joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10055530
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x1011f604], 0x46e
mov dword [ebp - 0x10], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
jmp 0x10055577
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
jmp 0x10055577
jmp 0x100555f2
cmp dword [ebp - 0xc], 0x104
jge 0x100555cc
mov dword [0x1011f604], 0x10ff
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
movzx eax, word [eax + ecx*2]
cmp eax, 0
je 0x1005560b
jmp 0x1005560d
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
movzx eax, word [ecx + eax*2 - 0x18]
cmp eax, 0x6f
je 0x100555f7
jmp 0x10055688
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
movzx eax, word [ecx + eax*2 - 0x10]
cmp eax, 0x6c
je 0x1005565a
jmp 0x10055575
mov eax, dword [0x1011f604]
sub eax, 0x15af
mov dword [0x1011f604], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
movzx eax, word [eax + ecx*2 - 0x1a]
cmp eax, 0x6c
je 0x1005559d
jmp 0x1005568a
jmp 0x10055684
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
movzx eax, word [eax + ecx*2 - 0x16]
cmp eax, 0x61
je 0x1005561c
jmp 0x10055686
jmp 0x100555cc
mov dword [0x1011f608], 0x1e5b
jmp 0x10055568
mov dword [0x1011f608], 0x128c
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
movzx eax, word [eax + ecx*2 - 0x14]
cmp eax, 0x64
jne 0x10055684
mov dword [0x1011f608], 0x752
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
movzx eax, word [eax + ecx*2 - 0x12]
cmp eax, 0x64
je 0x100555b4
jmp 0x100555f2
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
movzx eax, word [eax + ecx*2 - 0xe]
cmp eax, 0x6c
jne 0x1005567f
mov dword [0x1011f608], 0x1f67
mov dword [ebp - 8], 1
jmp 0x10055691
jmp 0x10055575
jmp 0x10055686
jmp 0x10055688
jmp 0x1005568a
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
add esp, 0x10
pop ebp
ret

Function at 0x10055880
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [fcn.10055880]
mov dword [0x1011f604], 0x30e
mov dword [ebp - 4], eax
mov dword [0x1011f604], 0x200c
jmp 0x100558a7
jmp 0x100558ce
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x100558ce
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
jne 0x100558a5
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
jmp 0x100558ed
mov eax, dword [ebp - 4]
sub eax, 0x1000
and eax, 0xfffff000
mov dword [ebp - 4], eax
mov al, 1
test al, 1
jne 0x100558a7
jmp 0x100558e6
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
add esp, 8
pop ebp
ret
Function at 0x497ca0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x5f000]
push edi
jmp 0x497cba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x497cc1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x497cb0
mov eax, 1
add ebx, ebx
jne 0x497cd3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x497ce4
jne 0x497d03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x497d03
dec eax
add ebx, ebx
jne 0x497cf0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x497cc8
add ebx, ebx
jne 0x497cff
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x497d55
xor ecx, ecx
sub eax, 3
jb 0x497d1b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x497d8a
sar eax, 1
mov ebp, eax
jmp 0x497d26
add ebx, ebx
jne 0x497d26
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x497cf4
inc ecx
add ebx, ebx
jne 0x497d34
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x497cf4
add ebx, ebx
jne 0x497d41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x497d36
jne 0x497d52
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x497d36
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x497d74
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x497d66
jmp 0x497cb6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x497d74
add edi, ecx
jmp 0x497cb6
pop esi
mov edi, esi
mov ecx, 0x2cc0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x497d92
cmp byte [edi], 0x1a
jne 0x497d92
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x497d97
lea edi, [esi + 0x94000]
mov eax, dword [edi]
or eax, eax
je 0x497e0f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9c4a4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9c5bc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x497dc4
mov ecx, edi
jns 0x497df3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9c5c0]
or eax, eax
je 0x497e09
mov dword [ebx], eax
add ebx, 4
jmp 0x497de1
call dword [esi + 0x9c5d0]
mov ebp, dword [esi + 0x9c5c4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x497e43
sub esp, 0xffffff80
jmp 0x454d3d
Function at 0x51d0b7
Capabilities:
Encode data using xor

Disassembly:
pop ebp
sub dword [esp + esi], esp
aaa
das
cmc
jno 0x51d0ec
loop 0x51d134
mov byte [0xdbfa1a9f], al
cli
mov ebp, 0xc25ac691
inc esp
fist dword [ebp + 5]
sbb ebx, dword [eax - 0x6a6653b]
sub al, 0xdd
cmpsd dword [esi], dword es:[edi]
jp 0x51d0e6
add eax, 0x221e90c9
fadd st(4), st(0)
xor cl, byte [ebx]
in eax, 0xc3
out 0xd5, al
sub al, byte [edi]
or esp, ebp
ret
pop es
push ebp
add eax, 0x5a42f7be
xor eax, 0x658ad7e6
jne 0x51d15e
mov ch, ah
rcr byte [eax - 0x79cfffff], 1
push edi
pop ecx
and al, 0x6f
or eax, 0x93ba5a42
xchg ebx, eax
dec esp
stosd dword es:[edi], eax
mov bl, 0x45
sbb al, 0xd
imul edi, dword [esi + 0x360eff63], 0x6728fe5f
add ecx, dword [edx]
sbb ebx, dword [ebx + 0x19]
xor ebp, eax
sbb ecx, dword [edx + 0x1a]
push edx
sub al, byte [edi + ebp - 0x645f6f5e]
sbb cl, byte [edx - 0x53]
pop ebx
dec edi
mov ah, 0x27
mov eax, 0xbcdb5f4b
fsub qword ss:[edx]
pop esi
les ebx, [edi - 0xd0c4b2d]
loop 0x51d188
push ds
cmp al, 0x37
jnp 0x51d1a4
mov eax, 0x486745c2
ja 0x51d10a
xor ecx, ecx
invalid
sub al, 0x62
out 0xdd, eax
movsd dword es:[edi], dword [esi]
pushal
mov dword [0xac0ea02], eax
fidiv word [edi + 0x5af26a02]
mov cs, word [edx - 0x6b]
iretd
mov ch, 0xc3
pop edx
mov eax, dword [0xafe4e24b]
push 0x62
or ebx, dword [edi]
mov dl, byte [eax]
mov byte [ecx - 0x1a], 0x22
out dx, al
sar ebx, cl
sbb al, 0xb9
xchg edx, eax
jbe 0x51d1b2
sbb byte [edi + 0x7a], bl
adc eax, 0x6d761867
jp 0x51d1bb
sbb byte [bp + 0x6d], dh
into
mov dl, 0x4a
or byte [edx - 0x54], 7
adc esp, dword [esi - 0x2b376910]
push cs
xor ah, byte [esi]
fiadd word [edx + ebp*2 + 0x52]
cmpsb byte [esi], byte es:[edi]
invalid
inc esp
push 0x52
jns 0x51d1ad
jp 0x51d1a4
stosb byte es:[edi], al
sbb al, dl
dec edx
or eax, 0xfa67882b
pop ebp
in eax, dx
or ch, byte [ebx - 0x42]
jp 0x51d15c
movsd dword es:[edi], dword [esi]
adc byte [edx - 0x37], al
xor al, al
shl dh, cl
dec byte [edx + 0x7a12c602]
loop 0x51d209
cmp edx, esp
ret 0x1206
popal
int3

Function at 0x56632e
Capabilities:
Encode data using xor

Disassembly:
movsd dword es:[edi], dword [esi]
imul esp, dword [ebx + 0x628d70a1], 0x7a6499d5
adc bl, al
add al, 0xa1
fcmovnb st(0), st(2)
sub eax, 0xe7a6f722
cdq
sahf
mov ah, byte [edx - 0x21fd0520]
push eax
in al, 0xe9
cld
and al, 0x2a
push eax
and dword [eax], esp
or eax, 0xbbb00b50
aas
adc dword [ecx - 0x6c], 0xac7124de
fisub word [ecx + esi*2]
lodsb al, byte [esi]
mov al, byte [0x9c7b5c6a]
lahf
out 0x8f, eax
call 0xa8901bf3
ffree st(6)
aas
in eax, 0x18
jae 0x5663e2
invalid
and ebp, dword [ecx - 0x6019706c]
cmc
jo 0xe133bbd8
or edx, dword [eax]
or byte [eax], 0x15
in eax, dx
sbb ebp, dword [eax - 0x75]
nop
clc
popal
jg 0x56644d
pop edx
invalid
invalid
Function at 0x5ae7e1
Capabilities:
Encode data using xor

Disassembly:
mov cl, 0xbd
pop esp
adc bh, cl
mov eax, dword [0x5260b29e]
sbb ebx, edi
push esi
scasb al, byte es:[edi]
xchg dword [ebp + 0x33], eax
sahf
jecxz 0x5ae73e
inc edx
ret
stosb byte es:[di], al
xor bh, byte [esi]
nop
wait
adc byte [eax + eax*8 - 0x40], dh
not dword [edi - 0x3c]
cmp byte [eax - 0x5e], dl
imul ecx, dword [ebx], 0xa8e9721d
and byte [0x41115793], al
pop edi
jae 0x5ae826
nop
jne 0x5ae7db
jp 0x5ae74b
push ecx
mov al, byte [0xde3a317a]
mov bl, 0xf2
inc eax
int3
or eax, 0x73f04181
out dx, eax
ljmp 0xe123
xor al, 0x20
sal dword [eax], cl
rol dword [edx], 0xe
push cs
push cs
cmp byte [ebx + 0x507f7b7e], bl
wait
jle 0x5ae861
jg 0x5ae838
arpl word [ebp + esi + 0x74625a6d], bp
in al, 0xb7
add bl, dh
pop ds
imul edi, dword [ebp + 1], 0xdf05011d
mov dl, 0x7d
push ebx
push ebx
pop esp
clc
pushal
jo 0x5ae789
sahf
loope 0x5ae7e3
and eax, 0x5f409947
and byte [ebp + 0x4659e8ca], bl
adc dword [eax + 0x324be164], esp
mov dh, 5
push eax
sbb dword cs:[ecx - 0x10], 0x76
nop
and esp, dword [eax + 0x3e]
xchg edi, eax
pop esp
add dword [edi], esp
out 0, al
je 0x5ae7ca
and byte [ebp + 0x4ce2a986], ch
add al, 0x24
push ecx
mov ecx, 0x3ba8a380
sbb bl, byte [eax - 0x17]
and byte [ebx + 0x581a3ba8], 0xe9
adc edi, dword [esi + 0x616e51e5]
imul eax, eax, 0x70
adc al, 0x5c
mov eax, 0x7080144e
cdq
mov ebx, 0x409f613b
test dword [edi + 0x50], ebx
push ebx
and eax, 0x855c5ea0
pop edi
cmovb edx, dword [eax - 0x1b2403d8]
nop
sub ah, bh
fsetpm
mov cl, 0x91
xchg ecx, eax
add ecx, 0xb1c814e1
adc al, 0xbc
jae 0x5ae868
and al, 0xcc
invalid
Function at 0x5d0657
Capabilities:
Encode data using xor

Disassembly:
call 0x8ae45626
fsubr dword [edi + 0x2ddff77c]
out 0x96, al
vpunpckhdq xmm7, xmm2, xmmword [ebx]
lcall 0x9a6d, 0x60f8789e
push 0x38
jg 0x5d06bb
wait
out 0x14, eax
clc
mov ah, 0xb4
cli
lodsd eax, dword [esi]
xchg byte [esp + eax*8 - 0x45], ah
loope 0x5d06fe
wait
aam 0xb
fidivr dword [eax]
dec esi
fmul dword [ebx]
inc esi
push ebp
invalid
sub ebx, dword [eax]
sti
invalid
sbb dword [ebx], ebx
sub edx, dword [edi + 0x3a]
imul edi, dword [ebx], 0xffffffce
invalid
imul ebp, ebx, 0x69
xlatb
mov esp, 0x5856f6d8
push esi
std
xlatb
and byte [edi], 0x1e
cli
push ss
cmp edx, dword [edx + ecx*8 + 0x5bafcfca]
cmp eax, 0xcb7d0010
cdq
jle 0x5d06ca
fsubr dword [ebx - 0x65]
loopne 0x5d074d
xlatb
sbb ebp, dword [ebx]
mov eax, dword [0x6b461455]
fsubr qword [ebx]
xor dword [ebx + 8], ebp
mov bh, 0xf0
imul esp, ebx, 0xffffffb3
fisttp word [edi + 0x7d]
jb 0x5d0792
or ebp, dword [edx + 0x31]
cli
push esp
stc
sahf
dec ecx
xor al, 0xbc
retf
cmp byte [ebx + ecx*2 - 0x16d549f1], 0xc
xchg esp, eax
sbb ebp, dword [eax - 0x5c3031ae]
fstpnce st(3), st(0)
xor al, 0x55
invalid
mov dh, 0x2a
jmp 0xa8789b60
jne 0x5d07a8
jge 0x5d0749
mov bl, 0x23
or bl, byte [eax]
pop ss
mov eax, 0x8b3af90b
aaa
jmp 0x5d0780
xchg edi, eax
mov esi, 0x3aeed799
pop edi
popal
push esp
mov edx, 0xcb71db52
xchg esi, eax
les ebx, [edx - 0x32bdbd55]
mov ebx, 0xd7369b3b
xlatb
jnp 0x5d0762
sub ebp, eax
and al, 0xeb
mov ecx, 0xd74bcba6
push esi
test dword [ebp + edx + 0x7b06fbae], 0x3fbce72b
push ds
jbe 0x5d0778
mov esp, 0xcb761e3f
imul esi, dword [0x112cda98], 0x74
mov al, 0xa7
movsd dword es:[edi], dword [esi]
mov ebx, 0xa08ed7a3
test eax, 0x1bb38437
sbb ebx, dword [ebp + ebp + 0x78962b56]
push edi
pop esi
rol byte [ebx + 0x63ffd03f], 1
mov esp, dword [esi - 0x2c]
push es
stosd dword es:[edi], eax
push 0x5e87f9df
fld qword [edi - 0x13b7ce68]
pop ds
daa
mov edx, dword [ecx]
sbb esp, dword [edx]
jl 0x5d0865
xor dh, byte [ebx + ebx + 0x6f]
sub bh, byte [ebx]
cmp esi, dword [ecx - 0x700794b6]
or cl, byte [ebp - 0x38]
invalid
pop es
mov dl, 0xfe
mov dl, 0xa3
invalid
mov dword [0xbb393d8e], eax
or eax, dword [edi + 0x19]
or esi, dword [edx]
cmpsd dword [esi], dword es:[edi]
or byte [ebp + 0x6bd57782], bl
salc
and dword [esi - 0x78], edx
sal byte [esi], 0x4b
clc
jno 0x5d0861
and dl, al
invalid
Function at 0x61e519
Capabilities:
Encode data using xor

Disassembly:
enter 0x2bb1, 0x6b
and al, 0xfa
mov dword [0xd41852db], eax
and dword [ebx + 0x28], 0x611b4e72
sub byte [ebx], ah
mov word [esi - 0x658ce37a], gs
push edx
xchg ebx, eax
push edx
lodsb al, byte [esi]
pop ebx
wait
mov dword [ebp + 0x3f], ebp
scasb al, byte es:[edi]
retf
aam 0xdd
invalid
xor dl, al
loop 0x61e4b7
xchg dword [ecx - 1], esp
pop ss
shl byte [ebp + 0x39], cl
outsb dx, byte [esi]
lodsb al, byte [esi]
cmpsb byte [esi], byte es:[edi]
cmp al, 0x72
pop ebx
sti
test edx, ebp
stosd dword es:[edi], eax
push ebp
mov bl, 0xe3
popfd
cmpsb byte [esi], byte es:[edi]
sbb esi, dword [ebx]
xor eax, ecx
add ebx, dword cs:[edi + ecx*2]
xor eax, ecx
add ebx, dword cs:[edi + ecx*2]
sbb ebx, dword [edi - 0x10c4f1e5]
aam 0xa
cdq
mov edi, 0x7bbe0105
jns 0x61e55e
in eax, dx
pop edx
inc eax
jnp 0x61e4fd
pop eax
xchg dword [edi], eax
jne 0x61e56d
inc ecx
aaa
imul eax, dword [ecx + ecx*8], 0xffffffda
or edi, ebx
xchg ecx, eax
adc ch, dl
jecxz 0x61e556
loop 0x61e4f5
cmp edi, eax
invalid
inc edx
stosb byte es:[edi], al
cmc
nop
cli
or bl, byte [ecx]
js 0x61e59c
cmp eax, 0x7f78f82b
sub edi, eax
js 0x61e5e2
mov al, bh
stosd dword es:[edi], eax
fidivr dword ds:[ebp + 0x1b7e3be9]
mov byte [ecx], ch
mov edx, 0x90bf2bda
scasb al, byte es:[edi]
mov ebx, dword [ecx - 0x3bc51909]
xchg esp, edx
fist word [ebx + 0x6e]
dec edi
bound ecx, qword [ecx - 0x59]
pop edx
retf 0x6f6d
dec ebx
salc
mov edx, 0xcd6caa28
pop edx
fistp qword [esp + ebx + 0x5b]
jmp 0x12f79f5a
mov ecx, 0x16221295
push eax
sub bl, byte [ebx + 0x1486df06]
mov al, 0xdb
imul ebx, dword [edx + 0x5a], 0xffffffab
wait
mov edi, dword [esi - 0x64651686]
pop edx
retf
sbb ch, al
rcr dl, 1
jl 0x61e58e
ja 0x61e63e
int 0x67
iretd
retf
Function at 0x64fbfe
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6551d0
cmp edx, dword [eax]
je 0x64fc20
add eax, 8
inc ecx
cmp eax, 0x655260
jl 0x64fc11
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6551d0]
jne 0x64fd4e
mov eax, dword [0xa58814]
cmp eax, 1
je 0x64fd28
test eax, eax
jne 0x64fc51
cmp dword [0x655114], 1
je 0x64fd28
cmp edx, 0xfc
je 0x64fd4e
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64fc88
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00650310
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00650540
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x64fccb
lea eax, [ebp - 0x1a4]
push eax
call fcn.00650540
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x653788
push edi
call fcn.00651d10
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00650310
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00650320
lea eax, [ebp - 0xa0]
push 0x653768
push eax
call fcn.00650320
push dword [esi + 0x6551d4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00650320
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00651c84
add esp, 0x2c
pop edi
jmp 0x64fd4e
lea eax, [ebp + 8]
lea esi, [esi + 0x6551d4]
push 0
push eax
push dword [esi]
call fcn.00650540
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x417f1c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4223ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00410b37
and dword [ebp - 0x14], 0
cmp dword [0x4b96d4], 0
mov dword [ebp - 0x18], eax
jne 0x417fcf
push 0x404000
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x418077
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403ff4
push ebx
call edi
test eax, eax
je 0x418077
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403fe4
push ebx
mov dword [0x4b96d4], eax
call edi
push eax
call esi
push 0x403fd0
push ebx
mov dword [0x4b96d8], eax
call edi
push eax
call esi
push 0x403fb4
push ebx
mov dword [0x4b96dc], eax
call edi
push eax
call esi
mov dword [0x4b96e4], eax
test eax, eax
je 0x417fcf
push 0x403f9c
push ebx
call edi
push eax
call esi
mov dword [0x4b96e0], eax
mov eax, dword [0x4b96e0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x418028
cmp dword [0x4b96e4], ecx
je 0x418028
push eax
call esi
push dword [0x4b96e4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x418028
test ebx, ebx
je 0x418028
call edi
test eax, eax
je 0x41801f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41801f
test byte [ebp - 8], 1
jne 0x418028
or dword [ebp + 0x10], 0x200000
jmp 0x41805b
mov eax, dword [0x4b96d8]
cmp eax, dword [ebp - 0x18]
je 0x41805b
push eax
call esi
test eax, eax
je 0x41805b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41805b
mov eax, dword [0x4b96dc]
cmp eax, dword [ebp - 0x18]
je 0x41805b
push eax
call esi
test eax, eax
je 0x41805b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4b96d4]
call esi
test eax, eax
je 0x418077
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x418079
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b39b
leave
ret
Function at 0x41d1a0
Capabilities:
Get common file path
Manipulate console buffer

Disassembly:
mov eax, 0x13a0
call fcn.004187e0
cmp dword [0x963b2c], 0x37
push esi
jne 0x41d2ba
lea eax, [esp + 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualUnlock]
push 0
lea ecx, [esp + 0xba4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
mov esi, dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea edx, [esp + 0xc]
push edx
push 0
push 0
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
mov eax, dword [esp + 0xc]
push 0
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
push 0
lea ecx, [esp + 0x3a4]
push ecx
push 0x4041c0
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0
lea edx, [esp + 0x7a4]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x180]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
lea ecx, [esp + 0x1c]
push ecx
push 0
lea edx, [esp + 0x5c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputW]
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0
call esi
push 0x4041e0
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
lea ecx, [esp + 0x14]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileSectionW]
push 0x30
lea eax, [esp + 0x28]
push 0
push eax
mov dword [esp + 0x2c], 0
call fcn.0040a6c0
add esp, 0xc
lea ecx, [esp + 0x20]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CommConfigDialogA]
mov edx, dword [0x966290]
mov dword [esp + 8], edx
mov eax, 0x5d1
add dword [esp + 8], eax
mov eax, dword [esp + 8]
mov cl, byte [eax + edi]
mov edx, dword [0x962324]
mov byte [edx + edi], cl
pop esi
add esp, 0x13a0
ret
Function at 0x4b594d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4b596d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004b4a5a
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4b5990
test byte [esp + 8], 2
je 0x4b5990
call fcn.004b4acd
mov dword [eax], 0xd
call fcn.004b4ad6
mov dword [eax], 5
jmp 0x4b5969
xor eax, eax
ret

Function at 0x4c6699
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4c66d1
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004c4726
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004c46fe
jmp 0x4c66dd
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4c7d8b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4c7dcd
call fcn.004cdb04
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4c7dcd
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4c7dc4
xor eax, eax
jmp 0x4c7dd5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004c7ddb
pop edi
pop esi
pop ebx
ret 4

Function at 0x4ce034
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4ce062
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4ce080
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004cdf9a
jmp 0x4ce080
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4ce080
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004cdf9a
test edi, edi
mov eax, edi
jne 0x4ce06a
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x52a74985
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x2ff95c30
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219