joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c650
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa000]
push edi
or ebp, 0xffffffff
jmp 0x40c672
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40c679
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40c668
mov eax, 1
add ebx, ebx
jne 0x40c68b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40c680
jne 0x40c69c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c680
xor ecx, ecx
sub eax, 3
jb 0x40c6b0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40c722
mov ebp, eax
add ebx, ebx
jne 0x40c6bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40c6c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40c6ec
inc ecx
add ebx, ebx
jne 0x40c6d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40c6cd
jne 0x40c6e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c6cd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40c70c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40c6fd
jmp 0x40c66e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40c70c
add edi, ecx
jmp 0x40c66e
pop esi
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x40c774
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc050]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40c729
mov ecx, edi
jns 0x40c758
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc054]
or eax, eax
je 0x40c76e
mov dword [ebx], eax
add ebx, 4
jmp 0x40c746
call dword [esi + 0xc064]
mov ebp, dword [esi + 0xc058]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40c7a8
sub esp, 0xffffff80
jmp 0x40a6fc

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x403203
pop dword [ebp - 0x44]
mov eax, 0xc3d80827
add eax, 0x3c6829dc
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x2feca810
sub dword [ebp - 0x54], 0xe19a62c5
mov dword [ebp - 0x50], 0xa7e168b3
sub dword [ebp - 0x50], 0x75ae1c6e
mov dword [ebp - 0x4c], 0xc5eea33d
add dword [ebp - 0x4c], 0x865da0f1
mov dword [ebp - 0x48], 0xcc7f3e82
add dword [ebp - 0x48], 0x3380c17e
lea eax, [ebp - 0x54]
push eax
mov eax, 0x7d16ce2f
sub eax, 0x7cd65dcb
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x4ca54f01
sub dword [ebp - 0x54], 0xd832e5ab
mov dword [ebp - 0x50], 0xe6ca2580
sub dword [ebp - 0x50], 0xa55dc40b
mov dword [ebp - 0x4c], 0xe6cc96a0
sub dword [ebp - 0x4c], 0x835d2a34
mov dword [ebp - 0x48], 0xd18dd9d4
add dword [ebp - 0x48], 0x2e72262c
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3aa3d
push 0
call eax
mov ecx, 0x582f
xor esi, esi
add esi, eax
mov edx, 0x410000
add edx, dword [ebp - 0x44]
mov edi, 0x2383ef87
sub edi, 0xac6ed237
sub dword [ebp - 0x20], ecx
mov ebx, dword [edx]
sub ebx, edi
xor dword [ebp - 8], 0x59a4f395
mov dword [esi], ebx
xor dword [ebp - 0x2c], 0xa0866f37
add esi, 0x8d437da6
sub esi, 0x8d437da2
add edx, 4
loop 0x403316
add eax, 0x1538f
mov ebx, eax
add eax, 5
mov ecx, 0x2f2de5a
sub ecx, 0x2b2de5a
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x41aea4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x41aeb3
pop dword [ebp - 0x14]
mov eax, 0x2e853f4f
add eax, 0xd1bc6f64
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x29ce5a9f
add dword [ebp - 0x24], 0x2483eaac
mov dword [ebp - 0x20], 0x68094b4b
sub dword [ebp - 0x20], 0x35d5ff06
mov dword [ebp - 0x1c], 0x2ae063a1
sub dword [ebp - 0x1c], 0xde941f73
mov dword [ebp - 0x18], 0x1153a6a2
sub dword [ebp - 0x18], 0x1153a6a2
lea eax, [ebp - 0x24]
push eax
mov eax, 0x6d8a253f
add eax, 0x92bb8b25
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xf5756990
add dword [ebp - 0x24], 0x7efcffc6
mov dword [ebp - 0x20], 0xdcd7dc8e
add dword [ebp - 0x20], 0x649484e7
mov dword [ebp - 0x1c], 0xe3696364
sub dword [ebp - 0x1c], 0x7ff9f6f8
mov dword [ebp - 0x18], 0xa3b50958
add dword [ebp - 0x18], 0x5c4af6a8
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x8fe2a4e7
add eax, 0x70630b99
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x4d425
push 0
call eax
mov ecx, 0x47c2
mov edi, eax
mov edx, 0x476000
add edx, dword [ebp - 0x14]
mov esi, 0xc4cfa144
add esi, 0x72479c76
sub dword [ebp - 0xc], edx
mov ebx, dword [edx]
xor dword [ebp - 0x10], eax
xor ebx, esi
add dword [ebp - 4], ecx
mov dword [edi], ebx
add edi, 0x78c495f8
add edi, 0x873b6a0c
add edx, 0xe638c7f2
sub edx, 0xe638c7ee
loop 0x41afc9
add eax, 0xa2ad5475
add eax, 0x5d53bd66
xor ebx, ebx
add ebx, eax
add eax, 0x3a42c9f7
sub eax, 0x3a42c9f2
mov ecx, 0x79971b11
add ecx, 0x86a8e4ef
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x2f433cbc
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x58942116
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40401c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x404028
push 0x404024
push 0x404020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x404028]
push dword [0x404024]
push dword [0x404020]
mov dword [0x404014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x40129c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
push esi
push edi
xor edi, edi
mov dword [ebp - 0x84], 0
call fcn.00401c59
mov edi, eax
mov dword [ebp - 0x88], 0x2547
mov eax, dword [ebp - 0x88]
or eax, eax
jl 0x4012e4
cmp eax, dword [0x4040e0]
jge 0x4012e4
cmp byte [eax + 0x4040e4], 0x2e
jle 0x401374
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x8c], eax
jmp 0x401348
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x90], eax
jmp 0x401328
mov eax, dword [ebp - 0x90]
or eax, eax
jl 0x401321
cmp eax, dword [0x4040e0]
jge 0x401321
movsx eax, byte [eax + 0x4040e4]
cmp eax, 0xd3
jg 0x40133e
add dword [ebp - 0x90], 0x53
mov eax, dword [ebp - 0x90]
cmp eax, dword [ebp - 0x8c]
jle 0x40133e
cmp eax, dword [0x4040e0]
jl 0x401300
sub dword [ebp - 0x8c], 0x329
mov eax, dword [ebp - 0x8c]
cmp eax, 0x250a
jle 0x40135d
cmp eax, dword [0x4040e0]
jl 0x4012f2
add dword [ebp - 0x88], 0xfffffdfc
cmp dword [ebp - 0x88], 0x50
jg 0x4012c4
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov eax, edi
or al, 0x40
push eax
mov eax, dword [fcn.00401dfc]
mov edx, dword [0x4040dc]
sub edx, eax
push edx
push dword [0x4040d8]
call sub.KERNEL32.dll_VirtualProtect
cmp dword [ebp - 4], 0
je 0x4014c2
mov dword [ebp - 0x8c], 0x53
mov dword [ebp - 0x90], 0x27
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x94], eax
jmp 0x40142a
mov dword [ebp - 0x98], 0x43
mov eax, dword [ebp - 0x98]
or eax, eax
jl 0x4013f1
cmp eax, dword [0x4040e0]
jge 0x4013f1
movsx eax, byte [eax + 0x4040e4]
cmp eax, 0xee
jge 0x401423
mov eax, dword [ebp - 0x98]
or eax, eax
jl 0x40140d
cmp eax, dword [0x4040e0]
jge 0x40140d
cmp byte [eax + 0x4040e4], 0x5f
jl 0x401423
add dword [ebp - 0x98], 0xdf
cmp dword [ebp - 0x98], 0xf04
jl 0x4013d0
add dword [ebp - 0x94], 0x52
mov eax, dword [ebp - 0x94]
cmp eax, dword [ebp - 0x8c]
jle 0x401440
cmp eax, dword [0x4040e0]
jl 0x4013c6
add dword [ebp - 0x90], 0x1b9
cmp dword [ebp - 0x90], 0x218c
jl 0x4013b8
add dword [ebp - 0x8c], 0x155
cmp dword [ebp - 0x8c], 0x197e
jl 0x4013ae
push edi
call fcn.004019bd
lea eax, [ebp - 0x84]
push eax
push edi
call fcn.00401ac7
add esp, 0xc
mov eax, edi
add eax, 0x1ce00
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x84]
push eax
or edi, edi
je 0x4014ae
mov eax, dword [ebp - 0x88]
mov esi, eax
add esi, eax
jmp 0x4014b4
mov esi, dword [ebp - 0x88]
push esi
push 0x4040e4
call fcn.00401dfc
add esp, 0xc
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x401853
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov eax, esi
add eax, 0xc8
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0xc]
mov eax, edi
or eax, esi
mov ecx, dword [ebp - 4]
cdq
idiv ecx
mov dword [ebp - 0xc], eax
and dword [ebp - 8], 0
jmp 0x4019a6
mov edi, dword [ebp - 8]
mov ecx, edi
mov edx, esi
shl edx, cl
add edi, edx
imul edi, dword [ebp - 4]
mov dword [ebp - 0x14], edi
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 8], eax
jne 0x4018bf
mov edi, dword [ebp + 0xc]
mov eax, esi
mov ecx, edi
or cl, 1
cdq
idiv ecx
add edi, eax
mov edx, dword [ebp - 8]
mov ecx, esi
dec ecx
and edx, ecx
imul edx, dword [ebp - 4]
sub edi, edx
mov dword [ebp - 4], edi
cmp dword [ebp - 4], 0
je 0x4019b8
and dword [ebp - 0x10], 0
push esi
call fcn.004014c8
mov dword [ebp - 0x28], eax
mov edi, dword [ebp - 0x14]
mov ecx, esi
sar edi, cl
mov edx, eax
mov ecx, esi
inc ecx
mov eax, edx
imul eax, ecx
mov edx, dword [ebp - 4]
mov ecx, esi
shl edx, cl
push ecx
mov ecx, edx
cdq
idiv ecx
pop ecx
add edi, edx
mov dword [ebp - 0x20], edi
mov eax, edi
movzx eax, byte [ebx + eax]
add eax, esi
mov byte [ebp - 0x15], al
push esi
call fcn.004014c8
add esp, 8
mov dword [ebp - 0x24], eax
mov edi, eax
mov edx, dword [ebp - 4]
mov dword [ebp - 0x38], edx
mov ecx, dword [ebp - 0x14]
xor ecx, esi
mov dword [ebp - 0x30], ecx
mov eax, esi
mov dword [ebp - 0x34], eax
mov ecx, edi
or cl, 1
cdq
idiv ecx
mov dword [ebp - 0x3c], eax
mov edx, eax
add edx, edi
mov eax, edx
mov edi, dword [ebp - 0x38]
or di, 1
mov edx, esi
imul edx, edi
mov edi, dword [ebp - 0x38]
mov ecx, edi
sub ecx, edx
cdq
idiv ecx
mov edi, dword [ebp - 0x30]
add edi, edx
mov dword [ebp - 0x1c], edi
mov eax, edi
movzx edx, byte [ebx + eax]
mov ecx, edx
mov edi, esi
sar edi, cl
sub edx, edi
mov byte [ebp - 0x29], dl
or esi, esi
je 0x401977
movzx eax, byte [ebp - 0x15]
mov edx, eax
add edx, eax
mov dword [ebp - 0x40], edx
jmp 0x40197e
movzx eax, byte [ebp - 0x15]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x40]
mov byte [ebx + eax], dl
mov eax, dword [ebp - 0x20]
movzx edx, byte [ebp - 0x29]
or edx, esi
mov byte [ebx + eax], dl
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x7e8
jl 0x4018cd
inc dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, esi
inc ecx
cdq
idiv ecx
cmp dword [ebp - 8], eax
jle 0x401885
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401c59
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
push edi
xor esi, esi
mov edi, esi
xor edi, edi
inc edi
lea eax, [ebp - 0x104]
push eax
push 0x401c3f
call sub.USER32.DLL_EnumWindows
push 0
push 0
push 3
push 0
push 0
push 0x80000000
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_CreateFileA
mov dword [ebp - 0x108], eax
call sub.KERNEL32.dll_GetLastError
mov esi, eax
mov edi, esi
sub edi, 3
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
mov ecx, 0x16d90a94
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..rdata
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x2ca53058
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x406de0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x4075d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
jmp 0x4075ea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4075f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4075e0
mov eax, 1
add ebx, ebx
jne 0x407603
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4075f8
jne 0x407614
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4075f8
xor ecx, ecx
sub eax, 3
jb 0x407628
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40769a
mov ebp, eax
add ebx, ebx
jne 0x407633
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407640
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x407664
inc ecx
add ebx, ebx
jne 0x407650
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407645
jne 0x407661
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407645
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x407684
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x407675
jmp 0x4075e6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x407684
add edi, ecx
jmp 0x4075e6
pop esi
mov edi, esi
mov ecx, 2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4076a2
cmp byte [edi], 0
jne 0x4076a2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4076a7
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x407716
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x71c4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7228]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4076d4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x7230]
or eax, eax
je 0x407710
mov dword [ebx], eax
add ebx, 4
jmp 0x4076f1
call dword [esi + 0x722c]
mov ebp, dword [esi + 0x7234]
lea edi, [esi - 0x1000]
mov ebx, pe_overlay
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40774a
sub esp, 0xffffff80
jmp 0x401020
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x403ec0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x403ecf
pop dword [ebp - 0x2c]
mov eax, 0x403ecf
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xff1a4384
add dword [ebp - 0x3c], 0x4f3801c7
mov dword [ebp - 0x38], 0x9d963cd1
sub dword [ebp - 0x38], 0x6b62f08c
mov dword [ebp - 0x34], 0x6a90f397
sub dword [ebp - 0x34], 0x1e44af69
mov dword [ebp - 0x30], 0xc6563772
sub dword [ebp - 0x30], 0xc6563772
lea eax, [ebp - 0x3c]
push eax
mov eax, 0xfb8b801b
sub eax, 0xfb4a1f83
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x14c06288
add dword [ebp - 0x3c], 0x5fb206ce
mov dword [ebp - 0x38], 0x8c6a1f87
add dword [ebp - 0x38], 0xb50241ee
mov dword [ebp - 0x34], 0xc2370bb2
sub dword [ebp - 0x34], 0x5ec79f46
mov dword [ebp - 0x30], 0x7ded2481
sub dword [ebp - 0x30], 0x7ded2481
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3969e
push 0
call eax
mov ecx, 0x57a4305f
sub ecx, 0x57a3eeb9
xor edx, edx
add edx, eax
mov edi, 0x4d67bfc9
sub edi, 0x4d2519c9
add edi, dword [ebp - 0x2c]
mov esi, 0xcf1a981
sub esi, 0x12b61e35
xor dword [ebp - 0x20], 0xc36764d7
mov ebx, dword [edi]
xor dword [ebp - 8], 0xf35fad5a
xor ebx, esi
mov dword [ebp - 0x18], 0xe5eac6d3
mov dword [edx], ebx
xor dword [ebp - 4], 0x88d34895
add edx, 4
add edi, 4
loop 0x403fe9
add eax, 0xf96b
xor ebx, ebx
add ebx, eax
add eax, 0x828e304c
add eax, 0x7d71cfb9
mov ecx, 0x4b544302
sub ecx, 0x4b144302
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x405d6a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x405d79
pop dword [ebp - 0x38]
mov eax, 0x81afdb8a
sub eax, 0x816f7e11
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xeeca85b1
sub dword [ebp - 0x48], 0xa0784066
mov dword [ebp - 0x44], 0xcdb94728
add dword [ebp - 0x44], 0x647a051d
mov dword [ebp - 0x40], 0xb070964f
add dword [ebp - 0x40], 0x9bdbaddf
mov dword [ebp - 0x3c], 0xf5487264
sub dword [ebp - 0x3c], 0xf5487264
lea eax, [ebp - 0x48]
push eax
mov eax, 0x5179047c
sub eax, 0x51389460
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xa390f6f5
sub dword [ebp - 0x48], 0x2f1e8d9f
mov dword [ebp - 0x44], 0xb4ac1134
add dword [ebp - 0x44], 0x8cc05041
mov dword [ebp - 0x40], 0x2159556a
add dword [ebp - 0x40], 0x42161702
mov dword [ebp - 0x3c], 0x66c001b7
add dword [ebp - 0x3c], 0x993ffe49
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x5398a4b0
sub eax, 0x53583490
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x391b7
push 0
call eax
mov ecx, 0x4815641c
sub ecx, 0x4815168a
xor esi, esi
add esi, eax
mov edx, 0xceaf2bf
sub edx, 0xcaa2abf
add edx, dword [ebp - 0x38]
mov ebx, 0x17820969
add dword [ebp - 0x34], 0xf73f155d
mov edi, dword [edx]
sub dword [ebp - 0x24], eax
xor edi, ebx
sub dword [ebp - 0x28], 0x815afddf
mov dword [esi], edi
xor dword [ebp - 0x1c], edx
add esi, 0xe11016ff
sub esi, 0xe11016fb
add edx, 0xef75995d
sub edx, 0xef759959
loop 0x405e97
add eax, 0x6e65d8d4
sub eax, 0x6e64afb9
mov ebx, eax
add eax, 0xe3562707
add eax, 0x1ca9d8fe
mov ecx, 0xf495211d
add ecx, 0xbaadee3
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x12510d1f
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
mov eax, section..rsrc
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x6859533f
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x405b2e
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, esi
cmp dword [esi + 0x14], 0x10
jb 0x405b3d
mov eax, dword [esi]
cmp byte [eax], 0x2d
je 0x405b46
xor al, al
pop esi
ret
push str._Dsun.plugin2.jvm.args
push 0x16
push 0
mov ecx, esi
call fcn.0040433b
test eax, eax
jne 0x405b72
push str.Invalid_argument_1_n
call fcn.00401a09
pop ecx
call fcn.004019e9
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x405b7c
mov eax, dword [esi]
push dword [esp + 0xc]
push eax
call fcn.0040c28f
pop ecx
pop ecx
test al, al
jne 0x405b99
push str.Invalid_argument_2_n
call fcn.00401a09
pop ecx
jmp 0x405b42
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x405ba3
mov eax, dword [esi]
push eax
call fcn.0040606c
pop ecx
test al, al
je 0x405bcf
cmp dword [esi + 0x14], 0x10
jb 0x405bb6
mov esi, dword [esi]
push esi
call fcn.0040600b
push eax
call fcn.0040c28f
pop ecx
pop ecx
test al, al
jne 0x405bcf
push str.Invalid_argument_3_n
jmp 0x405b5f
mov al, 1
pop esi
ret