joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10134a20
Capabilities:
Decode data using base64 via winapi

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
push 0
push 0
push edi
push 0
push 1
push 0
push dword [esp + 0x24]
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x10134a75
push dword [edi]
call fcn.100d28d0
mov esi, eax
add esp, 4
test esi, esi
je 0x10134a75
push 0
push 0
push edi
push esi
push 1
push 0
push dword [esp + 0x24]
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x10134a6c
pop edi
mov eax, esi
pop esi
ret
push esi
call fcn.100d28c0
add esp, 4
push str.CryptStringToBinary_failed.
push 0x10220064
push str.mongoc
push 0
call fcn.100db4d0
add esp, 0x10
xor eax, eax
pop edi
pop esi
ret

Function at 0x10134aa0
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push eax
push 0
push 0x40000001
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
je 0x10134afd
push dword [esp + 4]
call fcn.100d28d0
mov esi, eax
add esp, 4
test esi, esi
je 0x10134afd
lea eax, [esp + 4]
push eax
push esi
push 0x40000001
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
je 0x10134af4
mov eax, esi
pop esi
pop ecx
ret
push esi
call fcn.100d28c0
add esp, 4
push str.CryptBinaryToString_failed.
push 0x10220064
push str.mongoc
push 0
call fcn.100db4d0
add esp, 0x10
xor eax, eax
pop esi
pop ecx
ret
Function at 0x10136aa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x10136c25
cmp dword [esi + 0x20], 0
je 0x10136c25
cmp dword [esi + 0x24], 0
je 0x10136c25
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x10136c25
cmp dword [eax], esi
jne 0x10136c25
mov eax, dword [eax + 4]
cmp eax, 0x2a
je 0x10136b05
cmp eax, 0x39
je 0x10136b05
cmp eax, 0x45
je 0x10136b05
cmp eax, 0x49
je 0x10136b05
cmp eax, 0x5b
je 0x10136b05
cmp eax, 0x67
je 0x10136b05
cmp eax, 0x71
je 0x10136b05
cmp eax, 0x29a
jne 0x10136c25
push edi
mov edi, dword [esi + 0x1c]
mov dword [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x2c], 2
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 8]
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], eax
test ecx, ecx
jns 0x10136b3e
neg ecx
mov dword [edi + 0x18], ecx
cmp ecx, 2
mov eax, 0x2a
push 0
mov edx, 0x39
cmove eax, edx
push 0
mov dword [edi + 4], eax
push 0
jne 0x10136b60
call fcn.1009d4f0
jmp 0x10136b65
call fcn.1009d270
add esp, 0xc
mov dword [esi + 0x30], eax
mov dword [edi + 0x28], 0xfffffffe
push edi
call fcn.10137b60
mov esi, dword [esi + 0x1c]
xor edx, edx
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x4c]
add eax, eax
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call fcn.100a13a0
mov eax, dword [esi + 0x84]
add esp, 0x10
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x10216b6a]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x10216b68]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x10216b6c]
mov dword [esi + 0x90], eax
xor eax, eax
movzx ecx, word [ecx*4 + 0x10216b6e]
pop edi
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x16b4], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
ret
mov eax, 0xfffffffe
pop esi
ret

Function at 0x10139260
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1013928d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1013928d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4282a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x17000]
push edi
jmp 0x4282ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4282c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4282b0
mov eax, 1
add ebx, ebx
jne 0x4282d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4282c8
jne 0x4282e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4282c8
xor ecx, ecx
sub eax, 3
jb 0x4282f8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42836a
mov ebp, eax
add ebx, ebx
jne 0x428303
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x428310
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x428334
inc ecx
add ebx, ebx
jne 0x428320
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x428315
jne 0x428331
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x428315
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x428354
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x428345
jmp 0x4282b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x428354
add edi, ecx
jmp 0x4282b6
pop esi
mov edi, esi
mov ecx, 0x115
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x428372
cmp byte [edi], 3
jne 0x428372
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x428377
lea edi, [esi + 0x26000]
mov eax, dword [edi]
or eax, eax
je 0x4283e6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x28000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x280c4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4283a4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x280cc]
or eax, eax
je 0x4283e0
mov dword [ebx], eax
add ebx, 4
jmp 0x4283c1
call dword [esi + 0x280c8]
mov ebp, dword [esi + 0x280d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42841a
sub esp, 0xffffff80
jmp 0x409ac0

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x40924c
Capabilities:
Encode data using xor

Disassembly:
movsd dword es:[edi], dword [esi]
inc esi
movsd dword es:[edi], dword [esi]
fdiv qword [ecx - 0x69]
invalid
adc dword [0xbb27db04], ecx
loopne 0x409218
in eax, 0x35
stc
loope 0x409283
xor eax, 0x962ae1f9
xchg esi, eax
hlt
sub byte [0x876bc4], al
dec eax
mov dword [0x1c44ffd9], eax
push eax
xor dh, cl
stosd dword es:[di], eax
xchg ebp, eax
mov byte [0xb15d11c7], al
stc
leave
test bh, dh
mov esp, gs
jge 0x409290
mov bh, byte [edi]
cmp ah, byte [edx]
mov dh, 0xb9
and edi, edx
jae 0x409255
int1
hlt

Function at 0x417e10
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc0
push esi
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [0x4c6adc]
push ecx
call sub.IMM32.dll_ImmGetContext
test esi, esi
mov dword [0x4c6adc], eax
je 0x417e53
lea edx, [esp + 4]
push edx
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
pop esi
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0xe]
mov eax, dword [esp + 0xc4]
and ecx, 0xffff
and edx, 0xffff
mov dword [eax], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 4], edx
mov edx, dword [esp + 0xa]
invalid
loope 0x417e89
inc dword [eax]

Function at 0x445728
Capabilities:
Encode data using xor

Disassembly:
jge fcn.004456a8
adc cl, byte [edi - 0x690fb986]
sub dh, bl
mov eax, dword [0x1c933736]
aaa
xchg ebx, eax
invalid
mov ds, word [eax]
jp 0x44567e
movsb byte es:[edi], byte [esi]
mov dword [0x6186338], eax
push ss
cmp bl, byte es:[bp + di + 0x5e]
mov edx, 0x7c307dfa
xor byte [esi + esi*2 + 0x26], bh
sub al, 0xf6
loopne 0x4456e2
invalid
salc
dec edx
add byte [ebx + 0x66], ah
jecxz 0x4456d1
invalid
jg fcn.004456e8
push esi
cmp al, 0xc
sub al, 0x9b
jbe 0x4456c5
xor byte [ebp - 0x79f3b4ac], 0x7a
pop edx
adc bh, ah
invalid
movsd dword es:[edi], dword [esi]
invalid
Function at 0x473a0c
Capabilities:
Encode data using xor

Disassembly:
in al, 0x64
mov al, byte [0xa43af2b5]
shl esp, 1
cmp eax, 0xa8194d20
add edi, esp
cmp ecx, dword [ebx - 0x5f09d22f]
daa
fimul word [ebx]
xor dword [edi], eax
cmp ah, byte [ecx + edx*8 + 0x4d203de4]
sbb dword [eax - 0x74c418ff], ebp
shr dword [0xde27a0f6], 1
or esi, dword [ecx]
pop es
lcall 0xb1e4, 0x2e79b8fe
mov eax, dword [0x84fea991]
pop edx
int3
stc
xchg edi, eax
jo 0x473947
cmp esi, dword [edi + 0x5b]
and eax, 0xea0d16a5
and eax, dword [eax + 0x69]
or eax, 0x694023ea
out 0xf3, eax
invalid
add al, 0xbb
dec edi
dec ebp
jg 0x47394b
out 0xcf, eax
push cs
push ss
emms
or dword [eax + 0x4b], esi
pop esp
shl byte [ebx], cl
jno 0x473a04
mov al, byte [0xe0e33170]
fist dword [esp + ebx*4 + 0x68274647]
xor eax, 0x910c34d7
xchg ecx, eax
daa
push 0xc34d735
cmp ecx, dword [edx + ecx*8]
push esi
xor eax, 0x7fd31fea
xchg ebp, eax
shl dword [eax - 0x6b], cl
mov cl, 0x7c
mov bh, byte [ebx + 0x1b]
jg 0x4739da
jbe 0x4739d9
loop 0x4739b9
sal dword [eax + eax - 0x3b4fa7c9], 0x1d
mov eax, 0x73f6f0d9
mov ah, 0
aaa
pop eax
mov al, 0xc4
sbb eax, 0xf6f0d9b8
jae 0x473991
mov word [ebp + 0x75], ds
push 0xffffffffffffff9c
pop ebp
jne 0x473a72
pushfd
push ss
loope 0x47399b
stc
mov esi, 0x192afc76
mov eax, 0x58d30588
mov cl, 0x9b
out 0x5c, eax
cmp dword [edi], ecx
push esi
jnp 0x473a56
add al, 0x9a
add al, 0x2d
lds edi, [eax - 0x5b6ec44b]
mov cl, 0x49
cmc
add dword [ecx], esi
std
iretd
loope 0x4739f6
xor ebp, dword [edx + 0x28]
or ecx, ebp
inc eax
xor eax, 0x5a1aa300
cmp ch, dh
push eax
push cs
mov dword [ebp + 0x40083641], ebx
stc
or byte [eax - 7], al
jne 0x473aa8
in al, 0xc1
or esp, edx
ror dword [ecx], 0xd4
daa
dec esp
inc ecx
das
invalid
mov esp, 0x901abbc
wait
jae 0x473a6c
jbe 0x473b24
mov ebp, 0x24893619
imul esi, dword [eax], 0x2a844009
mov ecx, 0xad64f1c
push cs
mov edi, 0x7581b9dc
or dword [esi], 0x1f581c4b
sbb byte [ebx - 0x14af8433], 0x54
in al, 0x49
dec ecx
out dx, al
mov ecx, 0x23e9830b
sub byte [ebp + 0x4c], 0x44
dec ebp
mov edx, edx
hlt
dec ebx
outsd dx, dword [esi]
push eax
daa
sbb ah, byte [ebx + 0x69]
adc edi, ecx
and eax, 0xf4849f1b
mov eax, dword [0x7e90ffbd]
test dword [ebx + 0x31], ebx
jne 0x473ad7
pop ecx
cmp dword [ebx - 0x581f1320], 0x5a
not dword [edx + 0x57809b96]
dec ebx
scasb al, byte es:[edi]

Function at 0x47d600
Capabilities:
Encode data using xor

Disassembly:
pop edx
cmp eax, ebx
movsd dword es:[edi], dword [esi]
jp 0x47d5cd
xor dword [ebp - 0xd], ecx
sub esp, dword [ebx + 0x19]
pop edi
in eax, 0x87
in eax, dx
cmpsd dword [esi], dword es:[edi]
lea esp, [esi - 0x1140cedd]
cmp edi, dword [ebp + 0x67ff1935]
aaa
aaa
shr ah, 1
mov dword [0x778d7347], eax
jg 0x47d653
ja 0x47d652
jg 0x47d5ab
salc
stosd dword es:[edi], eax
xor byte [edi - 0x13f7d027], dh
mov ebx, 0x827b5c98
xchg esp, eax
ror byte [ecx + 0x38605dee], 1
aam 0x8b
dec esp
cmpxchg dword [esi], esi
insd dword es:[edi], dx
sbb cl, bl
in al, dx
jp 0x47d5c9
ja 0x47d673
ret
lodsb al, byte [esi]
pop ecx
and al, 0x63
or al, 0x56
xor dword [edi - 0x67], ebx
jge 0x47d5d1
imul dh
xor bl, byte [edx + 0x413b4d81]
xchg ebx, eax
rcr dword [esi - 0x10b35c8b], 1
jmp 0xd9300626
push es
invalid
add al, 0x10
jmp 0x3d34a7c1
Function at 0x48a56f
Capabilities:
Encode data using xor

Disassembly:
jp 0x48a5b8
aam 0xd2
mov ss, esi
dec edx
inc edi
sar dword [ebx + 0x41], 0xf3
call [eax - 0x77]
in al, dx
test dword [ecx], ebx
jp 0x48a56b
stc
in al, dx
mov al, 0x17
cld
lds esp, [edi - 0x1dfa7bfb]
mov bl, 0x57
bound ecx, qword [edi + 0x75]
cdq
cmpsb byte [esi], byte es:[edi]
or bl, byte fs:[edx]
outsb dx, byte [esi]
dec edi
rol ebp, 1
add dh, al
add byte [edi - 0xd], bl
in al, dx
invalid
les edx, [ebp + 0x5143c5dd]
add eax, 0x6afe5c10
xor eax, 0x2ec018a1
xchg esp, eax
and ah, byte [edx - 0x5df01c85]
add eax, 0xe679266a
lcall 0x3ebd, 0xb329180a
std
inc esp
jno 0x48a62c
out 0x50, eax
xlatb
push ss
fld xword [0x10611e89]
xor dword [ecx - 9], ecx
pop ecx
adc esi, dword [eax - 0x27]
pop dword fs:[di]
invalid
push ds
ret

Function at 0x48b29c
Capabilities:
Encode data using xor

Disassembly:
wait
add byte [esi], al
and eax, 0x212acc6d
mov al, 0x54
push ds
cmpsb byte [esi], byte es:[edi]
sub esp, ebx
wait
cmp eax, 0xb07193bd
push ecx
jge 0x48b32a
pop edi
aam 0xd6
mov esi, 0x8fc6a5b9
setle byte [edx]
push ebp
jle 0x48b319
push esp
sti
cmp dword [edi + ecx*4], eax
wait
or byte [esi - 0x112868b7], ah
dec edi
adc al, 0xbe
movsd dword es:[edi], dword [esi]
dec esi
cmc
mov bl, 0xa
in eax, dx
sti
add eax, ebp
cmp dword [ecx + 0xddc34b0], 0xffffffd1
invalid
lds eax, [ebx - 0x23cb4f47]
or eax, 0x35c762d1
invalid
sbb ebp, dword [ebx]
mov bl, dh
and byte [ebp + 0x1b65e768], cl
sub al, 0xae
subps xmm3, xmm2
rol dword [ecx], cl
les edi, [ebx + 0x54]
inc esi
out dx, al
mov dh, pe_nt_image_headers32
jno 0x48b328
bound eax, qword [edx + edx]
inc edi
xchg ecx, eax
mov edi, 0x9508f25b
pop esp
mov dh, 0x5e
ja 0x48b2db
enter 0x7eee, 0x20
salc
mov eax, dword [edi + ebp*2 - 0x565deb41]
ret 0x4a58
Function at 0x4bb3b5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c3398
cmp edx, dword [eax]
je 0x4bb3d7
add eax, 8
inc ecx
cmp eax, 0x4c3428
jl 0x4bb3c8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c3398]
jne 0x4bb505
mov eax, dword [0x4c7d1c]
cmp eax, 1
je 0x4bb4df
test eax, eax
jne 0x4bb408
cmp dword [0x4c32c4], 1
je 0x4bb4df
cmp edx, 0xfc
je 0x4bb505
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb43f
lea eax, [ebp - 0x1a4]
push 0x4c0848
push eax
call fcn.004bbda0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bc230
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb482
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bc230
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c0844
push edi
call fcn.004be100
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4c0828
push eax
call fcn.004bbda0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bbdb0
lea eax, [ebp - 0xa0]
push 0x4c0824
push eax
call fcn.004bbdb0
push dword [esi + 0x4c339c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bbdb0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4c07fc
push eax
call fcn.004be074
add esp, 0x2c
pop edi
jmp 0x4bb505
lea eax, [ebp + 8]
lea esi, [esi + 0x4c339c]
push 0
push eax
push dword [esi]
call fcn.004bc230
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4091db
Capabilities:
Encode data using xor

Disassembly:
push eax
mov ebp, 0xf99fdf62
xor ah, byte [edx - 0x63]
sub eax, dword [esi]
pop eax
enter 0xffffffffffffad92, 0x22
pushal
xchg edx, eax
xchg edx, eax
lodsd eax, dword [esi]
and ah, byte [eax - 0x6e]
or ecx, dword [ebx + eax*8]
mov dword [0xcaf6b4ee], eax
dec edx
pop edx
mov bh, 0x97
cmp dl, bl
add ch, al
stc
std
test al, 0x98
cwde
das
cmpsb byte [esi], byte es:[edi]
dec edx
and edx, dword [esi + 0x6d]
bound edi, qword [ebp + 0x7e6aa761]
push ebx
xor bl, 0xe9
in al, 0x28
push esp
add esp, edx
cmp ebx, dword [eax - 0x62]
jle 0x40919d
dec esp
int 0x57
std
stc
mov dword [ebx + 0x768e25e], ebp
pop es
clc
mov cl, 0x4b
insd dword es:[edi], dx
rcr dword [ebp + 0x6ca223a2], cl
movsb byte es:[edi], byte [esi]
inc esp
shr byte [eax - 0x3c], 0xe2
or eax, 0xc7b367e0
sbb eax, 0xf5333d8f
loop 0x4091fa
push es
cwde
ja 0x4091b6
adc esp, dword [ebx + 0x4f895f6f]
cwde
pop eax
insb byte es:[edi], dx
test dword [edi], eax
les ebx, [esi + edi*8 - 0x24]
mov byte [0xa795395], al
leave
shr dword [eax + esi*2], 1
dec edx
rcl byte [edi - 0x224fa77b], cl
mov eax, 0x69840f6a
lcall 0x963d, 0x3c17af35
mov ds, word [eax]
push cs
ret 0xb24d

Function at 0x417c10
Capabilities:
Get disk information

Disassembly:
push ecx
push esi
push 0x4c2074
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [0x4c5afc], eax
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov dword [0x4c5afc], eax
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
mov dword [0x4c64c0], eax
mov dword [esp + 8], 0
call dword [sym.imp.ole32.dll_CoInitialize]
test esi, esi
je 0x417c66
lea eax, [esp + 4]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push str.MSWHEEL_ROLLMSG
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
pop esi
mov ecx, dword [esp]
add ecx, eax
mov eax, ecx
pop ecx
ret

Function at 0x4452f7
Capabilities:
Encode data using xor

Disassembly:
dec eax
jns 0x445332
rol byte [ecx + 0x24b6731f], 1
salc
cld
jle 0x445371
add al, 0x48
retf
sar byte [0x52594848], 0xd
inc byte [ecx + 0x5fcb356a]
pop edi
into
lahf
inc esp
jbe 0x44533e
and bl, byte [eax]
das
pause
mov dword [esi], edx
xchg edx, eax
xor byte [edi + 0x27], dl
scasd eax, dword es:[edi]
int 0x8a
pcmpeqd mm1, qword [edx + 0x3748243c]
add eax, 0x37292991
aaa
cmp al, 0xee
xchg ebx, eax
aaa
pushal
stosb byte es:[edi], al
xor al, 0xc
loope 0x445374
push 0xf750b4e3
pop es
lea edx, [ecx]
sub al, 0xe7
test edx, 0x4ca50a54
cmp ch, byte [0x2c8b4a4]
mov al, byte [ebx - 0x44]
add dword [edx - 0x796e27b7], esp
shr byte [edi], 0x4b
enter 0xfffffffffffff9ec, 0x61
sbb ah, byte [ecx + 0x494ef6f0]
leave
or bl, bl
cmpsd dword [esi], dword es:[edi]
salc
das
push ebp
xlatb
mov dh, 0x73
jo 0x445386
retf 0xa54
retf 0x88b2
Function at 0x464c8f
Capabilities:
Encode data using xor

Disassembly:
stc
jne 0x464cca
and eax, 0x92a97898
push 0xf40b48c1
jo 0x464c36
inc ebp
cmp byte [ebx - 0x4f], al
test dword [eax - 0x55a9955a], esi
inc ebp
cld
div edi
jge 0x464c56
sub al, 0xf8
mov dh, 9
mov ah, 0xe0
xchg sp, ax
fstp qword [edi]
sbb cl, cl
cwde
xchg esp, eax
add byte [ebx - 0x52bd8afd], ch
jle 0x464d3a
cmp byte [ecx - 0x59], al
invalid
lea esi, [eax + edi*8 - 0x63]
sub eax, 0x2c4e9799
cmp ecx, ebp
xor dword ds:[eax - 0xf3acc15], ecx
xchg edi, eax
dec esi
sub al, 0x3b
int 0x3e
xor dword [eax - 0xf3acc15], ecx
mov ebp, 0x9830b30d
or byte [eax + 0xeaf112e], cl
in al, dx
insb byte es:[edi], dx
jp 0x464d04
or al, 0xbb
adc dh, byte [ebx + 0x1e0b629e]
jmp 0xcbd6a649
xor al, 0xeb
pushal
popfd
insd dword es:[edi], dx
fnstenv [eax - 0x36]
movsb byte es:[edi], byte [esi]
rcr dword [ecx - 0x23a39943], cl
dec esp
and ebp, dword [eax + 0x1d]
test al, 0x34
clc
jge 0x464d9a
cmpsd dword [esi], dword es:[edi]
pop esi
jge 0x464cfe
xor esp, dword [esi + 0x3c]
sbb eax, 0xb084c6a1
fldcw word fs:[ebx + 0x4190848a]
invalid
popal
cmpsb byte [esi], byte es:[edi]
dec esp
ljmp 0x652f

Function at 0x4a178f
Capabilities:
Encode data using xor

Disassembly:
sahf
xchg esi, eax
pushfd
mov edi, 0x19703358
cld
and eax, 0x962ddc68
outsb dx, byte [esi]
inc ecx
ret
shr dword [0x7f809348], cl
pop edi
jle 0x4a1760
out dx, eax
or ecx, esp
mov ch, 0x97
scasd eax, dword es:[edi]
push esi
xor cl, byte [edi + 0x33]
cmpsb byte [esi], byte es:[edi]
les edi, [edi - 0x69c085f1]
xor byte [ecx], al
movsb byte es:[edi], byte [esi]
mov ecx, dword [edx + 0x2f]
rol dword [ecx - 0x7f81898d], 1
pop edi
inc ebp
loope 0x4a179e
lodsb al, byte [esi]
inc edx
xchg byte [edx], al
cmp dl, byte [edi]
std
hlt
Function at 0x4ba351
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c23b0
cmp edx, dword [eax]
je 0x4ba373
add eax, 8
inc ecx
cmp eax, 0x4c2440
jl 0x4ba364
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c23b0]
jne 0x4ba4a1
mov eax, dword [0x4c6d3c]
cmp eax, 1
je 0x4ba47b
test eax, eax
jne 0x4ba3a4
cmp dword [0x4c22dc], 1
je 0x4ba47b
cmp edx, 0xfc
je 0x4ba4a1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba3db
lea eax, [ebp - 0x1a4]
push 0x4bf858
push eax
call fcn.004bad30
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb1c0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba41e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb1c0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bf854
push edi
call fcn.004bd090
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4bf838
push eax
call fcn.004bad30
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bad40
lea eax, [ebp - 0xa0]
push 0x4bf834
push eax
call fcn.004bad40
push dword [esi + 0x4c23b4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bad40
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4bf80c
push eax
call fcn.004bd004
add esp, 0x2c
pop edi
jmp 0x4ba4a1
lea eax, [ebp + 8]
lea esi, [esi + 0x4c23b4]
push 0
push eax
push dword [esi]
call fcn.004bb1c0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x7bc370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x7bc38e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x7e5074
push ecx
mov edi, eax
call fcn.007d0198
mov esi, eax
add esp, 8
test esi, esi
jne 0x7bc3cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.007d002e
push esi
call fcn.007cffb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret