joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a560
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x400
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x30]
push ebx
push 0x400
push esi
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
cmp eax, 0x3ff
jl 0x44a5ca
push esi
lea edi, [eax + 0x400]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edx, dword [esp + 0x38]
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x24]
push ebx
push edi
push esi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
dec edi
cmp eax, edi
jge 0x44a59a
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x44a5e6
push ecx
push esi
call fcn.0044b6e0
add esp, 8
mov ebx, eax
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x44a640
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x44a65e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x44a653
pop esi
ret

Function at 0x44a6b0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x44a742
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x44a734
mov ebp, dword [sym.imp.KERNEL32.DLL_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x44a72c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x44a6f5
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
Function at 0x401000
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 8], 1
jne 0x401014
mov eax, dword [0x4370cc]
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
jmp 0x401026
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [0x4370d0]
shr edx, 1
cmp dword [ebp - 4], edx
jae 0x4010ab
mov eax, dword [ebp - 4]
mov ecx, dword [0x4370b4]
movzx edx, word [ecx + eax*2]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
shr eax, 0xc
cmp eax, 3
jne 0x4010a6
mov ecx, dword [ebp - 0xc]
and ecx, 0xfff
add ecx, 0x1474
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
sub edx, 0x1474
mov dword [ebp - 8], edx
cmp dword [ebp - 4], 0
jne 0x401087
push 0x20e
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x401087
xor eax, eax
jmp 0x4010ab
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax]
mov edx, dword [ebp - 8]
mov eax, dword [ecx + edx]
add eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
add edx, dword [ecx]
mov ecx, dword [ebp - 8]
mov dword [edx + ecx], eax
jmp 0x40101d
mov esp, ebp
pop ebp
ret

Function at 0x4019c0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [0x4370c0], 0x24e1
mov eax, dword [0x4370c0]
sub eax, 0x24e1
mov dword [0x4370c0], eax
mov ecx, 1
test ecx, ecx
je 0x401a6b
mov edx, dword [0x4370c0]
cmp edx, dword [ebp + 0xc]
jb 0x4019f7
jmp 0x401a6b
cmp dword [0x4370c0], 0
jne 0x401a15
push 0x263
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x401a15
xor eax, eax
jmp 0x401a6b
mov eax, dword [ebp + 8]
add eax, dword [0x4370c0]
mov ecx, dword [eax]
add ecx, dword [0x4370c0]
mov edx, dword [ebp + 8]
add edx, dword [0x4370c0]
mov dword [edx], ecx
mov dword [ebp - 4], 0x156
mov eax, dword [0x4370c0]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 2]
push edx
mov eax, dword [ebp + 8]
add eax, dword [0x4370c0]
push eax
call fcn.004011d0
add esp, 8
mov ecx, dword [0x4370c0]
add ecx, 4
mov dword [0x4370c0], ecx
jmp 0x4019dd
mov esp, ebp
pop ebp
ret
Function at 0x401a70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov dword [ebp - 0x114], 0x437080
mov eax, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x11c], eax
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, dword [ebp - 0x114]
push edx
lea eax, [ebp - 0x110]
push eax
call dword [ebp - 0x11c]
push 0
push 0x80
push 3
push 0
push 3
push 1
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
je 0x401aea
cmp dword [ebp - 0x118], 0
je 0x401aea
jmp 0x401b4c
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0
je 0x401b4c
mov dword [ebp - 0x120], 0x3c41
mov eax, dword [ebp + 8]
add eax, 8
mov dword [0x4370b4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [0x4370d0], edx
mov dword [ebp - 0x120], 0x3c41
mov dword [ebp - 0x120], 0x3c41
call fcn.004011c0
mov eax, dword [ebp + 8]
mov dword [0x4370cc], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
call fcn.00401980
add esp, 0xc
mov dword [ebp + 8], eax
jmp 0x401aea
mov esp, ebp
pop ebp
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x42e072
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x39cb42ad
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e060
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x42e0d2
nop
mov ebx, 0x42cd70
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x7324e0b
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x42e0c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4068c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4ecb30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
mov eax, dword [esp + 0x48]
push ebx
mov ebx, dword [0x4f9368]
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0x1c]
xor esi, esi
push eax
push ecx
mov word [esp + 0x24], si
call ebx
cmp eax, esi
jge 0x406905
mov word [esp + 0x1c], 0xa
mov dword [esp + 0x24], eax
mov edx, dword [esp + 0x50]
lea eax, [esp + 0x2c]
push edx
push eax
mov dword [esp + 0x4c], esi
mov word [esp + 0x34], si
call ebx
cmp eax, esi
jge 0x406929
mov word [esp + 0x2c], 0xa
mov dword [esp + 0x34], eax
lea ecx, [esp + 0x1c]
mov eax, dword [edi]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x58]
push esi
push esi
push ecx
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x5c]
push 1
push 0x400
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 2
mov dword [esp + 0x30], esi
mov edx, dword [eax]
push 0x4fa644
push ecx
push eax
mov byte [esp + 0x68], 1
call dword [edx + 0x18]
mov edi, dword [0x4f936c]
lea edx, [esp + 0x2c]
push edx
mov esi, eax
call edi
lea eax, [esp + 0x1c]
push eax
call edi
mov ecx, dword [esp + 0x3c]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x3c
ret 0x10
Function at 0x4212c0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x19c]
test ecx, ecx
je 0x4212f2
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
push edx
call fcn.00494e60
push esi
push 0
push fcn.00418850
call fcn.004ddc20
add esp, 0xc
xor eax, eax
pop esi
ret 8
mov eax, 1
pop esi
ret 8
Function at 0x457ce9
Capabilities:
Create thread

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4f014b
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
push esi
mov esi, ecx
push edi
mov dword [0x521b48], esi
mov dword [0x521b4c], eax
mov edi, dword [esi + 0x7a8]
test edi, edi
mov dword [esi + 0xdc4], 0
je 0x457d26
mov ecx, edi
call fcn.0048e7a0
push edi
call fcn.004dcaa6
add esp, 4
mov dword [esi + 0x7a8], 0
push 0x20
call fcn.004dcb8f
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
mov dword [esp + 0x10], 0
je 0x457d49
mov ecx, eax
call fcn.0048e780
jmp 0x457d4b
xor eax, eax
push 0x521b48
push 0
push 0x457d90
mov dword [esi + 0x7a8], eax
call fcn.004ddc20
mov ecx, dword [esi + 0xdcc]
add esp, 0xc
push 0xffffffffffffffff
push ecx
call dword [0x4f92a4]
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 4
Function at 0x4acd20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4f590a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov al, byte [esp + 3]
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 0xc], esi
push edi
mov byte [esi], al
call fcn.004114e0
mov dl, byte [esp + 0xb]
lea ecx, [esi + 0x10]
push edi
mov dword [esp + 0x1c], edi
mov byte [ecx], dl
call fcn.004114e0
mov al, byte [esp + 0xb]
lea ecx, [esi + 0x20]
push edi
mov byte [esp + 0x1c], 1
mov byte [ecx], al
call fcn.004114e0
mov dl, byte [esp + 0xb]
lea ecx, [esi + 0x30]
push edi
mov byte [esp + 0x1c], 2
mov byte [ecx], dl
call fcn.004114e0
mov al, byte [esp + 0xb]
lea ecx, [esi + 0x40]
push edi
mov byte [esp + 0x1c], 3
mov byte [ecx], al
call fcn.004114e0
mov dl, byte [esp + 0xb]
lea ecx, [esi + 0x50]
push edi
mov byte [esp + 0x1c], 4
mov byte [ecx], dl
call fcn.004114e0
mov al, byte [esp + 0xb]
lea ecx, [esi + 0x60]
push edi
mov byte [esp + 0x1c], 5
mov byte [ecx], al
call fcn.004114e0
lea ecx, [esp + 0xb]
mov byte [esp + 0x18], 6
push ecx
lea ecx, [esi + 0x78]
call fcn.0048a480
mov dl, byte [esp + 0xb]
mov cl, byte [esp + 0xb]
mov eax, 0x4fa23c
mov dword [esi + 0x74], edi
mov dword [esi + 0x70], eax
mov byte [esi + 0x90], dl
mov dl, byte [esp + 0xb]
mov dword [esi + 0x94], edi
mov dword [esi + 0x98], edi
mov dword [esi + 0x9c], edi
mov dword [esi + 0x8c], edi
mov dword [esi + 0x88], eax
mov byte [esi + 0xa8], cl
mov dword [esi + 0xac], edi
mov dword [esi + 0xb0], edi
mov dword [esi + 0xb4], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 0xa0], eax
mov byte [esi + 0xc0], dl
mov dword [esi + 0xc4], edi
mov dword [esi + 0xc8], edi
mov dword [esi + 0xcc], edi
mov dword [esi + 0xbc], edi
mov dword [esi + 0xb8], 0x4fa230
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4b1e60
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x4f5d18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov ebx, ecx
mov ecx, dword [ebx + 0x11c]
mov eax, dword [ebx + 0x120]
push ecx
push eax
push eax
mov dword [esp + 0x2c], 0
call fcn.004be650
mov ebp, dword [ebx + 0x120]
mov edi, eax
add esp, 0xc
cmp edi, ebp
mov esi, edi
je 0x4b1ebb
push 0
mov ecx, esi
call fcn.004bf950
add esi, 8
cmp esi, ebp
jne 0x4b1eab
mov dword [ebx + 0x120], edi
mov eax, dword [ebx + 0xc8]
push 0
push 0
mov eax, dword [eax]
push 0x1004
push eax
call dword [0x4f94a0]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
mov dword [esp + 0x1c], eax
call fcn.0040b9c0
mov ecx, ebx
call fcn.004a5c10
test eax, eax
je 0x4b205b
mov eax, dword [ebx + 0x11c]
test eax, eax
je 0x4b205b
mov ecx, dword [ebx + 0x120]
sub ecx, eax
sar ecx, 3
je 0x4b205b
mov ebp, dword [esp + 0x2c]
mov edi, eax
mov dword [esp + 0x14], edi
mov eax, dword [ebp]
mov esi, dword [edi + 4]
cmp eax, esi
je 0x4b1fdd
mov edx, dword [eax - 0xc]
lea ecx, [eax - 0xc]
test edx, edx
mov edx, dword [0x50a0e4]
mov dword [esp + 0x2c], ecx
jge 0x4b1f58
lea ecx, [eax - 0xc]
cmp ecx, edx
jne 0x4b1f5e
mov ecx, dword [esp + 0x2c]
cmp dword [esi - 0xc], 0
jge 0x4b1fa4
mov eax, dword [esi - 8]
mov ecx, ebp
push eax
mov dword [esp + 0x30], eax
call fcn.00402130
test eax, eax
je 0x4b1fdd
mov edx, dword [esp + 0x2c]
mov edi, dword [ebp]
lea eax, [edx + edx]
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [esp + 0x2c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp]
mov edi, dword [esp + 0x14]
mov dword [ecx - 8], edx
mov ecx, dword [ebp]
mov word [eax + ecx], 0
jmp 0x4b1fdd
add eax, 0xfffffff4
cmp eax, edx
je 0x4b1fcd
push ecx
call dword [0x4f9320]
test eax, eax
jg 0x4b1fc5
mov edx, dword [ebp]
sub edx, 0xc
push edx
call fcn.004dcaa6
add esp, 4
mov eax, dword [0x50a0e0]
mov dword [ebp], eax
mov eax, dword [edi + 4]
mov dword [ebp], eax
add eax, 0xfffffff4
push eax
call dword [0x4f9310]
mov ecx, dword [edi]
push ecx
mov ecx, ebx
call fcn.004b1c10
mov edx, dword [ebx + 0x128]
mov esi, 1
push edx
mov dword [ebx + 0x114], esi
call dword [0x4f92a8]
push ebx
push 0
push fcn.004a62a0
call fcn.004ddc20
mov dword [0x522268], esi
mov eax, dword [ebx + 0x10c]
mov dword [0x52226c], eax
mov ecx, dword [edi]
mov eax, dword [esp + 0x34]
mov dword [0x522270], ecx
mov ecx, dword [0x50a0e4]
add esp, 0xc
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x4b2057
add eax, 0xfffffff4
push eax
call dword [0x4f9320]
test eax, eax
jg 0x4b2057
mov eax, dword [esp + 0x28]
add eax, 0xfffffff4
push eax
call fcn.004dcaa6
add esp, 4
mov eax, esi
jmp 0x4b208c
mov eax, dword [esp + 0x28]
mov edx, dword [0x50a0e4]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4b208a
add eax, 0xfffffff4
push eax
call dword [0x4f9320]
test eax, eax
jg 0x4b208a
mov edx, dword [esp + 0x28]
add edx, 0xfffffff4
push edx
call fcn.004dcaa6
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret 8
Function at 0x4b7e50
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov edx, dword [esp + 0x24]
push ebx
push ebp
push esi
lea eax, [esp + 0x18]
push edi
push eax
push edx
mov dword [esp + 0x18], ecx
call fcn.004b7f30
mov ebp, dword [esp + 0x1e]
mov al, 9
mov byte [esp + 0x15], al
mov byte [esp + 0x19], al
and ebp, 0xff
xor edx, edx
mov cl, 1
mov eax, 5
and ebp, 0x80000003
mov byte [esp + 0x14], cl
mov byte [esp + 0x16], 7
mov byte [esp + 0x17], 8
mov byte [esp + 0x18], dl
mov byte [esp + 0x1a], cl
mov byte [esp + 0x1b], al
jns 0x4b7eae
dec ebp
or ebp, 0xfffffffc
inc ebp
inc ebp
lea esi, [esp + 0x1c]
mov dword [esp + 0x34], eax
movsx edi, byte [esp + edx + 0x14]
mov eax, dword [esi]
mov ecx, 0x20
sub ecx, edi
mov ebx, eax
shl ebx, cl
mov ecx, edi
add esi, 4
shr eax, cl
add ebx, eax
mov dword [esi - 4], ebx
xor bl, 0x69
mov byte [esi - 4], bl
mov cl, byte [esi - 3]
xor cl, 0x4a
mov byte [esi - 3], cl
mov al, byte [esi - 2]
xor al, 0x87
mov byte [esi - 2], al
mov bl, byte [esi - 1]
lea eax, [edx + 1]
xor bl, 0x3c
cdq
idiv ebp
mov eax, dword [esp + 0x34]
mov byte [esi - 1], bl
dec eax
mov dword [esp + 0x34], eax
jne 0x4b7eb7
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x1c]
push eax
push ecx
mov ecx, dword [esp + 0x18]
call fcn.00421a20
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 8
Function at 0x4bbfc0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4f6e9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov al, byte [esp + 2]
push esi
push edi
mov edi, ecx
push 0
lea esi, [edi + 4]
mov ecx, esi
mov dword [esp + 0x14], esi
mov byte [esi], al
call fcn.004114e0
mov dl, byte [esp + 0xa]
lea ecx, [esi + 0x10]
push 0
mov dword [esp + 0x20], 0
mov byte [ecx], dl
call fcn.004114e0
mov al, byte [esp + 0xa]
lea ecx, [esi + 0x20]
push 0
mov byte [esp + 0x20], 1
mov byte [ecx], al
call fcn.004114e0
mov dl, byte [esp + 0xa]
lea ecx, [esi + 0x30]
push 0
mov byte [esp + 0x20], 2
mov byte [ecx], dl
call fcn.004114e0
mov al, byte [esp + 0xa]
lea ecx, [esi + 0x40]
push 0
mov byte [esp + 0x20], 3
mov byte [ecx], al
call fcn.004114e0
mov dl, byte [esp + 0xa]
lea ecx, [esi + 0x50]
push 0
mov byte [esp + 0x20], 4
mov byte [ecx], dl
call fcn.004114e0
lea eax, [esp + 0xa]
lea ecx, [esi + 0x60]
push eax
call fcn.0048a480
lea ecx, [esp + 0xb]
push ecx
lea ecx, [esi + 0x70]
call fcn.0048a480
lea edx, [esp + 0xc]
lea ecx, [esi + 0x80]
push edx
call fcn.0048a480
lea eax, [esp + 0xd]
lea ecx, [esi + 0xa0]
push eax
call fcn.0048a480
lea ecx, [esp + 0xe]
push ecx
lea ecx, [esi + 0xb0]
call fcn.0048a480
lea edx, [esp + 0xf]
lea ecx, [esi + 0xc0]
push edx
call fcn.0048a480
lea ecx, [esi + 0xd0]
mov byte [esp + 0x1c], 0xb
call fcn.004bccc0
mov byte [esp + 0x1c], 0xc
lea ecx, [esi + 0xe8]
call fcn.004bcd40
mov ecx, dword [esp + 0x14]
mov dword [edi], 0x4fa248
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x4c1460
Capabilities:
Contain obfuscated stackstrings
Parse pe header
Persist via run registry key
Resolve function by parsing pe exports

Disassembly:
mov ecx, 0x522168
jmp fcn.00402dd0

Function at 0x4c51f0
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
cmp eax, ecx
jne 0x4c5200
mov eax, 1
ret
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x60], ecx
mov dword [eax + 0x64], ecx
xor eax, eax
ret
Function at 0x432003
Capabilities:
Check for vm using instruction vpcext
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rsrc
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
je 0x432072
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x7fd707bc
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x432060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4320d2
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x6f3552f6
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x405c8c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422aa4], 0
push esi
jne 0x405cc3
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405c9d
mov dword [ecx*4 + 0x422aa0], eax
inc ecx
cmp ecx, 0x100
jl 0x405c98
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405cf4
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422aa0]
xor eax, esi
inc ecx
dec edx
jne 0x405cd6
pop edi
not eax
pop esi
ret 0xc

Function at 0x403468
Capabilities:
Encode data using xor

Disassembly:
push 0x40d94c
call sub.MSVBVM60.DLL_ThunRTMain
add byte [eax], al
dec eax
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
jp 0x4034d6
or dword [0x4f3b472b], 0xec1c88bc
or dword ss:[eax - 0x42], esi
add byte [eax], al
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
dec ecx
add byte [esi], al
push eax
add dword [ecx], 0x53
arpl word gs:[ebp + 0x72], si
inc ebx
insb byte es:[edi], dx
imul esp, dword [ebp + 0x6e], 0x6bd40074
add dword [eax], eax
add byte [eax], al
add byte [eax], dl
insd dword es:[edi], dx
push 1
rol byte [eax], 0
add byte [eax], dl
add byte [eax], al
add byte [edx], al
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
add byte [edx], cl
repne scasd eax, dword es:[edi]
sub ebx, dword [edi - 0x46b34193]
fdivr st(3), st(0)
mov esi, 0xf3dcb94c
aas
inc edx
sub dword [esi + 0x161], eax
add byte [eax - 0x50000000], ah
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [edi], cl
add byte [eax], al
add byte [ecx], 0x20
inc dword [eax]
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
arpl word [eax + 0x61], bp
insd dword es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword gs:[esi]
outsb dx, byte [esi]
inc edx
jne 0x403584
je 0x403581
outsb dx, byte [esi]
add byte [esi - 0x34de1da2], ah
xchg dword [edi - 0x517256b3], edi
stc
insd dword es:[edi], dx
nop
not byte [ebx - 0xc5e4293]
add byte [eax + 0x2f], 0x41
mov bl, 0x67
sal byte [edx - 0x634c5718], cl
add byte [eax], al
add byte [eax], al
or byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, byte [eax]
add byte [eax], al
add al, 0
add byte [eax], al
inc ecx
pop esp
std
sti
invalid
add byte [ecx], cl
daa
leave
push edi
fistp dword [eax + 0x25]
fld qword [ecx - 0x80]
xchg esi, eax
in eax, 0
les esi, [0x9b74edaa]
fld xword [edx - 0x58]
cmp ebp, dword [esi - 0x7e5466b7]
inc ebp
mov ah, 0x68
sahf
popfd
dec esp
xor dword [eax], eax
and edi, dword [eax]
add ch, 0xd8
pop edi
adc dword [esi + 0x77f48c45], 0xf04d97b3
imul edi, dword [esi + edx*2 - 0x61], 0xc3fd341f
dec ecx
mov bh, 0x6e
mov bh, 0xf8
invalid