joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40405c
Capabilities:
Get disk size
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4c5010]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4040f4
push 0x80000002
call sub.KERNEL32.DLL_GetLastError
test eax, eax
jne 0x4040d4
xor eax, eax
push ebp
push 0x4040cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x404110
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4040d4
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
ret
mov ax, word [0x4c5010]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4c5010], ax
mov esp, ebp
pop ebp
ret

Function at 0x404e68
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x4ca634
mov esi, section.DATA
mov edi, 0x4ca048
cmp byte [ebx + 0x28], 0
jne 0x404e97
cmp dword [edi], 0
je 0x404e97
mov edx, dword [edi]
mov eax, edx
xor edx, edx
mov dword [edi], edx
mov ebp, eax
call ebp
cmp dword [edi], 0
jne 0x404e86
cmp dword [0x4c5004], 0
je 0x404eb1
call fcn.00404d50
call fcn.00404ddc
xor eax, eax
mov dword [0x4c5004], eax
cmp byte [ebx + 0x28], 2
jne 0x404ec1
cmp dword [esi], 0
jne 0x404ec1
xor eax, eax
mov dword [ebx + 0xc], eax
call fcn.00404c04
cmp byte [ebx + 0x28], 1
jbe 0x404ed1
cmp dword [esi], 0
je 0x404ef2
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x404ef2
call fcn.004070b8
mov edx, dword [ebx + 0x10]
mov eax, dword [edx + 0x10]
cmp eax, dword [edx + 4]
je 0x404ef2
test eax, eax
je 0x404ef2
push eax
call sub.KERNEL32.DLL_LockResource
call fcn.00404bdc
cmp byte [ebx + 0x28], 1
jne 0x404f00
call dword [ebx + 0x24]
cmp byte [ebx + 0x28], 0
je 0x404f0b
call fcn.00404dac
cmp dword [ebx], 0
jne 0x404f27
cmp dword [0x4ca028], 0
je 0x404f1f
call dword [0x4ca028]
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_LeaveCriticalSection
mov eax, dword [ebx]
push esi
mov esi, eax
mov edi, ebx
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x404eb1
Function at 0x406b94
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
push 0x406d28
call sub.KERNEL32.DLL_SetErrorMode
mov esi, eax
test esi, esi
je 0x406bfc
push 0x406d38
push esi
call sub.KERNEL32.DLL_SetEvent
mov ebx, eax
test ebx, ebx
je 0x406bfc
push 0x105
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call ebx
test eax, eax
je 0x406bfc
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_Sleep_1
jmp 0x406d1e
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x406c3c
mov eax, dword [ebp - 4]
cmp byte [eax + 1], 0x5c
jne 0x406d1e
mov eax, dword [ebp - 4]
add eax, 2
call fcn.00406b80
mov esi, eax
cmp byte [esi], 0
je 0x406d1e
lea eax, [esi + 1]
call fcn.00406b80
mov esi, eax
cmp byte [esi], 0
je 0x406d1e
jmp 0x406c42
mov esi, dword [ebp - 4]
add esi, 2
mov ebx, esi
sub ebx, dword [ebp - 4]
lea eax, [ebx + 1]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_Sleep_1
jmp 0x406d01
lea eax, [esi + 1]
call fcn.00406b80
mov edi, eax
mov eax, edi
sub eax, esi
mov edx, eax
add edx, ebx
inc edx
cmp edx, 0x105
jg 0x406d1e
inc eax
push eax
push esi
lea eax, [ebp - 0x24f]
add eax, ebx
push eax
call sub.KERNEL32.DLL_Sleep_1
lea eax, [ebp - 0x14a]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_LoadResource
mov esi, eax
cmp esi, 0xffffffff
je 0x406d1e
push esi
call sub.KERNEL32.DLL_LoadLibraryA
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_VirtualAlloc
lea edx, [ebx + 1]
add eax, edx
inc eax
cmp eax, 0x105
jg 0x406d1e
mov byte [ebp + ebx - 0x24f], 0x5c
mov eax, 0x105
sub eax, ebx
dec eax
push eax
lea eax, [ebp - 0x11e]
push eax
lea eax, [ebp - 0x24f]
add eax, ebx
inc eax
push eax
call sub.KERNEL32.DLL_Sleep_1
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_VirtualAlloc
inc eax
add ebx, eax
mov esi, edi
cmp byte [esi], 0
jne 0x406c60
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_Sleep_1
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406d4c
Capabilities:
Clear file content
Get disk size
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_SetEndOfFile
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406f7c
push 0x80000001
call sub.KERNEL32.DLL_GetLastError
test eax, eax
je 0x406dcf
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406f7c
push 0x80000002
call sub.KERNEL32.DLL_GetLastError
test eax, eax
je 0x406dcf
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406f98
push 0x80000001
call sub.KERNEL32.DLL_GetLastError
test eax, eax
jne 0x406e58
xor eax, eax
push ebp
push 0x406e51
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00406b94
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
je 0x406e36
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x406fb8
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
je 0x406e36
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406e58
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_Sleep_1
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_SetThreadLocale
push eax
call sub.KERNEL32.DLL_ResetEvent
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x406f72
cmp byte [ebp - 0xd], 0
jne 0x406e9f
cmp byte [ebp - 0x12], 0
je 0x406f72
add byte [eax], al
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_VirtualAlloc
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x406eb8
dec ebx
cmp byte [ebx], 0x2e
je 0x406ec7
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x406eb7
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x406f72
inc ebx
cmp byte [ebp - 0x12], 0
je 0x406f04
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_Sleep_1
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SizeofResource
mov esi, eax
test esi, esi
jne 0x406f72
cmp byte [ebp - 0xd], 0
je 0x406f72
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_Sleep_1
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SizeofResource
mov esi, eax
test esi, esi
jne 0x406f72
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_Sleep_1
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SizeofResource
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c0c9a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff6
mov eax, 0x10f97d4c
call fcn.004bf8e8
inc esi
pop eax
inc edi
inc edi
aaa
xor edi, dword cs:[ecx]
mov ch, 0xb3
dec edi
pushal
not dword [ecx + ebx*4 - 0x53]
and ch, bh
push 0xa5d43d10
std
jecxz 0x4c0cad
loopne 0x4c0cf2
add dword [esi + 0xc], 0x466cfb23
or byte ds:[ebp - 0x31], dh
sbb eax, 0xc2194553
cmc
in al, dx
mov dword [edi], edi
adc dh, byte [ecx + edx]
pop ds
lcall 0xa0d, 0x26526176
push eax
xor al, 0xd1
xlatb
scasb al, byte es:[edi]
arpl word [eax + 0x24], sp
imul sp, word [edi], 0xa
test bl, ah
jne 0x4c0c9b
or al, byte [ebx + 0x210fa475]
or al, al
xor eax, 0x3db7dabd
mov word [eax], ss
push esp
mov dh, 0xe
mov edx, dr1
sal byte [0x3db7dabd], 0x8c
mov ebp, 0x8c3db7da
adc byte [esi + esi*4 + 0xe], dl
jnp 0x4c0cfc
aam 0xaa
out dx, eax
pop edx
cmova ecx, dword [esi - 0x44]
cmc
sub eax, 0x5c92dad9
add al, 0x7c
mov esi, dword [edi]
fild qword [esi]
xchg esp, eax
or al, 0x21
xor eax, 0xdebe1886
adc al, 0xb6
jge 0x4c0cda
or eax, 0x255ba294
xchg ebx, eax
sub byte [ecx + ecx*2], bl
push edi
or al, dl
mov cl, 0x90
lea eax, [ecx + 0x219d8831]
or dword [edx + 0x24917296], 0x1c
out dx, al
loopne 0x4c0d9e
invalid
test al, 0x59
inc eax
hlt
Function at 0x55ba4c
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0055c500
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret

Function at 0x5611a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov esi, eax
mov byte [esp], 0
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, 1
jmp 0x5611c1
inc edi
mov eax, esi
call 0x405c3c
cmp edi, eax
jg 0x5611d3
cmp byte [esi + edi - 1], 0x20
je 0x5611c0
mov eax, esi
test eax, eax
je 0x5611de
sub eax, 4
mov eax, dword [eax]
cmp eax, edi
jl 0x5612a0
cmp byte [esi + edi - 1], 0x2e
je 0x5612c4
jmp 0x5612a0
cmp byte [esi + edi - 1], 0x2e
jne 0x561248
inc dword [esp + 4]
cmp dword [esp + 4], 3
jg 0x5612c4
cmp dword [esp + 8], 0xff
jg 0x5612c4
xor eax, eax
mov dword [esp + 8], eax
mov ebp, esi
test ebp, ebp
je 0x56122c
sub ebp, 4
mov ebp, dword [ebp]
cmp ebp, edi
jg 0x561234
mov bl, 1
jmp 0x561242
movzx eax, byte [esi + edi]
add al, 0xd0
sub al, 0xa
setb bl
xor bl, 1
test bl, bl
jne 0x5612c4
jmp 0x56129f
movzx eax, byte [esi + edi - 1]
add al, 0xd0
sub al, 0xa
jae 0x56126d
mov eax, dword [esp + 8]
add eax, eax
lea eax, [eax + eax*4]
movzx edx, byte [esi + edi - 1]
add eax, edx
sub eax, 0x30
mov dword [esp + 8], eax
jmp 0x56129f
inc edi
mov eax, esi
call 0x405c3c
cmp edi, eax
jg 0x56127f
cmp byte [esi + edi - 1], 0x20
je 0x56126c
mov dword [esp + 0xc], esi
cmp dword [esp + 0xc], 0
je 0x561297
mov eax, dword [esp + 0xc]
sub eax, 4
mov eax, dword [eax]
mov dword [esp + 0xc], eax
cmp edi, dword [esp + 0xc]
jle 0x5612c4
jmp 0x5612af
inc edi
mov eax, esi
call 0x405c3c
cmp edi, eax
jle 0x5611f6
cmp dword [esp + 4], 3
jne 0x5612c4
cmp dword [esp + 8], 0xff
jg 0x5612c4
mov byte [esp], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x574110
Capabilities:
Encode data using base64
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
add eax, eax
add eax, eax
mov ecx, 3
cdq
idiv ecx
mov edx, eax
add edx, 4
mov ecx, esi
xor eax, eax
call 0x4062e0
cmp byte [ebp - 1], 0
jne 0x574170
mov eax, esi
call 0x405fdc
movzx edx, byte [ebp - 0xc]
dec edx
and dl, 0x3f
add dl, 0x21
mov byte [eax], dl
mov eax, dword [ebp - 0xc]
add eax, 2
mov ecx, 3
cdq
idiv ecx
lea eax, [eax + eax*2]
mov dword [ebp - 0xc], eax
mov edi, 2
xor eax, eax
mov dword [ebp - 0x10], eax
xor ebx, ebx
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x57418a
sub al, 2
jb 0x574191
jmp 0x574196
mov ebx, 2
jmp 0x574196
mov ebx, 1
mov eax, esi
call 0x405fdc
mov byte [eax + ebx - 1], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jge 0x57427a
test edi, edi
jle 0x5741f2
mov eax, esi
call 0x405fdc
lea eax, [eax + ebx - 1]
push eax
mov ecx, edi
mov eax, 0x3f
shl eax, cl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [edx + ecx]
and eax, edx
mov ecx, edi
shr eax, cl
mov edx, dword [esi]
or al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
sub edi, 6
inc ebx
mov eax, esi
call 0x405fdc
mov byte [eax + ebx - 1], 0
jmp 0x57426e
test edi, edi
jge 0x574238
mov eax, edi
cdq
xor eax, edx
sub eax, edx
mov edi, eax
mov eax, esi
call 0x405fdc
lea eax, [eax + ebx - 1]
push eax
mov ecx, edi
mov eax, 0x3f
shr eax, cl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
and al, byte [edx + ecx]
mov ecx, edi
shl al, cl
mov edx, dword [esi]
or al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
mov eax, 8
sub eax, edi
mov edi, eax
inc dword [ebp - 0x10]
jmp 0x57426e
mov eax, esi
call 0x405fdc
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [edx + ecx]
and dl, 0x3f
mov ecx, dword [esi]
movzx ecx, byte [ecx + ebx - 1]
or dl, cl
mov byte [eax + ebx - 1], dl
inc ebx
inc dword [ebp - 0x10]
mov eax, esi
call 0x405fdc
mov byte [eax + ebx - 1], 0
mov edi, 2
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jl 0x5741ae
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x57428b
sub al, 2
jb 0x5742c5
jmp 0x57430d
cmp edi, 2
jne 0x574291
dec ebx
mov eax, ebx
sub eax, 2
jl 0x57430d
inc eax
mov dword [ebp - 0x14], eax
mov edi, 2
mov eax, esi
call 0x405fdc
mov edx, dword [esi]
movzx edx, byte [edx + edi - 1]
mov ecx, dword [0x5961a0]
movzx edx, byte [ecx + edx]
mov byte [eax + edi - 1], dl
inc edi
dec dword [ebp - 0x14]
jne 0x5742a1
jmp 0x57430d
cmp edi, 2
jne 0x5742cb
dec ebx
test ebx, ebx
jle 0x574308
mov dword [ebp - 0x14], ebx
mov edi, 1
mov eax, esi
call 0x405fdc
mov edx, dword [esi]
movzx edx, byte [edx + edi - 1]
mov ecx, dword [0x5961a4]
movzx edx, byte [ecx + edx]
mov byte [eax + edi - 1], dl
inc edi
dec dword [ebp - 0x14]
jne 0x5742d7
jmp 0x574308
inc ebx
mov eax, esi
call 0x405fdc
mov byte [eax + ebx - 1], 0x3d
test bl, 3
jne 0x5742fb
mov eax, esi
xor ecx, ecx
mov edx, ebx
call fcn.00406248
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x575150
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.00403ba0
ret

Function at 0x581710
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffebc
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406730
xor eax, eax
push ebp
push 0x581888
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call 0x461eec
test al, al
jne 0x58174c
mov word [ebp - 6], 0
jmp 0x581872
xor eax, eax
push ebp
push 0x58186b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x581845
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x476384]
call 0x47c424
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x581791
cmp eax, 0x1000
jae 0x5817ab
jmp 0x581793
jge 0x5817ab
mov word [ebp - 6], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.004051a4
jmp 0x581872
lea edx, [ebp - 0x4c]
mov ecx, 0x40
mov eax, dword [ebp - 0xc]
call 0x47c19c
cmp word [ebp - 0x4c], 0x5a4d
je 0x5817db
mov word [ebp - 6], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.004051a4
jmp 0x581872
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x14]
lea edx, [ebp - 0x144]
mov ecx, 0xf8
mov eax, dword [ebp - 0xc]
call 0x47c19c
cmp dword [ebp - 0x144], 0x4550
je 0x58181c
mov word [ebp - 6], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.004051a4
jmp 0x581872
movzx eax, word [ebp - 0x12e]
and ax, 0x2000
cmp ax, 0x2000
jne 0x581835
mov word [ebp - 6], 2
jmp 0x58183b
mov word [ebp - 6], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x581855
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x581872
mov eax, dword [ebp - 0xc]
call fcn.004045f8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58188f
lea eax, [ebp - 4]
call fcn.00406738
ret
Function at 0x622b30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x158000]
mov dword [edi + 0x18a7e4], 0x51c8280c
push edi
or ebp, 0xffffffff
jmp 0x622b5a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x622b61
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x622b50
mov eax, 1
add ebx, ebx
jne 0x622b73
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x622b84
jne 0x622ba3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x622ba3
dec eax
add ebx, ebx
jne 0x622b90
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x622b68
add ebx, ebx
jne 0x622b9f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x622bf5
xor ecx, ecx
sub eax, 3
jb 0x622bbb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x622c2a
sar eax, 1
mov ebp, eax
jmp 0x622bc6
add ebx, ebx
jne 0x622bc6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x622b94
inc ecx
add ebx, ebx
jne 0x622bd4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x622b94
add ebx, ebx
jne 0x622be1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x622bd6
jne 0x622bf2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x622bd6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x622c14
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x622c06
jmp 0x622b56
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x622c14
add edi, ecx
jmp 0x622b56
pop esi
mov edi, esi
mov ecx, 0xb567
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x622c32
cmp byte [edi], 0x79
jne 0x622c32
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x622c37
lea edi, [esi + 0x21e000]
mov eax, dword [edi]
or eax, eax
je 0x622ca6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x236a54]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x236b80]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x622c64
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x236b84]
or eax, eax
je 0x622ca0
mov dword [ebx], eax
add ebx, 4
jmp 0x622c81
call dword [esi + 0x236b94]
mov ebp, dword [esi + 0x236b88]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x622cda
sub esp, 0xffffff80
jmp fcn.0058a898
Function at 0x432006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..rsrc
nop
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x432072
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x5d217510
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x432060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4320d2
mov ebx, 0x42f314
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x389c4e80
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401477
Capabilities:
Create thread

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x34
call sym.___main
mov dword [ebp - 0x18], 0
mov dword [esp + 0xc], 0x1e
mov dword [esp + 8], str.clautopesecretaquemaitrobaras
mov dword [esp + 4], 0xc
mov dword [esp], 0x40bc44
call sym._XOR
mov dword [esp], str.kernel32.dll
call sym._GetModuleHandleA_4
sub esp, 4
mov dword [esp + 4], 0x40bc44
mov dword [esp], eax
call sym._GetProcAddress_8
sub esp, 8
mov dword [0x40e078], eax
mov eax, dword [0x40e078]
mov edx, dword [0x40bc20]
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x3000
mov dword [esp + 4], edx
mov dword [esp], 0
call eax
sub esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [0x40bc20]
mov dword [esp + 0xc], 0x1e
mov dword [esp + 8], str.clautopesecretaquemaitrobaras
mov dword [esp + 4], eax
mov dword [esp], 0x405020
call sym._XOR
mov dword [esp], str.Ntdll.dll
call sym._GetModuleHandleA_4
sub esp, 4
mov dword [esp + 4], 0x40bc50
mov dword [esp], eax
call sym._GetProcAddress_8
sub esp, 8
mov dword [0x40e07c], eax
mov eax, dword [0x40e07c]
mov edx, dword [0x40bc20]
mov dword [esp + 8], edx
mov dword [esp + 4], 0x405020
mov edx, dword [ebp - 0xc]
mov dword [esp], edx
call eax
sub esp, 0xc
mov dword [esp], str.kernel32.dll
call sym._GetModuleHandleA_4
sub esp, 4
mov dword [esp + 4], 0x40bc60
mov dword [esp], eax
call sym._GetProcAddress_8
sub esp, 8
mov dword [0x40e074], eax
mov eax, dword [0x40e074]
mov edx, dword [0x40bc20]
lea ecx, [ebp - 0x18]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0x20
mov dword [esp + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [esp], edx
call eax
sub esp, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x401623
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._CreateThread_24
sub esp, 0x18
mov dword [ebp - 0x14], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov eax, 0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret