [0x403108]
call sub.user32.dll_ShowWindow
push dword [0x403108]
call sub.user32.dll_UpdateWindow
push 0
push 0
push 0
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_GetMessageA
or eax, eax
je 0x4011e8
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_DispatchMessageA
jmp 0x4011c1
mov eax, dword [ebp - 0x44]
leave
ret 0x10
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x44982551
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x2527342b
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x100073d1
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000746e
push ebx
push esi
call fcn.1000739a
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100072e3
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000741b
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000746d
push edi
push eax
call fcn.10008388
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1000743b
call fcn.10005f75
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000746c
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100072e3
add esp, 0x20
test eax, eax
jne 0x1000745a
push edi
call fcn.10005f75
jmp 0x10007462
push ebx
call fcn.10005f75
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100076d9
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1000f980
push 0x1000f978
push str.FlsAlloc
push 0x1e
call fcn.100075f7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000770d
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000e128]
call esi
jmp 0x10007713
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10007757
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1000f990
push 0x1000f988
push str.FlsGetValue
push 0x20
call fcn.100075f7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000778e
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000e128]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x1000d1f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000d21d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000d21d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x4f0459b9
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
mov eax, section..text_1
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x40351123
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x44a880
Capabilities:
Get common file path

Disassembly:
sub esp, 0x478
mov ecx, 0x41
xor eax, eax
push edi
lea edi, [esp + 0x240]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x240]
push eax
invalid
insb byte es:[edi], dx
invalid

Function at 0x4f07c0
Capabilities:
Encode data using xor

Disassembly:
mov dword [0x80bd10e5], eax
xor byte [edx + 0x74], ch
add eax, dword [edx + edi*8 - 0x7532c7be]
xor ebx, esi
inc edx
pop ss
pop edx
add byte [edx + edi*2], 0xb5
inc edi
ror dword [esp + ebp*8 - 0x4bf4c404], 0x3c
sbb al, 0x7a
scasd eax, dword es:[edi]
std
cmp al, 0xab
push ecx
push 0x73
call 0x8a9d7833
invalid

Function at 0x51d82b
Capabilities:
Encode data using xor

Disassembly:
bound ebx, qword [0xffc928a9]
mov bl, 0xf4
sub byte [edi + 0x7ced02a3], 0xd2
lea eax, [0xc3da7384]
popfd
loopne 0x51d881
and esp, dword [edx + 0x25]
add si, word [esi + 0x2a5b242d]
lodsb al, byte [esi]
jae 0x51d8c5
mov bh, 0x7b
push ds
std
cwde
sahf
jmp 0xe5ba43e8
push 0x59
push cs
mov eax, 0x30c7ed0
movsd dword es:[edi], dword [esi]
div byte [ebp + 0x44]
add byte [edx - 0x4f], ch
pop ds
or al, 0x8a
hlt
inc ecx
push eax
xor al, 0xc2
loop 0x51d8af
popfd
lcall 0x72ed, 0x40fd9ac1
int3
adc dword [edx + 0x6bb1601], ebp
scasd eax, dword es:[edi]
wait
mov ds, word es:[edx - 0x95e7563]
xchg ecx, eax
out 0x4a, al
xor byte [edi], bh
jbe 0x51d8bd
jp 0x51d8af
cmpsb byte [esi], byte es:[edi]
or edx, dword [esi + 0x71]
inc esi
jmp 0x51d95b
popfd
scasd eax, dword es:[edi]
cmp eax, 0xa1cf05df
cmp dl, byte [ebp + 0xb]
inc edx
adc dword [ebp + 0x11fa0f7e], ebp
outsd dx, dword [esi]
cmp dword [ecx + 0x79ed2ea9], ebp
fld dword [edx - 0x17]
fidiv dword [esi + esi*8]
not al
int 0xae
retf
mov cl, 0x9a
mov eax, dword [0x81ba916e]
xchg esi, eax
cmp eax, 0x10cb61d4
add byte [ecx], 0x1b
cmc
loope 0x51d980
fnsave dword [edx + 0x3ab03b01]
loope 0x51d9bc
shr dword [edx], 1
dec ebp
fimul dword [eax]
shl byte [edx + esi - 0x652e156f], cl
std
dec edi
in eax, dx
jo 0x51d9c7
or dl, byte [ecx + 0x21ca31da]
jbe 0x51d931
mov ch, 0xd0
push edi
sbb al, 0x26
outsd dx, dword [esi]
cmp ch, byte [eax + edi + 0x41]
fidiv dword [ecx]
retf 0x8ad6
salc
mov bl, byte [ecx + 0x4a]
add edi, ecx
jno 0x51d905
loope 0x51d9b8
sbb dword [edx + 0x41], edx
sbb esi, edx
jp 0x51d964
outsd dx, dword [esi]
adc dword [esi - 0x7f], edi
dec edi
int1
or bl, byte [edx + edi + 0x56]
adc dl, byte [ebx + ebx + 0x326a4f31]
out 0x22, al
add dword [edx + 0x5b], edi
inc ebx
jns 0x51da19
jnp 0x51d989
rcr dword [edi - 0x45a3f513], cl
add word gs:[esi], dx
mov ah, 0xa2
and dword [esi + 0x1ae5825b], ecx
mov cl, 0xa
mov eax, dword [0x8ded91ba]
push edx
pop ebx
dec edi
loope 0x51d973
mov dh, 0xd1
imul ecx, ecx, 0x61220d90
mov ebp, 0x5a14ea11
shr dword [ecx - 0x37], 1
nop
or eax, 0x11bd6122
ljmp 0xf16d
adc al, 0x5a
jge 0x51d98e
insd dword es:[edi], dx
int1
popfd
scasd eax, dword es:[edi]
movsd dword es:[edi], dword [esi]
fidiv dword [ecx - 0x6cca52ee]
ljmp 0x7cf9
jno 0x51d9a5
mov cl, 0xba
frstor dword [eax - 0x33]
xchg edi, eax
sal dword [edi + 0x69962527], 0xfe
mov ebp, 0x685c63d
iretd
Function at 0x581546
Capabilities:
Encode data using xor

Disassembly:
les esp, [esi + edi*4 + 0x28]
adc al, 0xd4
pop ecx
movsd dword es:[edi], dword [esi]
fstp qword [ebp + 0x79fa6b32]
or eax, 0x78332873
enter 0xffffffffffff8ab7, 0x7a
ficom word [edx + edi*4 - 0x137a68ac]
and byte [ecx + 0x5230f4b9], bl
imul ebx, dword [ebx - 0x5c], 0xfffffff6
in al, 0x42
std
dec esi
add eax, 0xd3d4e574
or ebp, eax
in al, dx
aaa
mov al, 0x26
xor dword [ecx - 0x7d], ebx
mov ch, 0x78
movsd dword es:[edi], dword [esi]
xor ecx, 0x52
mov ch, 0xf5
sal byte [edx - 0x1b], 0x56
add dword [eax], 0xffffffee
jecxz 0x581559
mov al, byte [0x64e5b449]
sub dword [eax - 0x5fb32a5d], esp
je 0x5815b1
dec ecx
jb 0x581596
arpl word [esi + 0x53], sp
loopne 0x581621
and byte [esp + eax + 0x23548e5d], dl
inc byte [esi + 0x41540564]
push esp
inc ecx
jmp 0xa569b808
adc dword [ebp - 0x364b2b58], edx
sub al, 0xc5
or ebp, eax
add al, 2
and al, 0xc8
call 0xc87c1833
outsb dx, byte [esi]
mov eax, dword [esi - 0x6d6471f5]
and eax, 0xea5281f
sbb esp, dword [eax - 0x59]
pop ss
sbb eax, 0x10f57dcb
xor eax, 0xc378b578
push edi
cmp eax, 0xedc5e8f5
pop eax
jbe 0x581664
bound esp, qword [edx]
jg 0x581629
sub eax, dword [ecx]
in eax, 0x75
inc eax
lahf
sub ebp, esp
wait
out 0x45, eax
stc
salc
ja 0x58162a
ret

Function at 0x5c76b3
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + eax*8 + 0x3cd88ae3]
adc byte [ecx + 0x28423b14], dh
xor cl, cl
or byte [edx + 0x35], 0x13
lcall 0x2677, 0xc3314940
dec ecx
xor ebx, eax
ja 0x5c76d8
push 0x5a1ab436
mov ah, 0x1a
pop edx
imul edx, eax, 0xffffffed
shl dword [ecx + 0x5d], 1
dec ecx
pushal
add byte [edx - 0x5f], bh
jg 0x5c76ad
add byte [ecx - 0x38], ah
and dword [eax], esp
xchg ecx, eax
call 0x69fef4e4
cli
out 1, eax
add ebp, ecx
cmp eax, 0x6228ae7b
aas
bound edi, qword [edi]
add al, 0x2f
pop ecx
jge 0x5c7697
ficom dword [esi - 0x47]
inc ebx
movsd dword es:[edi], dword [esi]
xor dword [esi], esp
xor ah, byte [esi + 0x67f0fb75]
invalid
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x431072
nop
nop
mov ebx, 0x40915c
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x6e760f8
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x431060
nop
mov eax, section..reloc
nop
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x2c4e3261
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x452138
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x585b44]
cmp dword [eax + 0x30], 0
je 0x4521e2
cmp dword [ebx + 0x94], 0
jne 0x4521dc
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4520c8
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4521dc
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4521a2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4521dc
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00418524
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4521b1
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x452d40
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x452d75
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004043a4
jmp 0x452d82
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404308
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x453e94
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x453ed5
mov eax, esi
call fcn.0043a638
test al, al
je 0x453ed5
mov eax, dword [ebx + 0x84]
call fcn.0043a3d8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x453ed5
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043a3d8
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x75364794
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x4d03138d
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp int.00401219
Function at 0x4010ce
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
cmp dword [ebp + 8], 0xffffffff
push ebx
push esi
push edi
je 0x401170
xor edi, edi
xor esi, esi
push edi
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x6c]
push 0x40
push ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
push edi
push dword [ebp - 0x30]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x130]
push 0x18
push edx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
movzx ecx, word [ebp - 0x11c]
xor bx, bx
push 1
push edi
push ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp word [ebp - 0x12a], di
jbe 0x40116c
push 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x2c]
push 0x28
push ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test bx, bx
jne 0x40115e
mov esi, dword [ebp - 0x18]
inc bx
add esi, dword [ebp - 0x1c]
cmp bx, word [ebp - 0x12a]
jb 0x401141
mov eax, esi
jmp 0x401172
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401245
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
push 0
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4012e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x4012c1
cmp eax, 3
je 0x4012c1
cmp eax, 0xb7
je 0x4012e3
push 0x40c458
lea eax, [ebp - 4]
mov dword [ebp - 4], 8
push eax
call fcn.00406f00
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.004011f4
add esp, 8
test eax, eax
je 0x4012ce
lea eax, [ebp - 0x108]
push eax
call fcn.00401245
add esp, 4
test eax, eax
je 0x4012ca
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x4012e3
cmp eax, 0xb7
jne 0x40128f
jmp 0x4012e3
xor eax, eax
jmp 0x4012e8
push 0x40c458
lea eax, [ebp - 4]
mov dword [ebp - 4], 7
push eax
call fcn.00406f00
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret