joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423414
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
push dword [esp + 0x20]
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
mov dword [esp + 0x14], eax
je 0x423453
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x10], ebx
je 0x423453
mov edi, dword [ebx]
add edi, 0x40
push edi
call fcn.00407fb0
mov esi, eax
pop ecx
test esi, esi
jne 0x42345a
xor eax, eax
jmp 0x423566
push edi
push ebx
push esi
call fcn.004074f0
mov edi, esi
add esp, 0xc
add edi, dword [esi]
mov dword [esp + 0x20], 0x10
mov edx, dword [edi]
xor eax, eax
mov ecx, 0x432110
cmp edx, dword [ecx]
je 0x42348c
add ecx, 8
inc eax
cmp ecx, 0x432130
jl 0x42347a
jmp 0x4234cb
push dword [eax*8 + 0x432114]
mov ebx, dword [sym.imp.USER32.dll_GetSysColor]
lea ebp, [eax*8 + 0x432114]
call ebx
push dword [ebp]
xor edx, edx
mov dh, al
mov dword [esp + 0x20], edx
call ebx
push dword [ebp]
mov ebx, dword [esp + 0x20]
mov bl, ah
shl ebx, 8
call dword [sym.imp.USER32.dll_GetSysColor]
shr eax, 0x10
movzx eax, al
or ebx, eax
mov dword [edi], ebx
add edi, 4
dec dword [esp + 0x20]
jne 0x423471
mov edi, dword [esi + 4]
mov ebx, dword [esi + 8]
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov ebp, eax
push ebx
push edi
push ebp
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push ebp
push 0
mov dword [esp + 0x28], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp dword [esp + 0x20], 0
je 0x423551
push dword [esp + 0x20]
mov ebp, dword [sym.imp.GDI32.dll_SelectObject]
push dword [0x4403c0]
call ebp
mov cl, byte [esi + 0xe]
push 0xcc0020
mov dword [esp + 0x20], eax
xor eax, eax
push eax
push esi
push 1
pop edx
shl edx, cl
mov ecx, dword [esp + 0x1c]
lea ecx, [ecx + edx*4 + 0x28]
push ecx
push ebx
push edi
push eax
push eax
push ebx
push edi
push eax
push eax
push dword [0x4403c0]
call dword [sym.imp.GDI32.dll_StretchDIBits]
push dword [esp + 0x1c]
push dword [0x4403c0]
call ebp
push esi
call fcn.00407f40
pop ecx
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.DLL_FreeResource]
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 8

Function at 0x423b98
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x7c], 0
je 0x423bdc
push dword [ebp + 8]
call fcn.0042d1c6
mov esi, eax
test esi, esi
je 0x423c07
lea eax, [ebp + 0x10]
push 4
push eax
push 4
push 0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
sete al
jmp 0x423c07
push dword [ebp + 0x10]
lea eax, [ebp - 0x10]
push 0x43c170
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x10]
push dword [esi + 0x90]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
pop edi
pop esi
leave
ret 0xc
Function at 0x423cad
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ecx + 0x7c], 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
je 0x423cf1
push dword [ebp + 8]
call fcn.0042d1c6
mov esi, eax
test esi, esi
je 0x423d47
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 3
push 0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
sete al
jmp 0x423d47
mov ebx, dword [ebp + 0x14]
lea eax, [ebx + ebx + 1]
push eax
call fcn.00417ccd
pop ecx
mov edi, eax
xor ecx, ecx
test ebx, ebx
jbe 0x423d29
mov esi, edi
mov eax, dword [ebp + 0x10]
add eax, ecx
mov dl, byte [eax]
and dl, 0xf
add dl, 0x41
mov byte [esi], dl
mov al, byte [eax]
shr al, 4
add al, 0x41
inc ecx
mov byte [esi + 1], al
inc esi
inc esi
cmp ecx, ebx
jb 0x423d09
and byte [edi + ecx*2], 0
mov ecx, dword [ebp - 4]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00423c0d
push edi
mov esi, eax
call fcn.00417d09
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x424454
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, ecx
push ebx
call fcn.00419390
test eax, eax
jne 0x424643
mov edi, dword [ebx + 4]
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.0040171b
test byte [esi + 0x64], 0x20
mov dword [ebp - 0x10], eax
jne 0x42449a
cmp edi, 0x201
je 0x42449a
cmp edi, 0x202
jne 0x4245f9
cmp edi, 0x200
jb 0x4244aa
cmp edi, 0x209
jbe 0x4244c2
cmp edi, 0xa0
jb 0x4245f9
cmp edi, 0xa9
ja 0x4245f9
call fcn.0042d551
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_ScreenToClient]
push 0x2c
lea eax, [ebp - 0x44]
pop edi
push edi
push 0
push eax
call fcn.00408080
add esp, 0xc
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], edi
mov edi, dword [esi]
push eax
mov ecx, esi
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [edi + 0x6c]
cmp dword [ebp - 0x20], 0xffffffff
mov dword [ebp + 8], eax
je 0x42451b
push dword [ebp - 0x20]
call fcn.00407f40
pop ecx
mov eax, 0x201
cmp dword [ebp - 4], eax
jne 0x424534
test byte [ebp - 0x3d], 0x80
je 0x424534
mov dword [ebp - 8], 1
jmp 0x424538
and dword [ebp - 8], 0
cmp dword [ebp - 4], eax
je 0x424556
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x424556
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x104]
mov dword [ebp + 8], eax
cmp dword [ebp + 8], 0
jl 0x4245c2
cmp dword [ebp - 8], 0
jne 0x4245c2
cmp dword [ebp - 4], 0x202
jne 0x424581
push 0xffffffffffffffff
mov ecx, esi
call dword [edi + 0xe4]
push 0xc8
push 0xe001
jmp 0x4245ac
test byte [esi + 0x60], 8
jne 0x4245b5
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x4245b5
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x104]
je 0x4245ed
push 0x12c
push 0xe000
mov ecx, esi
call fcn.0042421e
jmp 0x4245ed
push dword [ebp + 8]
mov ecx, esi
call dword [edi + 0xe4]
jmp 0x4245ed
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x4245d5
cmp dword [ebp - 8], 0
je 0x4245ed
push 0xffffffffffffffff
mov ecx, esi
call dword [edi + 0xe4]
push 0xe001
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov dword [ecx + 0x104], eax
mov ecx, esi
call fcn.0041a197
test eax, eax
je 0x42460e
cmp dword [eax + 0x50], 0
je 0x42460e
xor eax, eax
jmp 0x42463c
cmp dword [ebp - 0x10], 0
je 0x424634
mov edi, dword [ebp - 0x10]
push ebx
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 0x98]
test eax, eax
jne 0x424643
mov ecx, edi
call fcn.0041a02a
test eax, eax
mov dword [ebp - 0x10], eax
jne 0x424614
push ebx
mov ecx, esi
call fcn.0041b332
pop edi
pop esi
pop ebx
leave
ret 4
push 1
pop eax
jmp 0x42463c
Function at 0x42d38a
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x430ce4
call fcn.00407d30
push ecx
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
mov dword [esi], edi
mov dword [ebx], edi
cmp dword [ecx + 0x7c], edi
je 0x42d41d
push dword [ebp + 8]
call fcn.0042d1c6
cmp eax, edi
mov dword [ebp + 0x14], eax
je 0x42d449
lea ecx, [ebp + 0x10]
push ecx
lea ecx, [ebp - 0x10]
push edi
push ecx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0xc]
push eax
call edi
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx], eax
xor ebx, ebx
cmp dword [ebp + 8], ebx
jne 0x42d3ff
push eax
call fcn.00417ccd
pop ecx
mov dword [esi], eax
lea ecx, [ebp + 0x10]
push ecx
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 0x14]
call edi
mov dword [ebp + 8], eax
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 8], ebx
je 0x42d491
push dword [esi]
call fcn.00417d09
pop ecx
mov dword [esi], ebx
jmp 0x42d449
push edi
lea eax, [ebp + 0xc]
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call fcn.0042d278
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], edi
mov eax, dword [eax - 8]
cmp eax, edi
mov dword [ebp + 8], eax
jne 0x42d44d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0041c126
xor eax, eax
jmp 0x42d494
cdq
sub eax, edx
sar eax, 1
push eax
mov dword [ebx], eax
call fcn.00417ccd
cmp dword [ebp + 8], edi
pop ecx
mov dword [esi], eax
jle 0x42d485
mov eax, dword [ebp + 0xc]
add eax, edi
mov cl, byte [eax + 1]
shl cl, 4
add cl, byte [eax]
mov eax, edi
cdq
sub eax, edx
mov edx, dword [esi]
sub cl, 0x51
sar eax, 1
inc edi
inc edi
mov byte [eax + edx], cl
cmp edi, dword [ebp + 8]
jl 0x42d462
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0041c126
push 1
pop eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0x10

Function at 0x42d6b9
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x430d42
call fcn.00407d30
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CNoTrackObject.0
xor eax, eax
push 0xa
lea ecx, [esi + 0x30]
mov dword [ebp - 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
call fcn.004179fe
push 0xa
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 1
call fcn.004179fe
push 0xa
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 2
call fcn.004172fe
mov ecx, dword [ebp - 0xc]
mov dword [esi], vtable.AFX_MODULE_THREAD_STATE.0
mov dword [esi + 0xc], 0x54
mov dword [esi + 0x28], 0x417cb1
mov eax, esi
mov dword fs:[0], ecx
pop esi
leave
ret
Function at 0x42e39d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
call fcn.0042d8a4
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
test eax, eax
je 0x42e3dc
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
je 0x42e3dc
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov esi, eax
test esi, esi
jne 0x42e3e0
xor eax, eax
jmp 0x42e45a
movzx eax, word [esi + 6]
shl eax, 2
push eax
call fcn.00417ccd
and dword [ebp - 4], 0
cmp word [esi + 6], 0
pop ecx
mov ebx, eax
jbe 0x42e416
mov ecx, ebx
lea eax, [esi + 8]
movzx edx, word [eax]
inc dword [ebp - 4]
mov dword [ecx], edx
movzx edx, word [esi + 6]
inc eax
add ecx, 4
inc eax
cmp dword [ebp - 4], edx
jl 0x42e400
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 8]
push eax
push ebx
call fcn.0042e54d
push ebx
mov edi, eax
call fcn.00417d09
test edi, edi
pop ecx
je 0x42e458
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
lea esi, [ecx + 7]
push ecx
mov ecx, dword [ebp - 8]
lea edx, [eax + 7]
push eax
push esi
push edx
call fcn.0042e349
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
call fcn.0042e461
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x42ef88
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x431508
call fcn.00407d30
sub esp, 0x110
push ebx
push esi
lea eax, [ebp - 0x14]
push edi
push eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], ecx
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x42f047
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov ebx, 0xff
lea eax, [ebp - 0x11c]
push ebx
push eax
push esi
push dword [ebp - 0x14]
call edi
mov esi, eax
test esi, esi
jne 0x42f027
lea eax, [ebp - 0x11c]
lea ecx, [ebp - 0x18]
push eax
call fcn.0041c194
mov ecx, dword [ebp - 0x1c]
and dword [ebp - 4], esi
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
call fcn.0042ef88
mov esi, eax
xor eax, eax
test esi, esi
setne al
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
mov byte [ebp - 0xd], al
call fcn.0041c126
cmp byte [ebp - 0xd], 0
jne 0x42f027
lea eax, [ebp - 0x11c]
push ebx
push eax
push 0
push dword [ebp - 0x14]
jmp 0x42efd1
cmp esi, 0x103
je 0x42f037
cmp esi, 0x3f2
jne 0x42f047
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
Function at 0x42f3fa
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
push dword [edi]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x42f42a
mov eax, dword [esp + 0x10]
cmp eax, dword [esi + 8]
jl 0x42f4b4
cmp dword [esp + 0x14], ebx
je 0x42f4b4
cmp esi, ebx
jne 0x42f450
push 0x10
call fcn.0042f217
cmp eax, ebx
je 0x42f43f
mov dword [eax], vtable.CThreadData.0
mov esi, eax
jmp 0x42f441
xor esi, esi
push esi
lea ecx, [edi + 0x14]
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
call fcn.0042f1b9
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x42f467
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
jmp 0x42f477
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_LocalReAlloc]
cmp eax, ebx
mov dword [esi + 0xc], eax
jne 0x42f483
call fcn.00416c64
mov eax, dword [esi + 8]
mov ecx, eax
imul ecx, ecx, 0x3fffffff
add ecx, dword [edi + 0xc]
shl ecx, 2
push ecx
mov ecx, dword [esi + 0xc]
push ebx
lea eax, [ecx + eax*4]
push eax
call fcn.00408080
mov eax, dword [edi + 0xc]
add esp, 0xc
mov dword [esi + 8], eax
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
mov eax, dword [esi + 0xc]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov dword [eax + edx*4], ecx
pop ebx
ret 8

Function at 0x42f4ea
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 1
mov ebx, ecx
pop edi
cmp dword [esi + 8], edi
mov dword [ebp - 4], edi
jle 0x42f53d
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x42f520
mov ecx, dword [ebx + 0x10]
cmp dword [ecx + edi*8 + 4], eax
je 0x42f520
mov eax, dword [esi + 0xc]
cmp dword [eax + edi*4], 0
je 0x42f537
and dword [ebp - 4], 0
jmp 0x42f537
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + edi*4]
test ecx, ecx
je 0x42f530
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [esi + 0xc]
and dword [eax + edi*4], 0
inc edi
cmp edi, dword [esi + 8]
jl 0x42f501
cmp dword [ebp - 4], 0
je 0x42f56b
push esi
lea ecx, [ebx + 0x14]
call fcn.0042f1cc
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.DLL_LocalFree]
test esi, esi
je 0x42f561
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
push 0
push dword [ebx]
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x42fa4c
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.004091d0
pop ecx
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
add eax, esi
je 0x42fac8
mov edi, 0x80000000
and byte [eax], 0
lea eax, [ebp + 8]
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x42fac8
lea eax, [ebp - 0x108]
xor ebx, ebx
push 0x105
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x42faa5
push 1
pop ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x42fac8
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0x5c
push esi
call fcn.00409870
pop ecx
test eax, eax
pop ecx
jne 0x42fa73
push esi
call fcn.00407f40
pop ecx
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4c0f10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x81000]
push edi
or ebp, 0xffffffff
jmp 0x4c0f32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4c0f39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c0f28
mov eax, 1
add ebx, ebx
jne 0x4c0f4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4c0f5c
jne 0x4c0f7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c0f7b
dec eax
add ebx, ebx
jne 0x4c0f68
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4c0f40
add ebx, ebx
jne 0x4c0f77
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4c0fcd
xor ecx, ecx
sub eax, 3
jb 0x4c0f93
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4c1002
sar eax, 1
mov ebp, eax
jmp 0x4c0f9e
add ebx, ebx
jne 0x4c0f9e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c0f6c
inc ecx
add ebx, ebx
jne 0x4c0fac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c0f6c
add ebx, ebx
jne 0x4c0fb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4c0fae
jne 0x4c0fca
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4c0fae
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4c0fec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4c0fde
jmp 0x4c0f2e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4c0fec
add edi, ecx
jmp 0x4c0f2e
pop esi
mov edi, esi
mov ecx, 0x3485
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4c100a
cmp byte [edi], 0x4a
jne 0x4c100a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4c100f
lea edi, [esi + 0xbc000]
mov eax, dword [edi]
or eax, eax
je 0x4c1087
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xda35c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xda4b0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4c103c
mov ecx, edi
jns 0x4c106b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xda4b4]
or eax, eax
je 0x4c1081
mov dword [ebx], eax
add ebx, 4
jmp 0x4c1059
call dword [esi + 0xda4c4]
mov ebp, dword [esi + 0xda4b8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4c10bb
sub esp, 0xffffff80
jmp 0x4177a0
Function at 0x4189c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x417015
lea edi, [esi - 0x6015]
push edi
jmp 0x4189da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4189e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4189d0
mov eax, 1
add ebx, ebx
jne 0x4189f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4189e8
jne 0x418a04
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4189e8
xor ecx, ecx
sub eax, 3
jb 0x418a18
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x418a8a
mov ebp, eax
add ebx, ebx
jne 0x418a23
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x418a30
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x418a54
inc ecx
add ebx, ebx
jne 0x418a40
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x418a35
jne 0x418a51
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x418a35
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x418a74
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x418a65
jmp 0x4189d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x418a74
add edi, ecx
jmp 0x4189d6
pop esi
mov edi, esi
mov ecx, 0x1a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x418a92
cmp byte [edi], 0
jne 0x418a92
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x418a97
lea edi, [esi + 0x6000]
mov eax, dword [edi]
or eax, eax
je 0x418b06
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9144]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x91b0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x418ac4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x91b8]
or eax, eax
je 0x418b00
mov dword [ebx], eax
add ebx, 4
jmp 0x418ae1
call dword [esi + 0x91b4]
mov ebp, dword [esi + 0x91bc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x418b3a
sub esp, 0xffffff80
jmp 0x411ab0

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40501c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x405028
push 0x405024
push 0x405020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x405028]
push dword [0x405024]
push dword [0x405020]
mov dword [0x405014], esp
call fcn.00401507
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x44f00550
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x1c467095
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219