joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407b90
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x5000]
inc word [edi + 0x74fc]
push edi
or ebp, 0xffffffff
jmp 0x407bba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407bc1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407bb0
mov eax, 1
add ebx, ebx
jne 0x407bd3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407bc8
jne 0x407be4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407bc8
xor ecx, ecx
sub eax, 3
jb 0x407bf8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x407c6a
mov ebp, eax
add ebx, ebx
jne 0x407c03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407c10
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x407c34
inc ecx
add ebx, ebx
jne 0x407c20
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407c15
jne 0x407c31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407c15
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x407c54
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x407c45
jmp 0x407bb6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x407c54
add edi, ecx
jmp 0x407bb6
pop esi
mov edi, esi
mov ecx, 0x72
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x407c72
cmp byte [edi], 0
jne 0x407c72
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x407c77
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x407cef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x7804]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x78b4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x407ca4
mov ecx, edi
jns 0x407cd3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x78bc]
or eax, eax
je 0x407ce9
mov dword [ebx], eax
add ebx, 4
jmp 0x407cc1
call dword [esi + 0x78b8]
mov ebp, dword [esi + 0x78c0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x407d23
sub esp, 0xffffff80
jmp 0x4025c2
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..data
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x64787e06
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x5b71129d
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x512739
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5711d4]
push edi
xor edi, edi
lea edx, [ebp - 8]
mov dword [ebp - 8], edi
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x4c]
cmp eax, edi
fnclex
jge 0x51276d
push 0x4c
push 0x43c640
push dword [0x5711d4]
push eax
call sub.MSVBVM60.DLL___vbaHresultCheckObj
mov cx, 1
call sub.MSVBVM60.DLL___vbaUI1I2
cmp al, 0x28
mov byte [ebp - 4], al
ja 0x5128a4
push ebx
push esi
movzx esi, byte [ebp - 4]
dec esi
cmp esi, 0x28
jb 0x512792
call sub.MSVBVM60.DLL___vbaGenerateBoundsError
shl esi, 6
add esi, dword [0x5712e4]
xor edx, edx
lea ebx, [esi + 4]
mov word [esi], di
mov ecx, ebx
call sub.MSVBVM60.DLL___vbaStrCopy
fldz
xor cx, cx
mov word [esi + 0xc], di
fstp dword [esi + 0x10]
mov dword [esi + 8], edi
mov word [esi], di
mov word [esi + 0x14], di
mov word [esi + 0x1a], di
mov word [esi + 0x1c], di
mov word [esi + 0x16], di
mov word [esi + 0x18], di
call sub.MSVBVM60.DLL___vbaUI1I2
mov byte [esi + 0x3c], al
cmp dword [0x5718e4], edi
jne 0x5127ef
push 0x5718e4
push 0x417790
call sub.MSVBVM60.DLL___vbaNew2
mov eax, dword [0x5718e4]
lea edx, [ebp - 8]
push edx
push eax
mov ecx, dword [eax]
mov dword [ebp - 0xc], eax
call dword [ecx + 0x1b8]
cmp eax, edi
fnclex
jge 0x51281d
push 0x1b8
push 0x438820
push dword [ebp - 0xc]
push eax
call sub.MSVBVM60.DLL___vbaHresultCheckObj
cmp word [ebp - 8], di
je 0x512890
mov eax, dword [0x571100]
fld dword [esi + 0x10]
mov edx, dword [eax]
mov al, byte [esi + 0x3c]
push eax
mov ax, word [esi + 0x18]
push dword [ebx]
mov dword [ebp - 0xc], edx
push ecx
xor cx, cx
fstp dword [esp]
push eax
mov ax, word [esi + 0x16]
push eax
mov ax, word [esi + 0x1c]
push eax
mov ax, word [esi + 0x1a]
push eax
mov ax, word [esi + 0x14]
push eax
push dword [esi + 8]
call sub.MSVBVM60.DLL___vbaUI1I2
push eax
movsx eax, word [esi + 0xc]
push eax
mov ax, word [esi]
push eax
mov eax, dword [ebp - 0xc]
push dword [ebp - 4]
push dword [0x571100]
call dword [eax + 0x74]
cmp eax, edi
fnclex
jge 0x512890
push 0x74
push 0x4373cc
push dword [0x571100]
push eax
call sub.MSVBVM60.DLL___vbaHresultCheckObj
mov al, byte [ebp - 4]
add al, 1
jb 0x5128a7
cmp al, 0x28
mov byte [ebp - 4], al
jbe 0x512783
pop esi
pop ebx
pop edi
leave
ret
call sub.MSVBVM60.DLL___vbaErrorOverflow
Function at 0x52a5c4
Capabilities:
Check os version
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push esi
push dword [0x5721b4]
call sub.MSVBVM60.DLL___vbaDerefAry1
fldz
push esi
fstp dword [eax + 0x1c]
push dword [0x5721b4]
call sub.MSVBVM60.DLL___vbaDerefAry1
and dword [eax + 0x18], 0
push esi
push dword [0x5721b4]
call sub.MSVBVM60.DLL___vbaDerefAry1
fldz
push esi
fstp dword [eax]
push dword [0x5721b4]
call sub.MSVBVM60.DLL___vbaDerefAry1
fldz
push esi
fstp dword [eax + 4]
push dword [0x5721b4]
call sub.MSVBVM60.DLL___vbaDerefAry1
fldz
push esi
fstp dword [eax + 8]
push dword [0x5721b4]
call sub.MSVBVM60.DLL___vbaDerefAry1
fldz
push esi
fstp dword [eax + 0xc]
push dword [0x5721b4]
call sub.MSVBVM60.DLL___vbaDerefAry1
fldz
xor cx, cx
fstp dword [eax + 0x14]
call sub.MSVBVM60.DLL___vbaUI1I2
push esi
mov bl, al
push dword [0x5721b4]
call sub.MSVBVM60.DLL___vbaDerefAry1
mov byte [eax + 0x10], bl
cmp esi, dword [0x5721b0]
jne 0x52a6b3
push esi
push dword [0x5721b4]
call sub.MSVBVM60.DLL___vbaDerefAry1
cmp dword [eax + 0x18], 1
mov eax, dword [0x5721b0]
jg 0x52a685
sub eax, 1
jo 0x52a6b8
test eax, eax
mov dword [0x5721b0], eax
jne 0x52a660
cmp esi, eax
je 0x52a6b3
test eax, eax
jle 0x52a6a7
push 1
push eax
push 1
push 0
push 0x5721b4
push 0x34
push 0
call sub.MSVBVM60.DLL___vbaRedimPreserve
add esp, 0x1c
jmp 0x52a6b3
push 0x5721b4
push 0
call sub.MSVBVM60.DLL___vbaErase
pop esi
pop ebx
ret 4
call sub.MSVBVM60.DLL___vbaErrorOverflow
Function at 0x52a6bd
Capabilities:
Check os version
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
xor cx, cx
call sub.MSVBVM60.DLL___vbaUI1I2
mov cx, 5
mov byte [ebp - 1], al
call sub.MSVBVM60.DLL___vbaUI1I2
mov cx, 1
mov byte [ebp - 3], al
call sub.MSVBVM60.DLL___vbaUI1I2
cmp al, byte [ebp - 3]
mov byte [ebp - 2], al
ja 0x52a800
push ebx
push esi
push edi
mov ebx, 0x19a
movzx edi, byte [ebp - 2]
dec edi
cmp edi, 5
jb 0x52a709
call sub.MSVBVM60.DLL___vbaGenerateBoundsError
mov ecx, dword [0x5721d8]
lea eax, [edi + edi*2]
push dword [ecx + eax*4]
call sub.MSVBVM60.DLL___vbaLenBstr
test eax, eax
jle 0x52a7ea
movzx cx, byte [ebp - 1]
add cx, 1
jo 0x52a802
call sub.MSVBVM60.DLL___vbaUI1I2
mov byte [ebp - 1], al
xor eax, eax
push eax
push eax
push eax
push 0x64
call sub.dx8vb.dll_Ordinal_131
movzx si, byte [ebp - 1]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov ax, si
sub ax, 1
push 0x28
jo 0x52a802
imul ax, ax, 0x32
jo 0x52a802
add ax, 0x14
push 0x78
jo 0x52a802
add ax, 5
jo 0x52a802
push eax
push ebx
call fcn.0056b76a
cmp edi, 5
mov dword [ebp - 8], 0x571a28
jb 0x52a798
call sub.MSVBVM60.DLL___vbaGenerateBoundsError
push 0xffffffffffffffff
push ecx
fldz
lea eax, [ebp - 8]
mov cx, 1
fstp dword [esp]
push eax
call sub.MSVBVM60.DLL___vbaUI1I2
sub si, 1
mov ecx, dword [0x5721d8]
jo 0x52a802
imul si, si, 0x32
jo 0x52a802
add si, 0x14
push eax
jo 0x52a802
lea eax, [edi + edi*2]
add si, 0x23
jo 0x52a802
movsx eax, word [ecx + eax*4 + 4]
push esi
push ebx
push eax
push dword [0x5719f8]
call sub.MSVBVM60.DLL___vbaDerefAry1
push dword [eax + 0x30]
call fcn.004a1599
mov al, byte [ebp - 2]
add al, 1
jb 0x52a802
cmp al, byte [ebp - 3]
mov byte [ebp - 2], al
jbe 0x52a6fa
pop edi
pop esi
pop ebx
leave
ret
call sub.MSVBVM60.DLL___vbaErrorOverflow
Function at 0x52acb9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
mov edi, dword [0x571ec8]
push 1
pop esi
cmp edi, esi
jl 0x52ace2
push esi
call fcn.0052b327
test ax, ax
je 0x52acd9
push esi
call fcn.0052b47d
add esi, 1
jo 0x52ace9
cmp esi, edi
jle 0x52acc8
pop edi
or ax, 0xffff
pop esi
ret
call sub.MSVBVM60.DLL___vbaErrorOverflow
Function at 0x401123
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [esp + 0x14]
lea eax, [esp + 0x18]
mov edi, ecx
push eax
call fcn.0040117e
xor ebp, ebp
pop ecx
pop ecx
mov ebx, dword [eax]
mov dword [eax], ebp
cmp dword [esp + 0x14], ebp
je 0x401152
push 4
push dword [esp + 0x18]
call fcn.004021ef
pop ecx
pop ecx
lea esi, [edi + 4]
push esi
push ebp
push ebx
push 0x401107
push ebp
push ebp
call fcn.004073c7
add esp, 0x18
mov dword [edi], eax
test eax, eax
je 0x401174
pop edi
pop esi
pop ebp
pop ebx
ret 4
push 6
mov dword [esi], ebp
call fcn.00401f1c
int3

Function at 0x40157f
Capabilities:
Encode data using xor

Disassembly:
push ebp
xor ebp, ebp
push esi
mov esi, ebp
cmp dword [esp + 0x10], esi
jbe 0x4016ad
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_InitializeAcl]
push edi
mov edi, dword [esp + 0x14]
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x14
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x96
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xe2
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x6a
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x10
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x3c
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x42
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x97
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x4b
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0xdc
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x85
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x72
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xcf
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x8c
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x37
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xdf
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x3d
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xdd
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xce
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x74
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xf7
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x43
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x30
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x58
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xfb
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xae
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x8a
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x87
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xf0
inc esi
cmp esi, dword [esp + 0x18]
jb 0x40159b
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x4016b5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
mov eax, dword [0x41d00c]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
xor ebp, ebp
push edi
mov eax, dword [esi + 0x3c]
mov ebx, dword [eax + esi + 0x78]
add ebx, esi
mov edi, dword [ebx + 0x20]
mov eax, dword [ebx + 0x18]
add edi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x40172d
mov eax, dword [edi]
lea ecx, [esp + 0x14]
add eax, esi
push eax
call fcn.0040119d
test esi, esi
je 0x40171a
cmp dword [esp + 0x38], 3
jbe 0x40171a
lea eax, [esp + 0x14]
push 0x14d
push eax
call fcn.004017a2
pop ecx
pop ecx
test eax, eax
je 0x40171a
cmp eax, dword [esp + 0x38]
je 0x401745
lea ecx, [esp + 0x14]
add edi, 4
call fcn.00401535
inc ebp
cmp ebp, dword [esp + 0x10]
jb 0x4016e6
xor edi, edi
mov ecx, dword [esp + 0x2c]
lea eax, [esi + edi]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004021fd
add esp, 0x20
ret
mov eax, dword [ebx + 0x24]
lea eax, [eax + ebp*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + esi]
lea ecx, [esp + 0x14]
call fcn.00401535
jmp 0x40172f

Function at 0x4017a2
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
lea eax, [esi + 0x10]
mov edi, dword [eax]
mov ebp, edi
xor ebp, dword [esp + 0x24]
cmp dword [esi + 0x14], 0x10
mov dword [esp + 0x18], eax
jb 0x4017c8
mov esi, dword [esi]
mov dword [esp + 0x20], esi
shr edi, 2
xor ebx, ebx
mov dword [esp + 0x14], edi
test edi, edi
je 0x401825
mov dword [esp + 0x24], esi
push ebx
call dword [sym.imp.ADVAPI32.dll_IsValidAcl]
push 4
lea eax, [esp + 0x28]
push esi
push eax
call fcn.00402e50
imul ecx, dword [esp + 0x30], 0x5bd1e991
add esp, 0xc
imul ebp, ebp, 0x5bd1e991
add esi, 4
mov eax, ecx
shr eax, 0x18
xor eax, ecx
imul eax, eax, 0x5bd1e991
xor ebp, eax
mov dword [esp + 0x24], eax
sub edi, 1
jne 0x4017d9
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
and eax, 3
sub eax, 1
je 0x40184b
sub eax, 1
je 0x401841
sub eax, 1
jne 0x401859
movsx ebx, byte [esi + edi*4 + 2]
shl ebx, 0x10
movsx eax, byte [esi + edi*4 + 1]
shl eax, 8
xor ebx, eax
movsx eax, byte [esi + edi*4]
xor eax, ebx
imul eax, eax, 0x5bd1e991
xor ebp, eax
mov eax, ebp
shr eax, 0xd
xor eax, ebp
imul ecx, eax, 0x5bd1e991
pop edi
pop esi
pop ebp
pop ebx
mov eax, ecx
shr eax, 0xf
xor eax, ecx
add esp, 0xc
ret

Function at 0x402b15
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x402b54
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x402b54
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x402b54
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x402b54
cmp dword [ecx + 0x74], 0xe
jbe 0x402b54
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x409394
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x417924
push 0x41791c
push str.FlsAlloc
push 0x1e
call fcn.00409215
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4093c8
push dword [ebp + 8]
mov ecx, esi
call dword [0x415148]
call esi
jmp 0x4093ce
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x409412
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x417934
push 0x41792c
push str.FlsGetValue
push 0x20
call fcn.00409215
mov esi, eax
add esp, 0x10
test esi, esi
je 0x409449
push dword [ebp + 8]
mov ecx, esi
call dword [0x415148]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x40c932
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40c9cf
push ebx
push esi
call fcn.0040c8fb
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040c844
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40c97c
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40c9ce
push edi
push eax
call fcn.00409bb0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40c99c
call fcn.004090a8
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40c9cd
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040c844
add esp, 0x20
test eax, eax
jne 0x40c9bb
push edi
call fcn.004090a8
jmp 0x40c9c3
push ebx
call fcn.004090a8
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x414280
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4142ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4142ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x6aca70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x65e015
lea edi, [esi - 0x25d015]
push edi
or ebp, 0xffffffff
jmp 0x6aca92
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6aca99
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6aca88
mov eax, 1
add ebx, ebx
jne 0x6acaab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x6acabc
jne 0x6acadb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6acadb
dec eax
add ebx, ebx
jne 0x6acac8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x6acaa0
add ebx, ebx
jne 0x6acad7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x6acb2d
xor ecx, ecx
sub eax, 3
jb 0x6acaf3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x6acb62
sar eax, 1
mov ebp, eax
jmp 0x6acafe
add ebx, ebx
jne 0x6acafe
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6acacc
inc ecx
add ebx, ebx
jne 0x6acb0c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6acacc
add ebx, ebx
jne 0x6acb19
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x6acb0e
jne 0x6acb2a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x6acb0e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x6acb4c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x6acb3e
jmp 0x6aca8e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x6acb4c
add edi, ecx
jmp 0x6aca8e
pop esi
mov edi, esi
mov ecx, 0xaa91
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x6acb6a
cmp byte [edi], 0x14
jne 0x6acb6a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x6acb6f
lea edi, [esi + 0x2aa000]
mov eax, dword [edi]
or eax, eax
je 0x6acbe7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2ac524]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2ac560]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6acb9c
mov ecx, edi
jns 0x6acbcb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2ac568]
or eax, eax
je 0x6acbe1
mov dword [ebx], eax
add ebx, 4
jmp 0x6acbb9
call dword [esi + 0x2ac564]
mov ebp, dword [esi + 0x2ac56c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x6acc1b
sub esp, 0xffffff80
jmp 0x402f40
Function at 0x408930
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov ebx, 0x4085d8
dec edi
mov eax, edi
call fcn.0040894f
sub edi, eax
add eax, 0x73ffa74e
xor dword [edx], ebx
inc edx
cmp edx, ecx
jne fcn.00408930
ret
Function at 0x487b80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x444c60]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x214], 0
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.004a5950
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x487bcf
cmp dword [ebp + 0xc], 0
jne 0x487bd9
jmp 0x487caa
cmp dword [ebp + 0x10], 0
je 0x487c2e
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x218], edx
mov eax, dword [ebp - 0x218]
add eax, 2
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp - 0x218]
mov dx, word [ecx]
mov word [ebp - 0x21e], dx
add dword [ebp - 0x218], 2
cmp word [ebp - 0x21e], 0
jne 0x487bf7
mov eax, dword [ebp - 0x218]
sub eax, dword [ebp - 0x21c]
sar eax, 1
mov dword [ebp - 0x224], eax
jne 0x487c32
jmp 0x487caa
lea ecx, [ebp - 0x210]
push ecx
push 0x104
call dword [0x436244]
mov edx, dword [ebp + 0x10]
push edx
push 0x104
lea eax, [ebp - 0x210]
push eax
call fcn.004a453b
add esp, 0xc
push 0x43f14c
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.004a3fe2
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x487c7e
jmp 0x487caa
mov eax, dword [ebp - 4]
push eax
push 1
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004a4858
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
call fcn.004a4290
add esp, 4
mov dword [ebp - 0x214], 1
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004a3d66
mov esp, ebp
pop ebp
ret
Function at 0x487fe0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
push 0x3e8
call dword [0x43625c]
push 0x43f1ec
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 4]
push ecx
call fcn.004a3fe2
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x488034
jmp 0x488156
push 2
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.004a4ccf
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
call fcn.004a4ef1
add esp, 4
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004999fc
add esp, 4
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.004a4ccf
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
push edx
push 1
mov eax, dword [ebp - 8]
push eax
call fcn.004a4858
add esp, 0x10
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x14]
je 0x4880a3
jmp 0x48812c
call dword [0x436248]
push eax
call fcn.004a4c11
add esp, 4
push 0x32
push 0xa
call fcn.00487f10
add esp, 8
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x10]
jge 0x4880cd
jmp 0x48812c
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 8]
push ecx
call fcn.00487f60
add esp, 8
mov edx, dword [ebp - 4]
push edx
call fcn.004a4290
add esp, 4
mov eax, dword [ebp + 8]
push eax
call dword [0x43623c]
push 0x43f284
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.004a3fe2
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x488116
jmp 0x488156
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
push 1
mov edx, dword [ebp - 8]
push edx
call fcn.004a4197
add esp, 0x10
cmp dword [ebp - 4], 0
je 0x48813e
mov eax, dword [ebp - 4]
push eax
call fcn.004a4290
add esp, 4
cmp dword [ebp - 8], 0
je 0x488156
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.004999f1
add esp, 4
mov esp, ebp
pop ebp
ret