joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43014a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0xdc]
mov ecx, edi
xor ebx, ebx
call fcn.0042d98f
test eax, eax
jle 0x430199
push ebx
mov ecx, edi
mov byte [ebp - 1], 0
call fcn.0042d642
mov edx, dword [eax]
lea ecx, [ebp - 1]
push ecx
push dword [ebp + 0x10]
mov ecx, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [edx]
cmp byte [ebp - 1], 0
jne 0x4301fa
mov ecx, edi
inc ebx
call fcn.0042d98f
cmp ebx, eax
jl 0x430168
mov eax, dword [ebp + 8]
sub eax, 0x100
je 0x430253
sub eax, 4
je 0x4301fe
dec eax
dec eax
jne 0x43024a
push dword [ebp + 0xc]
mov word [ebp + 8], ax
lea edi, [ebp + 0xa]
stosw word es:[edi], ax
call fcn.0045e38e
pop ecx
mov ecx, dword [esi + 0x5c]
push 0x8000000a
lea edx, [ebp + 8]
push edx
mov word [ebp + 8], ax
mov eax, dword [ecx]
push 0x42f493
call dword [eax + 0xfc]
mov esi, eax
test esi, esi
je 0x43024a
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xf0]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x18]
mov al, 1
jmp 0x43024c
cmp dword [esi + 0x60], 0
je 0x43024a
xor eax, eax
push 7
pop ecx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
mov ax, word [ebp + 0xc]
mov word [ebp - 0x10], ax
mov eax, dword [esi + 0x70]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x74]
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x14], eax
call fcn.0042e4d2
mov word [ebp - 0xe], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x60]
lea edx, [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx]
push edx
call dword [eax + pe_nt_image_headers32]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x43024a
cmp dword [esi + 0x60], 0
je 0x4302a2
mov ecx, dword [esi + 0x60]
mov eax, dword [ecx]
call dword [eax + 0xc0]
test al, al
je 0x4302a2
mov ecx, dword [esi + 0x60]
mov eax, dword [ecx]
call dword [eax + 0xcc]
test al, al
je 0x4302a2
mov ecx, dword [esi + 0x60]
mov eax, dword [ecx]
push str.RichEditUI
call dword [eax + 0xc]
push eax
call fcn.00458c61
pop ecx
pop ecx
test eax, eax
je 0x4302a2
mov ecx, dword [esi + 0x60]
call fcn.0043f3df
test al, al
jne 0x43024a
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setge al
movzx eax, al
push eax
mov ecx, esi
call fcn.0042fff0
jmp 0x4301fa
Function at 0x433bfa
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x48c0d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp byte [esi + 0x18], bl
je 0x433c6b
cmp dword [esi + 0x10], ebx
je 0x433c6b
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
inc edi
lea eax, [edi + edi]
call fcn.0045dfe0
mov dword [ebp - 8], esp
cmp esp, ebx
je 0x433c6b
push edi
push dword [ebp - 8]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push dword [ebp - 8]
add ecx, 0x140
call fcn.0042d7ef
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push ebx
push ebx
push ebx
push str.textchanged
push ecx
call dword [eax + 0x1c]
mov ecx, eax
call fcn.0042f982
xor eax, eax
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00457a79
leave
ret 0x10
Function at 0x43abad
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
sub esp, 0x2b4
lea ebp, [esp - 4]
mov eax, dword [0x48c0d0]
xor eax, ebp
mov dword [ebp + 0x2b4], eax
push 0xc
mov eax, 0x4720d3
call fcn.0045a6ad
mov edi, dword [ebp + 0x2c0]
mov ebx, ecx
call fcn.0043a196
call fcn.0042e66f
push eax
lea ecx, [ebp + 0x230]
call fcn.0042dda0
xor esi, esi
mov dword [ebp - 4], esi
call fcn.0042e675
mov ecx, eax
call fcn.0042d798
test al, al
je 0x43ad0f
push edi
lea ecx, [ebp + 0x230]
call fcn.0042d81d
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocString
lea ecx, [ebp + 0x230]
call fcn.0042d7c3
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x18], eax
push esi
cmp eax, 0xffffffff
jne 0x43ac83
push str.Error_opening_file
mov ecx, ebx
call fcn.0043a36c
mov bl, al
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x230]
call fcn.0042d673
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x2b4]
xor ecx, ebp
call fcn.00457a79
add ebp, 0x2b8
leave
ret 8
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, esi
jne 0x43ac98
push esi
push str.File_is_empty
jmp 0x43ac44
cmp edi, 0x400000
jbe 0x43aca8
push esi
push str.File_too_large
jmp 0x43ac44
push edi
mov dword [ebp - 0x14], esi
call fcn.0042ce0f
pop ecx
push esi
lea ecx, [ebp - 0x14]
push ecx
push edi
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], edi
je 0x43acee
push dword [ebp - 0x10]
call fcn.0045809d
pop ecx
mov ecx, ebx
call fcn.0043a196
push esi
push str.Could_not_read_file
jmp 0x43ac44
push dword [ebp + 0x2c4]
mov ecx, ebx
push edi
push dword [ebp - 0x10]
call fcn.0043aa5c
push dword [ebp - 0x10]
mov bl, al
call fcn.0045809d
pop ecx
jmp 0x43ac4d
call fcn.0042e675
push eax
lea ecx, [ebp + 0x230]
call fcn.0042d803
call fcn.0042e67b
test al, al
je 0x43ad30
call fcn.0042e681
jmp 0x43ad47
push 2
push esi
lea ecx, [ebp + 0x230]
call fcn.0042d7c3
push eax
call fcn.00444387
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp eax, esi
jne 0x43ad59
push esi
push str.Error_opening_zip_file
jmp 0x43ac44
lea eax, [ebp]
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push edi
push dword [ebp - 0x10]
call fcn.00442a85
add esp, 0x14
test eax, eax
je 0x43ad7e
push esi
push str.Could_not_find_ziped_file
jmp 0x43ac44
mov eax, dword [ebp + 0x22c]
mov dword [ebp - 0x14], eax
cmp eax, esi
je 0x43ac90
cmp eax, 0x400000
ja 0x43aca0
push eax
call fcn.0042ce0f
push 3
push dword [ebp - 0x14]
mov edi, eax
push edi
push dword [ebp - 0x18]
push dword [ebp - 0x10]
call fcn.004443e4
add esp, 0x18
cmp eax, esi
je 0x43ade5
cmp eax, 0x600
je 0x43ade5
push edi
call fcn.0045809d
pop ecx
call fcn.0042e67b
test al, al
jne 0x43adda
push dword [ebp - 0x10]
call fcn.0044441e
pop ecx
push esi
push str.Could_not_unzip_file
jmp 0x43ac44
call fcn.0042e67b
test al, al
jne 0x43adf7
push dword [ebp - 0x10]
call fcn.0044441e
pop ecx
push dword [ebp + 0x2c4]
mov ecx, ebx
push dword [ebp - 0x14]
push edi
call fcn.0043aa5c
push edi
jmp 0x43ad02
Function at 0x43f5d3
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x3c0], ebx
je 0x43f63b
cmp dword [ebp + 8], 0x100
jne 0x43f62a
cmp word [ebp + 0xc], 0xd
jne 0x43f62a
cmp byte [esi + 0x3c6], bl
je 0x43f611
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x43f62a
cmp byte [esi + 0x3c7], bl
jne 0x43f62a
mov ecx, dword [esi + 0x44]
cmp ecx, ebx
je 0x43f626
push ebx
push ebx
push ebx
push str.return
push esi
call fcn.0042f982
xor eax, eax
jmp 0x43f63e
mov eax, dword [esi + 0x3c0]
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop esi
pop ebx
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x44165e
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
jne 0x441669
xor eax, eax
ret
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [esp + 0x14]
not eax
mov ecx, 0xff
cmp edi, 8
jb 0x441724
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x47b0b0]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x47b0b0]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x47b0b0]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x47b0b0]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x47b0b0]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x47b0b0]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x47b0b0]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x47b0b0]
inc edx
sub edi, 8
dec esi
jne 0x441689
pop ebx
test edi, edi
je 0x44173d
movzx esi, byte [edx]
xor esi, eax
and esi, ecx
shr eax, 8
xor eax, dword [esi*4 + 0x47b0b0]
inc edx
dec edi
jne 0x441728
pop edi
not eax
pop esi
ret

Function at 0x441bd4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x441c08
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x441c03
mov byte [esi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x441c30
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x441c19
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x10]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.0045d050
add esp, 0xc
add dword [esi + 0x18], edi
mov eax, edi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret
Function at 0x4429cd
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x48c0d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x442a77
movzx ecx, word [esi]
test cx, cx
je 0x442a77
mov eax, esi
mov edx, esi
movzx ecx, cx
cmp cx, 0x2f
je 0x442a0b
cmp cx, 0x5c
jne 0x442a0d
mov eax, edx
inc edx
inc edx
movzx ecx, word [edx]
test cx, cx
jne 0x4429ff
cmp eax, esi
je 0x442a4b
push edi
sub eax, esi
mov edi, eax
sar edi, 1
push edi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0045df8c
xor eax, eax
mov word [ebp + edi*2 - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.004429cd
add esp, 0x14
pop edi
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.0045df6d
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.0045df3f
add esp, 0x10
push 0
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00457a79
leave
ret

Function at 0x443fa8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x444023
cmp dword [esi + 4], 0xffffffff
jne 0x444023
push edi
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x4802e4
push edi
call fcn.0045df3f
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
pop edi
jne 0x443ff5
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x443ff5
mov eax, 0x2000000
jmp 0x444028
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004419ea
add esp, 0x10
test eax, eax
jne 0x444013
mov eax, dword [ebp + 0x10]
jmp 0x444028
push eax
call fcn.00443ba4
mov dword [esi], eax
mov eax, dword [0x48daec]
pop ecx
jmp 0x444028
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc
Function at 0x453b6a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
mov eax, dword [esi + 8]
push edi
mov edi, eax
and edi, 7
je 0x453b8f
cmp eax, edi
jge 0x453b87
mov eax, esi
call fcn.0045351e
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
xor ecx, ecx
cmp dword [esi + 8], ecx
jle 0x453bb1
mov al, byte [esi + 0xc]
shr dword [esi + 0xc], 8
add dword [esi + 8], 0xfffffff8
mov byte [ebp + ecx - 4], al
inc ecx
cmp dword [esi + 8], 0
jg 0x453b96
cmp ecx, 4
jge 0x453bd0
mov edi, dword [esi + 4]
mov eax, dword [esi]
cmp eax, edi
jb 0x453bbe
xor eax, eax
jmp 0x453bc6
mov dl, byte [eax]
inc eax
mov dword [esi], eax
movzx eax, dl
mov byte [ebp + ecx - 4], al
inc ecx
cmp ecx, 4
jl 0x453bb4
movzx edi, byte [ebp - 3]
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 2]
shl edi, 8
add edi, eax
movzx eax, byte [ebp - 1]
shl eax, 8
add eax, ecx
mov ecx, edi
xor ecx, 0xffff
cmp eax, ecx
je 0x453c02
mov eax, str.zlib_corrupt
call fcn.0045113b
jmp 0x453c3d
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x453c12
mov eax, str.read_past_buffer
jmp 0x453bfb
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x453c27
mov ecx, edi
call fcn.00453549
test eax, eax
je 0x453c3d
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.0045d050
add dword [esi], edi
add dword [esi + 0x10], edi
xor eax, eax
add esp, 0xc
inc eax
pop edi
pop esi
leave
ret

Function at 0x457a79
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x48c0d0]
jne 0x457a83
repz ret
jmp fcn.00460750
Function at 0x46d80a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004616c4
and dword [ebp - 4], 0
cmp dword [0x48e740], 0
mov ebx, eax
jne 0x46d8bb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x46d96c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x46d96c
push eax
call fcn.00461652
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x48e740], eax
call esi
push eax
call fcn.00461652
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x48e744], eax
call esi
push eax
call fcn.00461652
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x48e748], eax
call esi
push eax
call fcn.00461652
pop ecx
mov dword [0x48e750], eax
test eax, eax
je 0x46d8bb
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00461652
pop ecx
mov dword [0x48e74c], eax
mov eax, dword [0x48e74c]
cmp eax, ebx
je 0x46d913
cmp dword [0x48e750], ebx
je 0x46d913
push eax
call fcn.004616cd
push dword [0x48e750]
mov esi, eax
call fcn.004616cd
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x46d913
test edi, edi
je 0x46d913
call esi
test eax, eax
je 0x46d90a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x46d90a
test byte [ebp - 0xc], 1
jne 0x46d913
or dword [ebp + 0x10], 0x200000
jmp 0x46d94c
mov eax, dword [0x48e744]
cmp eax, ebx
je 0x46d94c
push eax
call fcn.004616cd
pop ecx
test eax, eax
je 0x46d94c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x46d94c
mov eax, dword [0x48e748]
cmp eax, ebx
je 0x46d94c
push eax
call fcn.004616cd
pop ecx
test eax, eax
je 0x46d94c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x48e740]
call fcn.004616cd
pop ecx
test eax, eax
je 0x46d96c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x46d96e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x411910
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xc000]
push edi
or ebp, 0xffffffff
jmp 0x411932
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x411939
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x411928
mov eax, 1
add ebx, ebx
jne 0x41194b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x411940
jne 0x41195c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x411940
xor ecx, ecx
sub eax, 3
jb 0x411970
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4119e2
mov ebp, eax
add ebx, ebx
jne 0x41197b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x411988
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4119ac
inc ecx
add ebx, ebx
jne 0x411998
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41198d
jne 0x4119a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41198d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4119cc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4119bd
jmp 0x41192e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4119cc
add edi, ecx
jmp 0x41192e
pop esi
mov edi, esi
mov ecx, 0x24f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4119ea
cmp byte [edi], 0
jne 0x4119ea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4119ef
lea edi, [esi + 0xf000]
mov eax, dword [edi]
or eax, eax
je 0x411a5e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x11e1c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x11ebc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x411a1c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x11ec0]
or eax, eax
je 0x411a58
mov dword [ebx], eax
add ebx, 4
jmp 0x411a39
call dword [esi + 0x11ec8]
mov ebp, dword [esi + 0x11ec4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1df]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x411a92
sub esp, 0xffffff80
jmp 0x404319
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x50533476
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x3df61294
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0xdd0dec
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdd0df6
pushal
call 0xdd0dfc
pop ebp
sub ebp, 0x10
sub ebp, 0x9d0dec
jmp 0xdd0e12
mov eax, 0x9d0dec
add eax, ebp
add eax, 0x4c
mov ecx, 0x5cd
mov edx, 0x119a0b9e
xor byte [eax], dl
inc eax
dec ecx
jne 0xdd0e29
jmp 0xdd0e3c
adc eax, 0xa2171553
sahf
sahf
sahf
pop ds
pop ss
mov byte [0x1f9e9e9e], al
pop edi
sahf
sahf
sahf
popfd
push ebx
lcall 0x9eb6, 0x249e9e9e
sahf
sahf
imul edi, dword [ebp + ebx*4 + 0x56], 0x9e921f15
sahf
sahf
popfd
pop ebx
adc edi, edx
mov edx, 0xba9a1762
adc edi, edx
mov edx, 0xba9a1762
mul byte [esi + 4]
mov edi, 0xec6af69e
in eax, 0x9e
lahf
mov dl, 0xba
not byte [eax + 0x763aed89]
wait
sahf
sahf
sahf
ja 0xdd0e3f
sahf
sahf
sahf
retf

Function at 0x430006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x66333933
nop
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
mov ecx, 0x1a3c3f95
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x405d9a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c574], 0
push esi
jne 0x405dd1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405dab
mov dword [ecx*4 + 0x42c570], eax
inc ecx
cmp ecx, 0x100
jl 0x405da6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405e02
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c570]
xor eax, esi
inc ecx
dec edx
jne 0x405de4
pop edi
not eax
pop esi
ret 0xc

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rsrc
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x432072
nop
mov ebx, 0x40c7d0
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x5ef4426d
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x432060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4320d2
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
mov esi, 0x5e6a404d
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219