joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e5e80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov esi, ecx
je 0x4e5ea4
xor ebx, ebx
mov dword [esi], ebx
mov edx, dword [esi + 0x20]
cmp edx, ebx
jne 0x4e5f6d
xor eax, eax
jmp 0x4e5f83
mov eax, dword [esi]
test eax, eax
je 0x4e5eb9
dec eax
mov dword [esi], eax
pop edi
pop esi
mov eax, 2
pop ebx
pop ebp
ret 4
mov ecx, dword [esi + 0x3c]
sub ecx, dword [esi + 0x38]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov dword [ebp + 8], 0
je case.default.0x4e5f53
mov ecx, dword [esi + 0x38]
jmp 0x4e5ee0
mov edi, dword [ecx]
test edi, edi
jne 0x4e5eea
xor eax, eax
jmp 0x4e5f00
mov eax, dword [ecx + 8]
test eax, eax
je 0x4e5ef6
mov edx, dword [eax + 0xc]
jmp 0x4e5ef8
xor edx, edx
mov eax, dword [ecx + 4]
imul eax, edx
add eax, edi
cmp byte [eax + 8], 0
je 0x4e5f2d
test edi, edi
jne 0x4e5f0e
xor eax, eax
jmp 0x4e5f24
mov eax, dword [ecx + 8]
test eax, eax
je 0x4e5f1a
mov edx, dword [eax + 0xc]
jmp 0x4e5f1c
xor edx, edx
mov eax, dword [ecx + 4]
imul eax, edx
add eax, edi
cmp dword [eax + 0xa4], 0
jne case.0x4e5f53.2
mov eax, dword [ebp + 8]
inc eax
add ecx, 0xc
mov dword [ebp + 8], eax
cmp eax, ebx
jb 0x4e5ee0
jmp case.default.0x4e5f53
mov ecx, esi
call fcn.004dfa30
inc dword [esi + 0x98]
inc eax
cmp eax, 3
ja case.default.0x4e5f53
jmp dword [eax*4 + 0x4e6070]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 4
mov eax, dword [esi + 0x28]
cmp eax, ebx
je 0x4e5f79
mov ecx, dword [eax + 0xc]
jmp 0x4e5f7b
xor ecx, ecx
mov eax, dword [esi + 0x24]
imul eax, ecx
add eax, edx
mov edi, dword [eax + 4]
mov ecx, 0x5537a9
call fcn.004047e0
mov ecx, dword [0x552adc]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
call fcn.0043bd00
mov ecx, 0x55380c
call fcn.004174f0
mov ecx, dword [0x552af0]
mov eax, dword [ecx + 0x18]
cmp eax, ebx
jne 0x4e5fbd
xor ecx, ecx
jmp 0x4e5fd3
mov edx, dword [ecx + 0x20]
cmp edx, ebx
je 0x4e5fc9
mov edx, dword [edx + 0xc]
jmp 0x4e5fcb
xor edx, edx
mov ecx, dword [ecx + 0x1c]
imul ecx, edx
add ecx, eax
push str.bg_black.bgd
lea edi, [esi + 0x14]
push edi
call fcn.0043d890
test al, al
je 0x4e5f5a
mov dword [esi + 0x64], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], 0xffffffff
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], 0xff
mov dword [esi + 0x90], ebx
push ebx
mov ecx, edi
mov dword [esi + 0x80], ebx
call fcn.004b47f0
mov dword [esi + 0x68], eax
mov ecx, dword [esi + 0x20]
cmp ecx, ebx
jne 0x4e6040
xor eax, eax
jmp 0x4e6056
mov eax, dword [esi + 0x28]
cmp eax, ebx
je 0x4e604c
mov edx, dword [eax + 0xc]
jmp 0x4e604e
xor edx, edx
mov eax, dword [esi + 0x24]
imul eax, edx
add eax, ecx
mov eax, dword [eax + 4]
mov dword [esi + 0x6c], eax
mov dword [esi + 4], 8
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 4
Function at 0x4f4399
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x553988], 0
push esi
push edi
jne 0x4f430f
call fcn.004f427b
test eax, eax
je 0x4f4354
mov eax, dword [0x553988]
cmp eax, 1
jne 0x4f4330
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4f4354
jmp 0x4f4396
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x4f4396
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x4f4358
xor eax, eax
jmp 0x4f4396
mov eax, dword [esi]
push dword [0x553988]
call edi
mov edi, eax
test edi, edi
je 0x4f437a
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x4f4396
lea edi, [esi + 0xff0]
push esi
push dword [0x553988]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x4f4380
mov eax, esi
pop edi
pop esi
ret
jmp 0x4f42fb

Function at 0x4f4f8b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x551644]
jne 0x4f4f95
repz ret
jmp fcn.004facac
Function at 0x4ff48f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x551644]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004fa757
and dword [ebp - 0x14], 0
cmp dword [0x554718], 0
mov dword [ebp - 0x18], eax
jne 0x4ff542
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4ff5ea
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4ff5ea
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x525d64
push ebx
mov dword [0x554718], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x55471c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x554720], eax
call edi
push eax
call esi
mov dword [0x554728], eax
test eax, eax
je 0x4ff542
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x554724], eax
mov eax, dword [0x554724]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4ff59b
cmp dword [0x554728], ecx
je 0x4ff59b
push eax
call esi
push dword [0x554728]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4ff59b
test ebx, ebx
je 0x4ff59b
call edi
test eax, eax
je 0x4ff592
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4ff592
test byte [ebp - 8], 1
jne 0x4ff59b
or dword [ebp + 0x10], 0x200000
jmp 0x4ff5ce
mov eax, dword [0x55471c]
cmp eax, dword [ebp - 0x18]
je 0x4ff5ce
push eax
call esi
test eax, eax
je 0x4ff5ce
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4ff5ce
mov eax, dword [0x554720]
cmp eax, dword [ebp - 0x18]
je 0x4ff5ce
push eax
call esi
test eax, eax
je 0x4ff5ce
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x554718]
call esi
test eax, eax
je 0x4ff5ea
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4ff5ec
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f4f8b
leave
ret
Function at 0x401220
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
ror eax, 0xc2
not eax
mov eax, 0x66
inc eax
inc eax
mov esi, 0x62
add ebx, 0x33
bswap edi
inc eax
rcr esi, 0x56
not eax
bswap ebx
bswap ebx
dec edi
rol esi, 0xed
rol eax, 7
sub esi, 0x2d
rol eax, 0x35
sbb ebx, 0xdd
bswap eax
add esi, 0x1f
mov edi, 0x5f
dec edx
mov edi, 0xcf
imul esi
rcl edi, 0x61
neg esi
rcl edx, 0xc3
dec edx
or edi, 0xea
rcl edx, 0x37
dec edx
neg edx
dec edi
imul edi
sub ebx, 0xf
dec eax
imul edi
rol esi, 0xf2
bswap eax
not edx
add edx, 0x93
bswap ebx
bswap edi
or edi, 0x21
ror eax, 0xe4
dec edi
bswap ebx
bswap edx
not edi
xor ecx, ecx
xor edi, edi
or edx, 0x29
inc esi
bswap eax
rcr eax, 0x4e
or edi, 0x9f
dec ebx
or esi, 0x59
ror edi, 0x59
sbb edi, 0xd0
inc edi
ror eax, 0x1f
sbb esi, 0x30
mov edx, 0xf6
dec edx
mov ebx, 3
bswap edi
neg esi
mov edi, 0xaa
not esi
or eax, 0x28
sub esi, 0x69
or edi, 0xdc
or ebx, 0xf9
rol esi, 0xf7
rcl ebx, 0xa2
ror esi, 0xd
and edx, 0xbb
rcl edx, 0xda
ror eax, 0x44
bswap eax
imul edx
and edx, 0xe6
bswap edx
mov edx, 0x30
bswap edx
inc esi
mov edi, 0x3d
dec edx
or eax, 0x8c
imul edx
rcr eax, 0xd3
or esi, 0x87
sbb esi, 0xe5
not eax
dec ebx
add eax, 0xe5
and ebx, 0x4f
and ebx, 0x4e
rcr edi, 0x3d
neg eax
mov ecx, dword [ebp + 0xc]
dec edx
inc eax
or edx, 0x81
imul ebx
or eax, 0xc2
inc eax
sub esi, 0xcb
rcr edi, 0x25
and esi, 0xf4
bswap eax
dec ebx
ror eax, 0xe5
bswap edx
add edi, 0x8b
neg ebx
inc edx
add eax, 0xf1
add ebx, 0x48
and eax, 0x30
mov edi, 0xfd
rcr edi, 0x37
rcl ebx, 0xb6
not esi
imul esi
not edx
imul edi
rcr esi, 0xbf
bswap edi
inc eax
dec eax
bswap esi
bswap edx
mov esi, 0x1e
or edx, 2
bswap eax
neg ebx
ror edi, 0xa
sub edx, 0x31
rcr eax, 0xa9
rcr esi, 0x9a
neg edi
inc edi
bswap ebx
imul esi
inc ebx
or edx, 0x6b
rcl eax, 0x81
inc edx
neg edi
ror eax, 0x42
mov edi, dword [ebp + 8]
mov esi, eax
mov eax, eax
xor eax, ebx
not byte [edi]
xor eax, eax
xor esi, esi
mov ebx, esi
mov esi, esi
mov esi, ebx
mov esi, esi
xor eax, eax
mov eax, ebx
mov eax, esi
add byte [edi], 0x87
mov esi, esi
mov ebx, eax
xor ebx, ebx
mov esi, esi
mov ebx, esi
mov ebx, eax
xor esi, esi
xor esi, ebx
xor esi, eax
sub byte [edi], 0x54
mov ebx, esi
xor esi, eax
mov ebx, esi
mov ebx, ebx
xor eax, eax
mov ebx, esi
mov esi, esi
xor ebx, eax
xor eax, ebx
imul byte [edi]
inc edi
loop 0x4013df
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4077f5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410400]
jne 0x4077ff
repz ret
jmp fcn.00409b90
Function at 0x407e65
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406c15
and dword [ebp - 4], 0
cmp dword [0x411590], 0
mov ebx, eax
jne 0x407f16
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407fc7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x407fc7
push eax
call fcn.00406ba3
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x411590], eax
call esi
push eax
call fcn.00406ba3
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x411594], eax
call esi
push eax
call fcn.00406ba3
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x411598], eax
call esi
push eax
call fcn.00406ba3
pop ecx
mov dword [0x4115a0], eax
test eax, eax
je 0x407f16
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00406ba3
pop ecx
mov dword [0x41159c], eax
mov eax, dword [0x41159c]
cmp eax, ebx
je 0x407f6e
cmp dword [0x4115a0], ebx
je 0x407f6e
push eax
call fcn.00406c1e
push dword [0x4115a0]
mov esi, eax
call fcn.00406c1e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x407f6e
test edi, edi
je 0x407f6e
call esi
test eax, eax
je 0x407f65
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407f65
test byte [ebp - 0xc], 1
jne 0x407f6e
or dword [ebp + 0x10], 0x200000
jmp 0x407fa7
mov eax, dword [0x411594]
cmp eax, ebx
je 0x407fa7
push eax
call fcn.00406c1e
pop ecx
test eax, eax
je 0x407fa7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x407fa7
mov eax, dword [0x411598]
cmp eax, ebx
je 0x407fa7
push eax
call fcn.00406c1e
pop ecx
test eax, eax
je 0x407fa7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x411590]
call fcn.00406c1e
pop ecx
test eax, eax
je 0x407fc7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x407fc9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x6743d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x21d000]
push edi
jmp 0x6743ea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6743f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6743e0
mov eax, 1
add ebx, ebx
jne 0x674403
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x674414
jne 0x674433
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x674433
dec eax
add ebx, ebx
jne 0x674420
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x6743f8
add ebx, ebx
jne 0x67442f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x674485
xor ecx, ecx
sub eax, 3
jb 0x67444b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x6744ba
sar eax, 1
mov ebp, eax
jmp 0x674456
add ebx, ebx
jne 0x674456
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x674424
inc ecx
add ebx, ebx
jne 0x674464
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x674424
add ebx, ebx
jne 0x674471
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x674466
jne 0x674482
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x674466
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x6744a4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x674496
jmp 0x6743e6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x6744a4
add edi, ecx
jmp 0x6743e6
pop esi
mov edi, esi
mov ecx, 0x3eac
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x6744c2
cmp byte [edi], 0x11
jne 0x6744c2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x6744c7
lea edi, [esi + 0x26d000]
mov eax, dword [edi]
or eax, eax
je 0x67453f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x40e3a8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x40e524]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6744f4
mov ecx, edi
jns 0x674523
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x40e528]
or eax, eax
je 0x674539
mov dword [ebx], eax
add ebx, 4
jmp 0x674511
call dword [esi + 0x40e538]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x674570
cmp al, 0xef
ja 0x674563
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x674545
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x674552
mov ebp, dword [esi + 0x40e52c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x6745a4
sub esp, 0xffffff80
jmp 0x4288dd
Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40501c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x405028
push 0x405024
push 0x405020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x405028]
push dword [0x405024]
push dword [0x405020]
mov dword [0x405014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x50ce50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.QNhjSkbP
lea edi, [esi - 0x9000]
push edi
or ebp, 0xffffffff
jmp 0x50ce72
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x50ce79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50ce68
mov eax, 1
add ebx, ebx
jne 0x50ce8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x50ce80
jne 0x50ce9c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x50ce80
xor ecx, ecx
sub eax, 3
jb 0x50ceb0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x50cf22
mov ebp, eax
add ebx, ebx
jne 0x50cebb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x50cec8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x50ceec
inc ecx
add ebx, ebx
jne 0x50ced8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x50cecd
jne 0x50cee9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x50cecd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x50cf0c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x50cefd
jmp 0x50ce6e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x50cf0c
add edi, ecx
jmp 0x50ce6e
pop esi
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x50cf6b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xeacc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xeb24]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x50cf29
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xeb2c]
or eax, eax
je 0x50cf65
mov dword [ebx], eax
add ebx, 4
jmp 0x50cf46
call dword [esi + 0xeb28]
mov ebp, dword [esi + 0xeb30]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x50cf9f
sub esp, 0xffffff80
jmp section.bUItIFMf
Function at 0x510024
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx], al
add al, byte [eax]
add byte [eax], al
cld
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, byte [eax]
add byte [eax], al
cld
invalid
stc
jb 0x51002e
pop ds
xor esi, dword [ecx - 0x49]
jno 0x50ffe2
cwde
leave
jmp 0x51008f
pushal
jmp 0x510034
call 0x51003f
dec ecx
stc
mov dl, 0xed
pop ecx
pop ebx
jb 0x510049
jne 0x50ffd9
jge 0x510029
sbb dword [edx - 0x383c7edc], 0xffffffff
invalid
add ebx, 0xffffffc7
jmp 0x510058
cmp dword [ebx], 0
stc
jmp 0x510067
je 0x5100ed
jmp 0x510076
mov ecx, ebx
jmp 0x510081
add ebx, 4
jmp 0x510089
mov edx, dword [ebx]
jmp 0x510097
and eax, 0x8ced9cec
in eax, dx
cmp ebp, dword [ebx + 3]
sar ecx, cl
add edx, ebx
stc
jb 0x5100a3
mov ah, 0xb1
mov ebx, 0xc91a740d
mov eax, dword [ebx + 4]
jmp 0x5100ac
sub dword [edx], 0x3c62176a
jmp 0x5100b6
add edx, 4
jmp 0x5100bf
sub eax, 1
jmp 0x5100c6
jne 0x5100a6
jmp 0x5100d0
add ebx, 8
jmp 0x5100d7
sub dword [ecx], 1
stc
jb 0x5100de
and ecx, dword [edi]
test dword [eax + 0x72ffffff], esp
add dh, byte [ecx + 0xee83b]
add byte [eax], al
jne 0x510084
jb 0x5100e8
mov cl, 0x3b
call 0x5100fb
jmp 0x5100f1
popal
jmp 0x5100f6
jmp 0x50ed00

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x640b696c
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x433024
nop
nop
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x61e81818
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0xa21370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0xa2138e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0xa4a074
push ecx
mov edi, eax
call fcn.00a35198
mov esi, eax
add esp, 8
test esi, esi
jne 0xa213cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.00a3502e
push esi
call fcn.00a34fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0xa24850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0xa248ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0xa4f720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xa248ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.00a351e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0xa248ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0xa4f720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xa2492a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.00a36082
xor esi, esi
add esp, 8
cmp eax, esi
je 0xa24957
mov word [eax], si
add eax, 2
push eax
call fcn.00a36030
add esp, 4
jmp 0xa24959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0xa248ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0xa248b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0xa24ff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret