joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e0079ad
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push ebx
push esi
push 0x5e001794
push 0x5e00179c
push 0x5e0015a0
call fcn.5e0051bb
add esp, 0xc
or ebx, 0xffffffff
test eax, eax
je 0x5e007a13
mov esi, 0x5e001950
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x5e0079fd
test cl, cl
je 0x5e0079f9
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x5e0079fd
inc eax
inc eax
inc esi
inc esi
test cl, cl
jne 0x5e0079db
xor eax, eax
jmp 0x5e007a01
sbb eax, eax
sbb eax, ebx
test eax, eax
jne 0x5e007a13
call fcn.5e007c11
cmp eax, 1
je 0x5e007b28
push edi
mov edi, 0x5e01f2a0
mov ecx, ebx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x20c]
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
lea edx, [ebp - 0x20c]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x5e00130c
mov ecx, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
mov ecx, ebx
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, 0x5e0014a4
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
mov ecx, ebx
repne scasb al, byte es:[edi]
not ecx
lea esi, [ebp - 0x20c]
sub edi, ecx
mov eax, ecx
mov ecx, esi
mov esi, edi
mov edi, ecx
mov dword [ebp - 4], eax
mov ecx, ebx
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [ebp - 4]
dec edi
mov ecx, eax
lea ebx, [ebp - 0x414]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov ax, word [0x5e001654]
and ecx, 3
mov word [ebp - 0x414], ax
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 0x20c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
lea eax, [ebp - 0x414]
push eax
push 0x5e020440
call fcn.5e0074ba
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 1
lea eax, [ebp - 0x20c]
pop esi
push esi
push esi
push 0x5e00194c
push eax
call fcn.5e007b2c
add esp, 0x10
mov dword [0x5e01c50c], esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5e007b2c
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push esi
push edi
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x5e007b4b
push 1
pop eax
jmp 0x5e007c0d
push 0x11
xor eax, eax
pop ecx
lea edi, [ebp - 0x60]
rep stosd dword es:[edi], eax
push 1
lea eax, [ebp - 0x1c]
pop edi
xor esi, esi
push eax
lea eax, [ebp - 0x60]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
mov dword [ebp - 0x60], 0x44
push dword [ebp + 0xc]
mov word [ebp - 0x30], di
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x5e007bd4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xc]
push 0x5e0015c8
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0xc]
push 0x5e0015b8
push 0x5e001338
push eax
push 0x5e001334
push dword [0x5e020428]
call fcn.5e0031db
add esp, 0xc
push eax
call fcn.5e0031db
push eax
push edi
push 0x10
push edi
call fcn.5e0047be
add esp, 0x1c
mov eax, edi
jmp 0x5e007c0d
cmp dword [ebp + 0x10], edi
jne 0x5e007c0b
call fcn.5e005f7c
lea eax, [ebp + 8]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp + 8], 0x103
je 0x5e007bd9
cmp dword [ebp + 8], esi
je 0x5e007c0b
cmp dword [ebp + 0x14], edi
je 0x5e007c0b
push esi
call fcn.5e005da0
pop ecx
push edi
call fcn.5e010d37
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x5e00847f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 0xc], 0
and dword [ebp - 8], 0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], 0xc
push edi
call esi
add eax, eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x5e0084f0
mov ecx, ebx
mov eax, edi
mov dl, byte [eax]
mov byte [ecx], dl
cmp byte [eax], 0xa
jne 0x5e0084ce
cmp byte [eax + 1], 0xd
je 0x5e0084ce
mov byte [ecx], 0xd
inc ecx
mov byte [ecx], 0xa
inc eax
inc ecx
cmp byte [eax], 0
jne 0x5e0084b8
push ebx
call esi
cmp byte [ebx + eax - 1], 0xa
je 0x5e0084eb
push 0x5e0013b4
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp + 8], ebx
jmp 0x5e0084f3
mov dword [ebp + 8], edi
push 0
push 0x80
lea eax, [ebp - 0x10]
push 4
push eax
push 0
push 0x40000000
push 0x5e01bdd0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x5e008541
push 2
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x5e008541
lea eax, [ebp - 4]
push 0
push eax
push dword [ebp + 8]
call esi
push eax
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp edi, 0xffffffff
je 0x5e008554
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5e0088f3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
push edi
push 0x11
xor eax, eax
pop ecx
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
mov ax, word [ebp + 0xc]
xor esi, esi
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push esi
or dword [ebp - 0x28], 1
push esi
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 0x54], 0x44
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x5e008962
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, esi
jne 0x5e008962
lea eax, [ebp + 0xc]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp eax, 1
jne 0x5e008962
xor eax, eax
cmp dword [ebp + 0xc], esi
setne al
dec eax
jmp 0x5e008964
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x5e009912
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
lea eax, [ebp - 0x108]
push 1
push eax
call fcn.5e009d99
pop ecx
test eax, eax
pop ecx
je 0x5e009953
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
push dword [ebp + 8]
call esi
mov edi, eax
lea eax, [ebp - 0x108]
push eax
call esi
add edi, eax
cmp edi, 0x104
pop edi
pop esi
jle 0x5e009957
xor eax, eax
leave
ret
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x5e009982
test al, 0x10
je 0x5e009982
push 1
pop eax
leave
ret
lea eax, [ebp - 0x108]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
leave
ret
Function at 0x5e009d99
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 8]
push edi
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x5e009e01
xor eax, eax
lea ecx, [ebp - 4]
cmp dword [ebp + 0xc], eax
push ecx
je 0x5e009dbd
push 2
jmp 0x5e009dbf
push 0x17
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x5e009e01
mov edi, dword [ebp + 8]
push edi
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
jl 0x5e009e01
mov eax, dword [ebp - 8]
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
call esi
cmp byte [eax + edi - 2], 0x5c
je 0x5e009e11
push edi
call esi
cmp eax, 0x103
jl 0x5e009e05
xor eax, eax
jmp 0x5e009e14
push 0x5e00130c
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 1
pop eax
pop edi
pop esi
leave
ret

Function at 0x5e009e97
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x5e009ed2
cmp dword [ebp + 0xc], 0
je 0x5e009ec2
lea eax, [ebp - 4]
push eax
push 7
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x5e009ed2
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
jge 0x5e009ed6
xor eax, eax
leave
ret
mov eax, dword [ebp - 8]
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
push 1
pop eax
leave
ret

Function at 0x5e00b71c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ecx
push edx
push esi
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov edx, ecx
cmp edx, 4
jl 0x5e00b763
cmp edx, 0x10
jl 0x5e00b74f
shr ecx, 4
nop
xor eax, dword [ebx]
mov esi, dword [ebx + 4]
xor eax, dword [ebx + 8]
xor esi, dword [ebx + 0xc]
add ebx, 0x10
xor eax, esi
dec ecx
jne 0x5e00b73c
mov ecx, edx
shr ecx, 2
and ecx, 3
test ecx, ecx
je 0x5e00b763
xor eax, dword [ebx]
add ebx, 4
dec ecx
jne 0x5e00b75b
and edx, 3
cmp edx, 3
jne 0x5e00b777
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 0x10
xor eax, ecx
jmp 0x5e00b77c
cmp edx, 2
jne 0x5e00b788
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 8
xor eax, ecx
jmp 0x5e00b78d
cmp edx, 1
jne 0x5e00b793
xor ecx, ecx
mov cl, byte [ebx]
xor eax, ecx
pop esi
pop edx
pop ecx
pop ebx
ret
Function at 0x5e0108e8
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x5e010913
test byte [esp + 8], 0x80
je 0x5e010902
and al, 0xfe
jmp 0x5e010904
or al, 1
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x5e010924
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.5e013266
pop ecx
or eax, 0xffffffff
ret
xor eax, eax
ret

Function at 0x5e0121e7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x5e012207
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.5e013266
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x5e01222a
test byte [esp + 8], 2
je 0x5e01222a
call fcn.5e0132d9
mov dword [eax], 0xd
call fcn.5e0132e2
mov dword [eax], 5
jmp 0x5e012203
xor eax, eax
ret

Function at 0x5e012d0d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x5e01a418
cmp edx, dword [eax]
je 0x5e012d2f
add eax, 8
inc ecx
cmp eax, 0x5e01a4a8
jl 0x5e012d20
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x5e01a418]
jne 0x5e012e5d
mov eax, dword [0x5e01ea00]
cmp eax, 1
je 0x5e012e37
test eax, eax
jne 0x5e012d60
cmp dword [0x5e01a324], 1
je 0x5e012e37
cmp edx, 0xfc
je 0x5e012e5d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x5e012d97
lea eax, [ebp - 0x1a4]
push 0x5e0020e4
push eax
call fcn.5e0146e0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.5e0135c0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x5e012dda
lea eax, [ebp - 0x1a4]
push eax
call fcn.5e0135c0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x5e0020e0
push edi
call fcn.5e010f00
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x5e0020c4
push eax
call fcn.5e0146e0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.5e0146f0
lea eax, [ebp - 0xa0]
push 0x5e0020c0
push eax
call fcn.5e0146f0
push dword [esi + 0x5e01a41c]
lea eax, [ebp - 0xa0]
push eax
call fcn.5e0146f0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x5e002098
push eax
call fcn.5e015e62
add esp, 0x2c
pop edi
jmp 0x5e012e5d
lea eax, [ebp + 8]
lea esi, [esi + 0x5e01a41c]
push 0
push eax
push dword [esi]
call fcn.5e0135c0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x8982a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x414000]
push edi
jmp 0x8982ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x8982c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8982b0
mov eax, 1
add ebx, ebx
jne 0x8982d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x8982e4
jne 0x898303
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x898303
dec eax
add ebx, ebx
jne 0x8982f0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x8982c8
add ebx, ebx
jne 0x8982ff
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x898355
xor ecx, ecx
sub eax, 3
jb 0x89831b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x89838a
sar eax, 1
mov ebp, eax
jmp 0x898326
add ebx, ebx
jne 0x898326
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8982f4
inc ecx
add ebx, ebx
jne 0x898334
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8982f4
add ebx, ebx
jne 0x898341
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x898336
jne 0x898352
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x898336
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x898374
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x898366
jmp 0x8982b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x898374
add edi, ecx
jmp 0x8982b6
pop esi
mov edi, esi
mov ecx, 0x40d0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x898392
cmp byte [edi], 0x13
jne 0x898392
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x898397
lea edi, [esi + 0x463000]
mov eax, dword [edi]
or eax, eax
je 0x898406
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4b3998]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4b3d1c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x8983c4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4b3d20]
or eax, eax
je 0x898400
mov dword [ebx], eax
add ebx, 4
jmp 0x8983e1
call dword [esi + 0x4b3d30]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x898437
cmp al, 0xef
ja 0x89842a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x89840c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x898419
mov ebp, dword [esi + 0x4b3d24]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x89846b
sub esp, 0xffffff80
jmp 0x4b72d8
Function at 0x4fb2a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa0000]
push edi
jmp 0x4fb2ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4fb2c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4fb2b0
mov eax, 1
add ebx, ebx
jne 0x4fb2d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4fb2e4
jne 0x4fb303
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4fb303
dec eax
add ebx, ebx
jne 0x4fb2f0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4fb2c8
add ebx, ebx
jne 0x4fb2ff
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4fb355
xor ecx, ecx
sub eax, 3
jb 0x4fb31b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4fb38a
sar eax, 1
mov ebp, eax
jmp 0x4fb326
add ebx, ebx
jne 0x4fb326
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4fb2f4
inc ecx
add ebx, ebx
jne 0x4fb334
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4fb2f4
add ebx, ebx
jne 0x4fb341
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4fb336
jne 0x4fb352
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4fb336
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4fb374
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4fb366
jmp 0x4fb2b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4fb374
add edi, ecx
jmp 0x4fb2b6
pop esi
mov edi, esi
mov ecx, 0x3b6c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4fb392
cmp byte [edi], 0x17
jne 0x4fb392
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4fb397
lea edi, [esi + 0xf5000]
mov eax, dword [edi]
or eax, eax
je 0x4fb406
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x114994]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x114a28]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4fb3c4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x114a30]
or eax, eax
je 0x4fb400
mov dword [ebx], eax
add ebx, 4
jmp 0x4fb3e1
call dword [esi + 0x114a2c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4fb437
cmp al, 0xef
ja 0x4fb42a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4fb40c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4fb419
mov ebp, dword [esi + 0x114a34]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4fb46b
sub esp, 0xffffff80
jmp 0x435126
Function at 0x4017ea
Capabilities:
Encode data using xor

Disassembly:
mov ebp, edi
xchg ecx, edx
lea ebp, [0x7603d355]
mov ebp, edx
mov ebp, edi
mov cl, 0x31
push edi
push 0x9be7d4
imul ebp, ecx, 0xebd09c4e
imul ebx, ecx, 0x315a335c
call 0x401812
pop esi
mov cl, dl
xchg ah, dl
test edi, ebx
js 0x40181d
adc bl, dh
add esi, 0x1c71
jmp 0x401829
add esi, 0xc29
sbb ebp, edi
test cl, 0xd5
xchg ebp, eax
lea edx, [0xc77bb230]
cmp cl, ah
mov edx, 0xc822facd
mov ebx, esi
jmp 0x40184a
js 0x401856
dec cl
lea ecx, [0x18cefbeb]
test cl, al
test ebx, 0x71e77c2a
lea ebx, [eax]
sub ecx, 0x54ec72e0
movsx edi, dh
lea edx, [ebx]
test edi, ebp
ja 0x401879
mov edi, 0xf5d4f907
imul ebp, edi, 0x70e50819
imul ecx, edi, 0x1094085c
dec ebx
add eax, edx
mov cl, 0x7d
movzx ebp, si
test edx, ebx
lea eax, [0x24366500]
mov ch, dl
cmp edx, 0x8e26
jne 0x4018a1
mov edx, 0xd16f405e
xor edi, edi
mov dh, cl
test ah, 0x19
xchg ebx, edx
mov ebp, 0x8b20e208
test dh, al
add edi, 0x5d4be
sub eax, 0xc47556b2
sub edi, 0x5d4bd
and cl, 0x34
test edx, ebp
mov bl, ch
imul ebx, edx
xor edx, esi
mov cl, ah
dec ebx
cmp edi, 0x44b
jbe 0x4018a3
xor al, 0xc9
mov al, 9
imul ebp, esi
movsx ecx, cl
and eax, 0x574b3e72
push esi
repz ret
Function at 0x401150
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x130
mov eax, dword [0x48f120]
xor eax, esp
mov dword [esp + 0x12c], eax
push esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
lea eax, [esp + 4]
mov dword [esp + 4], 8
push eax
mov dword [esp + 0xc], 0x403
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
lea ecx, [esp + 0x28]
call fcn.00410530
lea ecx, [esp + 0x80]
call fcn.004078e0
lea ecx, [esp + 0x28]
call fcn.00413070
test eax, eax
je 0x4011bf
mov esi, 1
jmp 0x401223
push 5
push dword [esp + 0x30]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esp + 0x2c]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [esp + 0xc]
push 0
push 0
push 0
push eax
call esi
test eax, eax
jle 0x401221
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
push edi
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
nop word [eax + eax]
lea eax, [esp + 0x14]
push eax
call edi
lea eax, [esp + 0x14]
push eax
call ebx
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
call esi
test eax, eax
jg 0x401200
pop edi
pop ebx
xor esi, esi
lea ecx, [esp + 0x28]
call fcn.00410df0
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [esp + 0x130]
mov eax, esi
pop esi
xor ecx, esp
call fcn.004481b5
add esp, 0x130
ret 0x10

Function at 0x405b30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47663c
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x48f120]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov dword [ebp - 4], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
lea esi, [edi + 0x38]
mov dword [edi + 0x30], 0
mov byte [edi + 0x34], 0
mov dword [ebp - 0x14], esi
mov dword [esi + 0x24], 0
mov ecx, dword [ebp + 0x30]
mov byte [ebp - 4], 4
test ecx, ecx
je 0x405be4
mov eax, dword [ecx]
push esi
call dword [eax]
mov dword [esi + 0x24], eax
mov al, byte [ebp + 0x34]
lea ecx, [edi + 0x70]
mov byte [edi + 0x60], al
push 9
mov byte [ebp - 4], 5
mov byte [edi + 0x68], 9
call fcn.00405eb0
lea eax, [ebp - 0xd]
mov byte [ebp - 4], 6
push eax
lea ecx, [edi + 0x10]
mov byte [ebp - 0xd], 1
call fcn.0040dbf0
mov ecx, dword [ebp + 0x30]
test ecx, ecx
je 0x405c28
mov esi, dword [ecx]
lea eax, [ebp + 0xc]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x30