joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7640a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2a8000]
push edi
or ebp, 0xffffffff
jmp 0x7640c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x7640c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7640b8
mov eax, 1
add ebx, ebx
jne 0x7640db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x7640ec
jne 0x76410b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x76410b
dec eax
add ebx, ebx
jne 0x7640f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x7640d0
add ebx, ebx
jne 0x764107
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x76415d
xor ecx, ecx
sub eax, 3
jb 0x764123
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x764192
sar eax, 1
mov ebp, eax
jmp 0x76412e
add ebx, ebx
jne 0x76412e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7640fc
inc ecx
add ebx, ebx
jne 0x76413c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7640fc
add ebx, ebx
jne 0x764149
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x76413e
jne 0x76415a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x76413e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x76417c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x76416e
jmp 0x7640be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x76417c
add edi, ecx
jmp 0x7640be
pop esi
mov edi, esi
mov ecx, 0xaa2a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x76419a
cmp byte [edi], 0x26
jne 0x76419a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x76419f
lea edi, [esi + 0x360000]
mov eax, dword [edi]
or eax, eax
je 0x76420e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x381c94]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x381d9c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x7641cc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x381da4]
or eax, eax
je 0x764208
mov dword [ebx], eax
add ebx, 4
jmp 0x7641e9
call dword [esi + 0x381da0]
mov ebp, dword [esi + 0x381da8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x764242
sub esp, 0xffffff80
jmp 0x640828
Function at 0x461f20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x455015
lea edi, [esi - 0x54015]
push edi
or ebp, 0xffffffff
jmp 0x461f42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x461f49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x461f38
mov eax, 1
add ebx, ebx
jne 0x461f5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x461f50
jne 0x461f6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x461f50
xor ecx, ecx
sub eax, 3
jb 0x461f80
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x461ff2
mov ebp, eax
add ebx, ebx
jne 0x461f8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x461f98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x461fbc
inc ecx
add ebx, ebx
jne 0x461fa8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x461f9d
jne 0x461fb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x461f9d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x461fdc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x461fcd
jmp 0x461f3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x461fdc
add edi, ecx
jmp 0x461f3e
pop esi
mov edi, esi
mov ecx, 0x32d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x461ffa
cmp byte [edi], 0
jne 0x461ffa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x461fff
lea edi, [esi + 0x5f000]
mov eax, dword [edi]
or eax, eax
je 0x46206e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x621f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x62254]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x46202c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x62258]
or eax, eax
je 0x462068
mov dword [ebx], eax
add ebx, 4
jmp 0x462049
call dword [esi + 0x6225c]
popal
jmp 0x4095a4

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x41aafa
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4275a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040c3bc
and dword [ebp - 0x14], 0
cmp dword [0x824718], 0
mov dword [ebp - 0x18], eax
jne 0x41abad
push 0x403e08
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41ac55
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403dfc
push ebx
call edi
test eax, eax
je 0x41ac55
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403dec
push ebx
mov dword [0x824718], eax
call edi
push eax
call esi
push 0x403dd8
push ebx
mov dword [0x82471c], eax
call edi
push eax
call esi
push 0x403dbc
push ebx
mov dword [0x824720], eax
call edi
push eax
call esi
mov dword [0x824728], eax
test eax, eax
je 0x41abad
push 0x403da4
push ebx
call edi
push eax
call esi
mov dword [0x824724], eax
mov eax, dword [0x824724]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41ac06
cmp dword [0x824728], ecx
je 0x41ac06
push eax
call esi
push dword [0x824728]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41ac06
test ebx, ebx
je 0x41ac06
call edi
test eax, eax
je 0x41abfd
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41abfd
test byte [ebp - 8], 1
jne 0x41ac06
or dword [ebp + 0x10], 0x200000
jmp 0x41ac39
mov eax, dword [0x82471c]
cmp eax, dword [ebp - 0x18]
je 0x41ac39
push eax
call esi
test eax, eax
je 0x41ac39
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41ac39
mov eax, dword [0x824720]
cmp eax, dword [ebp - 0x18]
je 0x41ac39
push eax
call esi
test eax, eax
je 0x41ac39
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x824718]
call esi
test eax, eax
je 0x41ac55
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41ac57
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004071a4
leave
ret

Function at 0x41e540
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
mov eax, 0x6b
mov edx, 0x72
mov word [0xcceb88], ax
mov word [0xcceb8c], dx
mov ecx, 0x6e
mov edx, 0x65
xor eax, eax
push 0xcceb88
mov dword [0xcceb94], 0x320033
mov dword [0xcceb9c], 0x6c006c
mov word [0xcceb8e], cx
mov dword [0xcceb90], 0x6c0065
mov dword [0xcceb98], 0x64002e
mov word [0xcceb8a], dx
mov word [0xcceba0], ax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edx, dword [0xcceb84]
lea ecx, [esp]
push ecx
push 0x40
mov dword [0xcceb80], eax
mov eax, dword [0xccd370]
push edx
push eax
mov byte [0x824743], 0x65
mov dword [0x824739], 0x75747269
mov word [0x82473d], 0x6c61
mov byte [0x824738], 0x56
mov word [0x824744], 0x7463
mov byte [0x824746], 0
mov dword [0x82473f], 0x746f7250
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret
Function at 0x41e640
Capabilities:
Get common file path
Manipulate console buffer

Disassembly:
mov eax, 0x1280
call fcn.0041da20
cmp dword [0xcceb84], 0x37
push esi
jne 0x41e741
push 0
lea eax, [esp + 0x284]
push eax
push 0x403ee4
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointA]
mov esi, dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push 0
call esi
xor eax, eax
lea edx, [esp + 8]
push edx
push eax
push eax
push eax
push eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_ReadFileScatter]
push 0
lea eax, [esp + 0x684]
push eax
push 0x403ef0
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0
lea ecx, [esp + 0xa84]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [esp + 0x60]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 0
call esi
push 0x403f18
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
lea ecx, [esp + 0x1c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileSectionW]
push 0x30
lea eax, [esp + 0x34]
push 0
push eax
mov dword [esp + 0x38], 0
call fcn.004102c0
add esp, 0xc
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CommConfigDialogA]
mov edx, dword [0xcd12e8]
mov dword [esp + 4], edx
mov eax, 0x5d1
add dword [esp + 4], eax
mov eax, dword [esp + 4]
mov cl, byte [eax + ebx]
mov edx, dword [0xccd370]
mov byte [edx + ebx], cl
pop esi
add esp, 0x1280
ret
Function at 0x41e9e0
Capabilities:
Accept command line arguments
Get geographical location
Query environment variable

Disassembly:
mov eax, dword [0xcceb84]
mov ecx, dword [0xccd370]
sub esp, 0x984
push ebx
push ebp
shr eax, 3
xor ebp, ebp
push esi
push edi
cmp eax, ebp
jbe 0x41ebdb
mov dword [esp + 0x3c], 0x9e3779b9
mov dword [esp + 0x28], ecx
mov dword [esp + 0x30], eax
mov eax, dword [ecx + 4]
mov edi, dword [ecx]
mov ecx, dword [0x822058]
mov edx, dword [0x82205c]
mov dword [esp + 0x1c], eax
mov eax, dword [0x822060]
mov dword [esp + 0x48], ecx
mov ecx, dword [0x822064]
mov dword [esp + 0x18], 0xc6ef3720
mov dword [esp + 0x38], edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x44], ecx
mov dword [esp + 0x2c], 0x20
mov ebx, dword [esp + 0x18]
mov eax, edi
shl eax, 4
add eax, dword [esp + 0x34]
mov esi, edi
add ebx, edi
shr esi, 5
cmp dword [0xcceb84], 0x1b
mov dword [esp + 0x14], eax
jne 0x41ea96
push ebp
call dword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push ebp
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [esp + 0x14]
add esi, dword [esp + 0x44]
xor eax, ebx
mov dword [esp + 0x24], esi
mov dword [esp + 0x14], eax
mov dword [0xccd374], ebp
mov eax, dword [esp + 0x24]
add dword [0xccd374], eax
mov ecx, dword [0xccd374]
mov dword [esp + 0x40], ecx
mov dword [esp + 0x24], ebp
mov eax, dword [esp + 0x40]
add dword [esp + 0x24], eax
mov eax, dword [esp + 0x14]
xor eax, dword [esp + 0x24]
mov dword [esp + 0x24], eax
mov edx, dword [esp + 0x24]
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0x24]
sub dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov eax, ecx
shl eax, 4
add eax, dword [esp + 0x48]
add esi, ecx
cmp dword [0xcceb84], 0x1be
mov dword [esp + 0x14], eax
jne 0x41eb2b
push ebp
lea eax, [esp + 0x194]
push eax
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
shr ecx, 5
add ecx, dword [esp + 0x38]
cmp dword [0xcceb84], 0x979
mov dword [0xccd378], 0xff6b3619
mov dword [0xccd37c], 0xffffffff
mov dword [esp + 0x24], ecx
jne 0x41eb66
lea ecx, [esp + 0x50]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov eax, dword [esp + 0x14]
xor eax, esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
xor dword [esp + 0x14], eax
sub edi, dword [esp + 0x14]
mov dword [esp + 0x20], ebp
mov eax, dword [esp + 0x3c]
add dword [esp + 0x20], eax
sub dword [esp + 0x18], eax
dec dword [esp + 0x2c]
jne 0x41ea52
cmp dword [0xcceb84], 0x8d4
jne 0x41eba4
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x1c]
mov dword [eax], edi
mov dword [eax + 4], edx
cmp dword [0xcceb84], 0x17
jne 0x41ebc6
lea eax, [esp + 0x50]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov ecx, dword [esp + 0x28]
add ecx, 8
dec dword [esp + 0x30]
mov dword [esp + 0x28], ecx
jne 0x41ea12
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x984
ret
Function at 0x4021b2
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
enter 0x84, 0
sub ebp, 0x82
mov esi, eax
mov cl, byte [0x404050]
mov edx, eax
mov ebx, eax
shl edx, cl
mov eax, 0x404054
add edx, dword [0x404050]
call fcn.004020f3
xor eax, eax
mov dword [ebp + 0x7e], eax
lea eax, [ebp + 0x7e]
push eax
mov eax, esi
or al, 0x40
mov edi, 0x4039aa
push eax
sub edi, fcn.00403144
push edi
push fcn.00403144
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp + 0x7e], 0
je 0x402229
mov eax, fcn.00403144
mov ebx, esi
mov edx, edi
call fcn.004020f3
mov edx, 0x1c000
mov eax, 0x404054
mov ebx, esi
call fcn.00402d42
lea edx, [ebp - 2]
mov eax, esi
mov dword [ebp - 2], 0
call fcn.0040151f
lea eax, [esi + 0x1c000]
lea edi, [esi + 1]
imul edi, eax
mov ebx, 0x404054
or bl, 1
xor edx, edx
mov eax, esi
div ebx
lea ebx, [ebp - 2]
add eax, 0x404054
mov edx, edi
call fcn.00403144
lea esp, [ebp + 0x82]
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x117b7691
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x4464164b
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0xa1c058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00a1c1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa1c07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa1c06a
add dl, dl
jne 0xa1c089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa1c0dc
xor eax, eax
add dl, dl
jne 0xa1c096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa1c17d
add dl, dl
jne 0xa1c0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa1c0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa1c0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa1c0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa1c0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa1c075
mov eax, 1
add dl, dl
jne 0xa1c0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa1c0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa1c0e1
sub eax, ebx
mov ebx, 1
jne 0xa1c128
mov ecx, 1
add dl, dl
jne 0xa1c10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa1c119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa1c105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa1c075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa1c13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa1c14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa1c136
cmp eax, 0x7d00
jae 0xa1c16d
cmp eax, 0x500
jb 0xa1c168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa1c075
cmp eax, 0x7f
ja 0xa1c170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa1c075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa1c19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa1c075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401450
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
push dword [esp + 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x40147a
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x14]
test eax, eax
mov dword [ecx], eax
jne 0x40147e
xor eax, eax
pop esi
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x10]
push 1
mov dword [ecx], eax
pop eax
pop esi
ret

Function at 0x401499
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push edi
xor edi, edi
push edi
push 1
push edi
lea eax, [ebp - 4]
push edi
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x4014da
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x4014ed
push 8
push 1
push edi
lea eax, [ebp - 4]
push edi
push eax
call esi
test eax, eax
je 0x4014ed
lea eax, [ebp - 8]
push eax
push 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x4014f1
xor eax, eax
jmp 0x401503
cmp dword [ebp - 4], edi
je 0x401500
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret

Function at 0x401ce6
Capabilities:
Encode data using xor

Disassembly:
inc ebp
or byte [ebp - 0x66f68b2e], al
idiv dword [ebp + 0xc]
inc eax
imul eax, dword [ebp + 0xc]
pop ebp
ret
add edi, dword [edi + 0x6e]
pop ds
arpl word [eax - 0x4a], cx
lds edx, [ebx]
cld
loope 0x401d16
or dword [esi], edi
adc dword [ebp - 0x42572143], eax
pop ss
in eax, dx
jp 0x401cd5
idiv byte [eax + 0x5d]
jle 0x401d7c
mov esp, 0x64f368cf
inc esi
invalid
dec edi
mov ah, 0x63
sub al, 0xf5
push edx
lahf
cmp al, 0x31
invalid
sub byte [eax + 0x3b0017a5], ch
shr dword [esi + eax*2 + 0x3f], cl
adc al, 0xad
lodsd eax, dword [esi]
jmp 0x401ddc
lcall 0xc89e, 0x6aef3ce8
xor byte [ebp - 0x62], al
mov ebx, 0xfb9a6f42
mov bl, 0x1f
xor byte [esi + 0x2563e9e8], 0xd6
jns 0x401d87
ret
Function at 0x410c92
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4173c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040bc68
and dword [ebp - 0x14], 0
cmp dword [0x47c780], 0
mov dword [ebp - 0x18], eax
jne 0x410d45
push 0x403e78
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x410ded
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403e6c
push ebx
call edi
test eax, eax
je 0x410ded
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403e5c
push ebx
mov dword [0x47c780], eax
call edi
push eax
call esi
push 0x403e48
push ebx
mov dword [0x47c784], eax
call edi
push eax
call esi
push 0x403e2c
push ebx
mov dword [0x47c788], eax
call edi
push eax
call esi
mov dword [0x47c790], eax
test eax, eax
je 0x410d45
push 0x403e14
push ebx
call edi
push eax
call esi
mov dword [0x47c78c], eax
mov eax, dword [0x47c78c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x410d9e
cmp dword [0x47c790], ecx
je 0x410d9e
push eax
call esi
push dword [0x47c790]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x410d9e
test ebx, ebx
je 0x410d9e
call edi
test eax, eax
je 0x410d95
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x410d95
test byte [ebp - 8], 1
jne 0x410d9e
or dword [ebp + 0x10], 0x200000
jmp 0x410dd1
mov eax, dword [0x47c784]
cmp eax, dword [ebp - 0x18]
je 0x410dd1
push eax
call esi
test eax, eax
je 0x410dd1
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x410dd1
mov eax, dword [0x47c788]
cmp eax, dword [ebp - 0x18]
je 0x410dd1
push eax
call esi
test eax, eax
je 0x410dd1
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x47c780]
call esi
test eax, eax
je 0x410ded
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x410def
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004085a1
leave
ret