joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401b63
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
push esi
push edi
push ebx
push ecx
push edx
lea eax, [ebp - 0x400]
push eax
push 0x400
call sub.kernel32.dll_GetTempPathA
push 0x4070e2
lea eax, [ebp - 0x400]
push eax
call sub.kernel32.dll_lstrcatA
xor edi, edi
lea eax, [ebp - 0x400]
push eax
call sub.kernel32.dll_LoadLibraryA
or eax, eax
je 0x401c32
mov dword [0x40746e], eax
mov esi, str.BASSMOD_Init
mov ebx, 0x40745a
jmp 0x401bf1
push esi
push dword [0x40746e]
call sub.kernel32.dll_GetProcAddress
or eax, eax
je 0x401bda
mov dword [ebx], eax
add ebx, 4
jmp 0x401bd2
inc esi
cmp byte [esi], 0
jne 0x401bd1
inc esi
jmp 0x401bf1
push dword [0x40746e]
call sub.kernel32.dll_FreeLibrary
mov dword [0x40746e], 0
jmp 0x401c32
cmp byte [esi], 0
jne 0x401bba
push 0
push 0xac44
push 0xffffffffffffffff
call dword [0x40745a]
cmp eax, 1
jne 0x401c32
call dword [0x40745e]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
add eax, 4
push 6
push ecx
push 0
push eax
push 1
call dword [0x407462]
cmp eax, 1
jne 0x401c32
call dword [0x407466]
inc edi
mov eax, edi
pop edx
pop ecx
pop ebx
pop edi
pop esi
leave
ret 4

Function at 0x401c60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
pushal
lea eax, [ebp - 4]
push eax
push 0
push 0
push dword [ebp + 8]
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle
popal
leave
ret 4

Function at 0x401d27
Capabilities:
Check if file exists
Copy file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
pushal
mov esi, 0x4078dc
push dword [ebp + 8]
push esi
call sub.kernel32.dll_lstrcpyA
push str..BAK
push esi
call sub.kernel32.dll_lstrcatA
push esi
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x401d5e
push 0
push esi
push dword [ebp + 8]
call sub.kernel32.dll_CopyFileA
mov al, 0
jmp 0x401d60
mov al, 1
mov byte [0x407cf4], al
popal
leave
ret 4

Function at 0x401d6a
Capabilities:
Copy file
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
pushal
mov esi, 0x4078dc
cmp dword [ebp + 8], 0
jne 0x401da0
cmp byte [0x407cf4], 0
jne 0x401d8f
push 0
push 0x4074dc
push esi
call sub.kernel32.dll_CopyFileA
cmp byte [0x407cf4], 0
jne 0x401e07
push esi
call sub.kernel32.dll_DeleteFileA
jmp 0x401e07
push 0x6b
push dword [0x407476]
call sub.user32.dll_IsDlgButtonChecked
cmp byte [0x408127], 1
jne 0x401dcb
cmp byte [0x408128], 1
jne 0x401dc6
mov eax, 1
jmp 0x401dcb
mov eax, 0
cmp eax, 1
jne 0x401e05
push 0x400
push 0x40a54c
push 0xd
push dword [0x407472]
call sub.user32.dll_LoadStringA
push 0x40a54c
call fcn.00401ce6
push esi
call fcn.00401ce6
push dword [0x407cdc]
push esi
call sub.kernel32.dll_SetFileAttributesA
jmp 0x401e07
jmp 0x401d8f
popal
leave
ret 4
Function at 0x4021fd
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
pushal
mov esi, dword [0x407ce0]
or esi, esi
je 0x402255
push dword [0x407ce8]
call sub.kernel32.dll_UnmapViewOfFile
push dword [0x407cec]
call sub.kernel32.dll_CloseHandle
push 0
push 0
push dword [0x407cf0]
push esi
call sub.kernel32.dll_SetFilePointer
push esi
call sub.kernel32.dll_SetEndOfFile
push esi
call sub.kernel32.dll_CloseHandle
push dword [ebp + 8]
call fcn.00401d6a
push dword [0x407cdc]
push 0x4074dc
call sub.kernel32.dll_SetFileAttributesA
popal
leave
ret 4

Function at 0x402284
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbfc
pushal
mov byte [ebp - 0x401], 0
push 1
push 8
call fcn.00401057
or eax, eax
je 0x4022e1
mov esi, eax
lea eax, [ebp - 0x400]
push eax
push 0x400
call sub.kernel32.dll_GetTempPathA
push str._bassmod.dll
lea eax, [ebp - 0x400]
push eax
call sub.kernel32.dll_lstrcatA
mov ecx, dword [esi + 1]
lea eax, [esi + 5]
push ecx
push eax
lea eax, [ebp - 0x400]
push eax
call fcn.00405098
mov byte [ebp - 0x401], 1
popal
movzx eax, byte [ebp - 0x401]
leave
ret
Function at 0x403010
Capabilities:
Get common file path
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffba0
push esi
push edi
push ebx
push 0x70
push dword [0x407476]
call sub.user32.dll_GetDlgItem
or eax, eax
je 0x4031bc
mov dword [ebp - 0x404], eax
push 0
push dword [ebp - 0x404]
call sub.user32.dll_ShowWindow
mov esi, 0x40852a
push 9
push dword [0x40747a]
call fcn.0040225a
mov dword [esi + 4], eax
push eax
call fcn.00405050
or eax, eax
je 0x4031bc
push dword [0x407476]
pop dword [esi]
lea ebx, [ebp - 0x414]
push ebx
push dword [ebp - 0x404]
call sub.user32.dll_GetWindowRect
lea edi, [ebp - 0x424]
push edi
push dword [0x407476]
call sub.user32.dll_GetWindowRect
mov eax, dword [ebx]
sub eax, dword [edi]
mov dword [esi + 8], eax
mov eax, dword [ebx + 8]
sub eax, dword [ebx]
mov dword [esi + 0x10], eax
mov eax, dword [ebx + 4]
sub eax, dword [edi + 4]
mov dword [esi + 0xc], eax
lea eax, [esi + 8]
lea ecx, [esi + 0xc]
push ecx
push eax
push dword [0x407476]
call fcn.00401430
push 1
push 0x12
call fcn.00401057
or eax, eax
je 0x4030ce
mov eax, dword [eax + 1]
mov dword [esi + 0x1d], eax
push 1
push 0xb
call fcn.00401057
or eax, eax
je 0x4030e3
mov eax, dword [eax + 1]
jmp 0x4030f5
cmp dword [esi + 0x1d], 0
je 0x4030f0
mov eax, 0xfe
jmp 0x4030f5
mov eax, 0xff
mov byte [esi + 0x1c], al
lea ebx, [ebp - 0x460]
push 0x3c
push ebx
call sub.kernel32.dll_RtlZeroMemory
mov dword [ebx], 7
mov byte [ebx + 0x17], 1
mov byte [ebx + 0x1a], 4
push str.MS_SANS_SERIF
lea eax, [ebx + 0x1c]
push eax
call sub.kernel32.dll_lstrcpyA
push 1
push 0x13
call fcn.00401057
or eax, eax
je 0x4031ad
mov edi, eax
push dword [edi + 0x11]
pop dword [esi + 0x18]
push dword [edi + 5]
pop dword [ebx]
test dword [edi + 9], 1
je 0x40314c
mov dword [ebx + 0x10], 0x2bc
lea eax, [ebp - 0x400]
push eax
push 0x400
call sub.kernel32.dll_GetTempPathA
lea edx, [edi + 0x15]
push edx
lea eax, [ebp - 0x400]
push eax
call sub.kernel32.dll_lstrcatA
lea edx, [edi + 0x95]
push edx
lea eax, [ebp - 0x400]
push eax
call sub.kernel32.dll_lstrcatA
lea edx, [edi + 0x9b]
mov ecx, dword [edi + 0xd]
lea eax, [ebp - 0x400]
push eax
push ecx
push edx
call fcn.004031c1
lea edx, [edi + 0x15]
cmp byte [edx], 0
jne 0x4031a3
xor ebx, ebx
jmp 0x4031ad
push edx
lea eax, [ebx + 0x1c]
push eax
call sub.kernel32.dll_lstrcpyA
push ebx
call sub.gdi32.dll_CreateFontIndirectA
mov dword [esi + 0x14], eax
push esi
call fcn.0040170b
pop ebx
pop edi
pop esi
leave
ret
Function at 0x403e5c
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf0
push esi
push edi
push ebx
push 0x400
push 0x41314c
push 4
push dword [0x407472]
call sub.user32.dll_LoadStringA
push 0x41314c
call fcn.00401ce6
lea eax, [ebp - 0x400]
push eax
push 0x400
call sub.kernel32.dll_GetTempPathA
push str._regpatch.reg
lea eax, [ebp - 0x400]
push eax
call sub.kernel32.dll_lstrcatA
mov esi, dword [ebp + 8]
mov eax, dword [esi + 1]
add eax, 0x100000
mov dword [ebp - 0x40c], eax
push 4
push 0x1000
push eax
push 0
call sub.kernel32.dll_VirtualAlloc
mov dword [ebp - 0x404], eax
lea eax, [esi + 9]
push dword [ebp - 0x404]
push eax
call fcn.004040f5
mov ecx, dword [ebp - 0x404]
test dword [esi + 5], 1
je 0x403f2f
mov eax, dword [esi + 1]
add eax, 0x100000
mov dword [ebp - 0x410], eax
push 4
push 0x1000
push eax
push 0
call sub.kernel32.dll_VirtualAlloc
mov dword [ebp - 0x408], eax
push dword [ebp - 0x410]
push dword [ebp - 0x408]
push dword [ebp - 0x404]
call fcn.00404049
mov ecx, dword [ebp - 0x408]
push eax
push ecx
lea eax, [ebp - 0x400]
push eax
call fcn.00405098
test eax, eax
je 0x403f88
mov edi, 0x4074dc
push str._s__
push edi
call sub.kernel32.dll_lstrcpyA
lea eax, [ebp - 0x400]
push eax
push edi
call sub.kernel32.dll_lstrcatA
push 0x4072da
push edi
call sub.kernel32.dll_lstrcatA
push 5
push 0
push edi
push str.regedit.exe
push 0x4072dc
push dword [0x407476]
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
ja 0x403fab
push 0x400
push 0x41354c
push 0x27
push dword [0x407472]
call sub.user32.dll_LoadStringA
push 0x41354c
call fcn.00401ce6
jmp 0x403fcc
push 0x400
push 0x41394c
push 0x28
push dword [0x407472]
call sub.user32.dll_LoadStringA
push 0x41394c
call fcn.00401ce6
push 0x1f4
call sub.kernel32.dll_Sleep
push 0x4000
push dword [ebp - 0x40c]
push dword [ebp - 0x404]
call sub.kernel32.dll_VirtualFree
test dword [esi + 5], 1
je 0x40400b
push 0x4000
push dword [ebp - 0x410]
push dword [ebp - 0x408]
call sub.kernel32.dll_VirtualFree
lea eax, [ebp - 0x400]
push eax
call sub.kernel32.dll_DeleteFileA
push 0x400
push 0x413d4c
push 0xc
push dword [0x407472]
call sub.user32.dll_LoadStringA
push 0x413d4c
call fcn.00401ce6
push 0x4070ef
call fcn.00401ce6
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x404049
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push esi
push edi
push ebx
mov eax, dword [ebp + 0x10]
add eax, 0x100000
mov dword [ebp - 8], eax
push 4
push 0x1000
push eax
push 0
call sub.kernel32.dll_VirtualAlloc
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
push esi
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov esi, dword [ebp - 4]
or eax, eax
je 0x4040d6
push dword [ebp + 8]
push esi
call sub.kernel32.dll_lstrcmpA
or eax, eax
je 0x4040cb
mov bl, 0
jmp 0x4040c1
lodsb al, byte [esi]
cmp word [esi], 0x5b0a
jne 0x4040a3
mov bl, 1
cmp al, 0x5c
jne 0x4040b7
or bl, bl
jne 0x4040b7
cmp byte [esi], 0x5c
je 0x4040b7
cmp byte [esi - 2], 0x5c
je 0x4040b7
stosb byte es:[edi], al
stosb byte es:[edi], al
cmp word [esi], 0xd5d
jne 0x4040c1
mov bl, 0
cmp byte [esi], 0
jne 0x404099
mov byte [edi], 0
jmp 0x4040d6
push dword [ebp + 8]
push dword [ebp + 0xc]
call sub.kernel32.dll_lstrcpyA
push 0x4000
push dword [ebp - 8]
push dword [ebp - 4]
call sub.kernel32.dll_VirtualFree
push dword [ebp + 0xc]
call fcn.00405050
pop ebx
pop edi
pop esi
leave
ret 0xc
Function at 0x404882
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push esi
push edi
push ebx
cmp byte [0x4074d2], 1
jne 0x4048ae
push 5
push dword [0x40748e]
call sub.user32.dll_ShowWindow
push 0
push dword [0x407492]
call sub.user32.dll_ShowWindow
push 0
push 0
push 0x184
push dword [0x40748e]
call sub.user32.dll_SendMessageA
push 0x400
push 0x416554
push 0
push dword [0x407472]
call sub.user32.dll_LoadStringA
push 0x416554
call fcn.00401ce6
push 0x4070ef
call fcn.00401ce6
call fcn.004011b6
xor ebx, ebx
jmp 0x404937
cmp byte [esi], 3
jne 0x404905
push esi
call fcn.0040357e
jmp 0x404937
cmp byte [esi], 4
jne 0x404912
push esi
call fcn.00403844
jmp 0x404937
cmp byte [esi], 0x11
jne 0x40491f
push esi
call fcn.0040444a
jmp 0x404937
cmp byte [esi], 5
jne 0x40492c
push esi
call fcn.00403e5c
jmp 0x404937
cmp byte [esi], 0x14
jne 0x404937
push esi
call fcn.00403a10
inc ebx
push ebx
call fcn.00401098
mov esi, eax
or esi, esi
jne 0x4048f8
push 0x400
push 0x416954
push 1
push dword [0x407472]
call sub.user32.dll_LoadStringA
push 0x416954
call fcn.00401ce6
push dword [0x4074d7]
call fcn.0040499b
push 0x6c
push dword [0x407476]
call sub.user32.dll_GetDlgItem
push 0
push eax
call sub.user32.dll_EnableWindow
push 1
push 0
push 0
push dword [0x407476]
call sub.user32.dll_RedrawWindow
pop ebx
pop edi
pop esi
leave
ret
Function at 0x4049d2
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
push edx
push esi
push edi
mov esi, dword [ebp + 8]
xor ecx, ecx
jmp 0x404a16
inc ecx
cmp ecx, dword [0x407ce4]
jne 0x404a16
push 0x400
push 0x416d54
push 0x16
push dword [0x407472]
call sub.user32.dll_LoadStringA
push 0x416d54
call fcn.00401ce6
xor eax, eax
pop edi
pop esi
pop edx
pop ecx
pop ebx
leave
ret 0x10
cmp dword [ecx + esi], 0x4550
jne 0x4049e1
add esi, ecx
mov eax, dword [ebp + 8]
add eax, dword [0x407ce4]
cmp dword [eax - 4], 0x32505564
jne 0x404a56
push 0x400
push 0x417154
push 0x17
push dword [0x407472]
call sub.user32.dll_LoadStringA
push 0x417154
call fcn.00401ce6
jmp 0x404a0b
push esi
movzx eax, word [esi + 6]
dec eax
imul eax, eax, 0x28
movzx ecx, word [esi + 0x14]
add esi, 0x18
add esi, ecx
mov edi, esi
or dword [edi + 0x24], 0x80000000
add edi, eax
pop esi
cmp dword [ebp + 0xc], 4
jne 0x404a7f
mov ecx, dword [esi + 0x34]
jmp 0x404a81
xor ecx, ecx
mov dword [0x404d5d], ecx
mov ebx, dword [esi + 0x28]
mov ecx, dword [esi + 0x34]
mov dword [0x404d55], ebx
add dword [0x404d55], ecx
mov eax, dword [edi + 0xc]
add eax, dword [edi + 0x10]
mov dword [esi + 0x28], eax
cmp dword [ebp + 0xc], 4
jne 0x404ab2
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 0x10]
add eax, ebx
jmp 0x404ab4
xor eax, eax
mov dword [0x404d61], eax
mov eax, dword [ebp + 8]
add eax, dword [edi + 0x14]
add eax, dword [edi + 0x10]
mov ecx, 0x404b3d
mov ebx, 0x23b
mov edx, eax
add edx, ebx
push edx
push ebx
push ecx
push eax
call sub.kernel32.dll_RtlMoveMemory
pop edx
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx + 0x16]
lea ecx, [eax + ecx]
mov ebx, dword [0x407450]
sub ebx, eax
push ebx
push ecx
push edx
call sub.kernel32.dll_RtlMoveMemory
mov eax, dword [ebp + 0x10]
push 0x100
push eax
call fcn.004051a0
add dword [edi + 8], eax
add dword [edi + 0x10], eax
or dword [edi + 0x24], 0xe0000000
mov eax, dword [edi + 0xc]
add eax, dword [edi + 8]
mov ebx, dword [esi + 0x38]
push ebx
push eax
call fcn.004051a0
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 8]
add eax, dword [0x407cf0]
mov dword [eax - 4], 0x32505564
xor eax, eax
inc eax
pop edi
pop esi
pop edx
pop ecx
pop ebx
leave
ret 0x10

Function at 0x405098
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x4050c3
xor eax, eax
leave
ret 0xc
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
push dword [ebp - 4]
call sub.kernel32.dll_FlushFileBuffers
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 8]
leave
ret 0xc
Function at 0x4051c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], 1
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
push dword [ebp + 0x14]
push dword [ebp - 8]
call sub.advapi32.dll_RegQueryValueExA
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegCreateKeyExA
or eax, eax
jne 0x405242
mov eax, 4
mov dword [ebp - 4], eax
inc dword [ebp - 0xc]
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0x14]
push dword [ebp - 8]
call sub.advapi32.dll_RegQueryValueExA
push eax
push dword [ebp - 8]
call sub.advapi32.dll_RegCloseKey
pop eax
leave
ret 0x10

Function at 0x4052c0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
pushal
cmp dword [ebp + 8], 0
jne 0x405300
push 0
call sub.kernel32.dll_GetModuleHandleA
lea esi, [ebp - 0x200]
push 0x200
push esi
push eax
call sub.kernel32.dll_GetModuleFileNameA
push esi
call sub.kernel32.dll_lstrlenA
push esi
add esi, eax
jmp 0x4052f5
dec esi
cmp byte [esi], 0x5c
jne 0x4052f4
mov byte [esi], 0
pop esi
jmp 0x405303
mov esi, dword [ebp + 8]
push esi
call sub.kernel32.dll_SetCurrentDirectoryA
popal
leave
ret 4

Function at 0x405380
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbfc
pushal
mov byte [ebp - 1], 0
mov esi, dword [ebp + 8]
or esi, esi
je 0x4053da
push esi
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x4053da
cmp byte [esi], 0
je 0x4053da
lea edi, [ebp - 0x401]
jmp 0x4053af
lodsb al, byte [esi]
stosb byte es:[edi], al
cmp byte [esi], 0x5c
je 0x4053b9
cmp byte [esi], 0
jne 0x4053ad
cmp al, 0x3a
je 0x4053ad
lodsb al, byte [esi]
stosb byte es:[edi], al
mov byte [edi], 0
push 0
lea eax, [ebp - 0x401]
push eax
call sub.kernel32.dll_CreateDirectoryA
cmp byte [esi - 1], 0
jne 0x4053ab
mov byte [ebp - 1], 1
popal
movzx eax, byte [ebp - 1]
leave
ret 4

Function at 0x4053f0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
pushal
mov byte [ebp - 1], 0
mov esi, dword [ebp + 8]
or esi, esi
je 0x40545e
push esi
call sub.kernel32.dll_lstrlenA
or eax, eax
je 0x40545e
mov ebx, eax
push 0
call sub.user32.dll_OpenClipboard
cmp eax, 1
jne 0x40545e
add ebx, 2
push ebx
push 0x2042
call sub.kernel32.dll_GlobalAlloc
or eax, eax
je 0x405459
mov ebx, eax
push ebx
call sub.kernel32.dll_GlobalLock
or eax, eax
je 0x405459
mov edi, eax
push esi
push edi
call sub.kernel32.dll_lstrcpyA
call sub.user32.dll_EmptyClipboard
cmp eax, 1
jne 0x405459
push edi
call sub.kernel32.dll_GlobalUnlock
push ebx
push 1
call sub.user32.dll_SetClipboardData
call sub.user32.dll_CloseClipboard
popal
movzx eax, byte [ebp - 1]
leave
ret 4
Function at 0x415ba2
Capabilities:
Encode data using xor

Disassembly:
cdq
pop edx
cld
dec eax
push 0x18eb8a06
scasd eax, dword es:[edi]
rol dword ss:[ebx - 0x6b], 1
div dword [ecx + 0x5a]
or dword [ebx], edx
or dh, byte [eax - 0x3f417524]
mov ebx, 0x14bf87c0
cmp al, 0xaa
scasb al, byte es:[edi]
mov al, 0xdc
mov bh, byte [esi - 0x783f4440]
mov edi, 0xaeaa3c14
popfd
pop esi
mov byte [0x7df27134], al
jo 0x415bcf
mov edi, ds
pop ebp
lahf
dec esi
xor bl, bh
sbb byte [edx + 0x588920be], 0x63
and dl, byte [ebx + edx*8]
loope 0x415b42
inc esp
add al, 0xa5
dec ecx
call 0xd52e646f
je 0x415b98
out 8, al
in eax, dx
aam 0x74
or eax, 0xe048a822
cwde
or ch, byte [esi]
pop edx
and ch, byte [eax + 0xa98e048]
pop edx
invalid
movsb byte es:[edi], byte [esi]
aam 0x82
lodsb al, byte [esi]
jg 0x415bb2
ror dword [edi], 0x30
aaa
clc
sti
push ebx
sbb edi, 0x92c0f9cd
ja 0x415b56
xor dh, dl
loop 0x415bd1
out 0x90, al
nop
sbb ebp, dword [eax - 0x66]
retf
sbb eax, 0x6eb63060
adc eax, dword [ebx]
mov cl, 0x3a
cmp ebx, dword [edi]
xor byte [esi - 0x4efcec92], dh
cmp bh, byte [ebx]
pop ds
xchg edx, eax
mov ebx, dword [edi + 0x59]
pop edi
pop ecx
inc ebp
jle 0x415bc4
mov fs, edx
lodsb al, byte [esi]
loop 0x415b85
fld dword [esi]
push ss
aaa
je 0x415bd7
xchg edi, eax
cmp eax, 0x74c0d528
int1
push esp
inc edx
or al, 0xd6
cmovne esp, ebx
adc ah, byte fs:[eax + 0x60]
cmp eax, 0x918d2246
mov cl, byte [edx - 0x1c22ff94]
enter 0x7e55, 0xffffffffffffff8a
and cl, byte [ebp + 0x6c8a8a91]
add ch, bl
jecxz 0x415bc6
push ebp
jle 0x415b8b
xchg byte [eax + 0x58f4e8ee], cl
mov al, byte [0xc02c47a8]
jno 0x415bf4
cmp edi, dword [esi - 0xe]
in eax, 0x7a
fcom qword [eax]
lcall 0x909d, 0xb431836b
ret 0x37b8

Function at 0x4186b0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
mov dword [esp + 4], eax
mov al, byte [0x4cb950]
test al, al
je 0x41871d
mov ecx, dword [0x4cb9c0]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
and ecx, 0xffff
cmp ecx, 0xffffd7b2
push edi
jne 0x4186ea
mov eax, dword [0x4c9c3c]
test eax, eax
je 0x4186ea
push 0xfffffffffffffff5
call esi
push 0xfffffffffffffff5
call esi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea edx, [esp + 0xc]
push 0
push edx
push 0x1d
push 0x4ca920
push eax
call edi
push 0xfffffffffffffff5
call esi
lea ecx, [esp + 0xc]
push 0
push ecx
push 2
push 0x4cb9d0
push eax
call edi
pop edi
pop esi
ret
mov al, byte [0x4ca4a8]
test al, al
jne 0x418737
push 0
push 0
push 0x4ca920
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
ret
Function at 0x47d1c2
Capabilities:
Packed with generic packer

Disassembly:
je 0x47d236
popal
pop es
add byte [ebx], al
add al, dh
mov ebx, 0x80047
add byte [eax], cl
dec eax
xchg esi, eax
inc eax
add byte [ebp], ah
add al, 0x53
insb byte es:[edi], dx
add al, byte [eax]
add byte [eax], al
mov ebx, 0x10047
mov word [eax], es
popal
insb byte es:[edi], dx
jne 0x47d250
add al, byte [eax]
inc eax
add byte [eax], al
inc edi
add byte [edx], al
add byte [ecx], al
sbb al, 0
add byte [edx], al
add byte [eax], cl
lock add byte [eax], 0
or byte [ebp + 0x78], al
arpl word [eax - 0x56], bp
add byte [edi + 0x65], ah
add eax, dword [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add ecx, dword [eax]
dec eax
xchg esi, eax
inc esi
add byte [eax], al
add byte [ebx + edx*2], al
insb byte es:[edi], dx
add byte [eax], al
add byte [edx + edi*4], al
inc edi
add ch, bh
add byte [esi], al
dec ecx
outsb dx, byte [esi]
js 0x47d25f
add byte [eax], al
add byte [edx + edi*4], al
inc edi
add byte [edi], dh
add byte [esi], al
dec ecx
outsb dx, byte [esi]
js 0x47d270
add byte [eax], al
add al, byte [eax]
dec eax
add byte [eax], bl
add byte [ecx*2 + 0x365766f], al
add byte [eax], al
add byte [eax], al
add byte [eax], cl
add byte [esi], bh
dec eax
xchg esi, eax
inc eax
add byte [eax], al
add byte [eax + eax], al
add byte [esi + 2], ch
add byte [eax], al
add dword [eax], eax
inc edi
add byte [ecx], al
add byte [eax], cl
inc ebx
jne 0x47d26f
add byte [esi + 0x64], ch
js 0x47d277
outsb dx, byte [esi]
js 0x47d277
and eax, 0x47ba0400
add al, 0xba
inc edi
add byte [edx], al
add byte [eax], cl
add byte [eax], al
ja 0x47d2cb
outsb dx, byte [esi]
xchg ebx, eax
add byte [eax], al
add al, byte [eax]
xor byte [eax], al
cmp byte [eax + eax + 0x69460500], al
jb 0x47d308
dec esi
add byte [eax], al
invalid
or byte [eax], al
add al, byte [eax]
add byte [esi + 0x40], dl
popal
add byte [ebp + 0x6c], ah
add al, byte [eax]
inc eax
lock add byte [eax], al
add byte [ecx], al
add byte [ecx], al
add dword [ebx + 0x25000200], ecx
add byte [esp + eax*4 + 0x40], ah
add byte [eax], al
inc ebx
insb byte es:[edi], dx
popal
jb 0x47d314
add byte [eax], al
add byte [eax], al
add byte [eax], cl
add byte [ecx], al
add byte [eax], al
xchg esi, eax
inc eax
add byte [eax], al
add bh, cl
add byte [ebp + 0x6c], ah
insb byte es:[edi], dx
add al, byte [eax]
add al, byte [eax]
add byte [eax], al
jl 0x47d296
inc eax
add byte [eax], cl
inc ebp
add byte [esi + 0x74], ch
popal
or byte [ebp], al
outsb dx, byte [esi]
je 0x47d37b
imul ebp, dword [esi + 0x73], 0xb9000003
inc edi
add byte [eax], cl
add dh, bh
add byte [eax - 0x6a], cl
cmp al, byte [eax]
rol byte [eax], 1
add byte [eax], al
add byte [ebx], cl
dec esp
popal
jae 0x47d325