joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4149a4
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp], ebp
push 0x698bebde
mov dword [ebp - 0x14], eax
cwde
cwde
not ah
lea eax, [ebx + 0xcc8]
jmp loc.0041f18b

Function at 0x414b2a
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x34]
je 0x41818a
jmp loc.0041e404

Function at 0x4153a2
Capabilities:
Packed with generic packer

Disassembly:
jmp loc.004201e8
jmp 0x40d166

Function at 0x4153ba
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x2c]
jmp loc.0041f935

Function at 0x4154b1
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push 0x94e9a975
xchg dword [ebp - 0x24], eax
pushfd
jmp loc.0042218d

Function at 0x415cb7
Capabilities:
Packed with generic packer

Disassembly:
jmp loc.0041e99f
jmp 0x41187c

Function at 0x415cbc
Capabilities:
Packed with generic packer

Disassembly:
stc
cmp edi, ebx
pushal
call fcn.0040ec40

Function at 0x41661c
Capabilities:
Packed with generic packer

Disassembly:
lea eax, [ebx + eax*4 + 0x6c0]
mov word [esp + 4], 0x5605
push 0x7cd486bd
jmp loc.00420d92

Function at 0x416906
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x41833f
mov dword [esp + 8], 0x40db7c
call fcn.0040d601

Function at 0x41696a
Capabilities:
Packed with generic packer

Disassembly:
mov dh, 0xf2
setb dh
pushal
lea eax, [ebx*2 + 0x44315b39]
lea eax, [ebx + edx*4 + 0x400]
pushfd
jmp loc.0042316d

Function at 0x416b12
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 4]
jb fcn.00414e18
shl ah, 1
sar ah, 4
jmp loc.0041e1a4
cwde
mov eax, 3
mov byte [esp], dh
jmp 0x414e04

Function at 0x416eda
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 4]
jmp loc.00422249

Function at 0x41736d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
rcl ah, cl
xor al, 0xaf
push ebp
inc ah
jmp loc.0041f266

Function at 0x417618
Capabilities:
Packed with generic packer

Disassembly:
jmp loc.0041e14e
cmc
shl eax, 4
cmp ah, bl
stc
pushal
add eax, edx
pushfd
jmp 0x40d3e7

Function at 0x4177ce
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 8]
jmp loc.004221d1
pushfd
lea eax, [ebx + edx*4]
jmp 0x416da2

Function at 0x417b36
Capabilities:
Packed with generic packer

Disassembly:
pushfd
lea eax, [ebx + edx*4 + 0x400]
jmp loc.0042314b

Function at 0x417b68
Capabilities:
Packed with generic packer

Disassembly:
cmp ecx, 7
pushfd
jmp loc.0041ecb6

Function at 0x417cfe
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x24]
jae 0x411b58
bswap cx
pushal
mov ebx, dword [esp + 0x20]
push edi
mov ecx, dword [esp + 0x28]
pushfd
push dword [esp]
push esi
lea esp, [esp + 0x38]
jmp fcn.0040ec15
jmp 0x40ef96
adc dl, dl
jmp 0x41415f

Function at 0x41833a
Capabilities:
Packed with generic packer

Disassembly:
jmp loc.00422e4e
jmp 0x416b06

Function at 0x41834c
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp], ecx
push 0x2f06d989
test al, dl
jmp loc.0041f808

Function at 0x4183cb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushal
lea esp, [esp + 0x28]
jmp loc.00422023
Function at 0x418412
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x40]
jb 0x411b58
lahf
shrd ax, bp, 2
aas
mov eax, dword [ebp - 0x20]
xchg dh, cl
xadd cl, dh
cmp bh, 0xff
xor cl, 0x4a
not eax
bt ax, bx
seto cl
rcr cl, cl
mov cl, byte [eax + edi]
mov al, ah
add cl, cl
bswap ax
not dh
push edx
bswap ax
setb dh
setb ah
not ah
pushal
lea eax, [ebx + edx*4 + 0x400]
push 0xa17ded71
call fcn.004153a7

Function at 0x418479
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0xc]
jmp loc.00422fd6

Function at 0x41a28b
Capabilities:
Packed with generic packer

Disassembly:
mov word [eax + edi], dx
jmp loc.00422d09

Function at 0x41a821
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pop dword [esp + 0x48]
pushfd
cmc
stc
cmc
mov dword [esp + 0x48], esi
sar esi, cl
mov dword [esp + 0x44], ecx
neg si
mov dword [esp + 0x40], ebp
cmp esp, 0x6d1c4dfc
inc si
cmc
bsf si, bx
mov dword [esp + 0x3c], edx
rcl esi, 0xc
mov dword [esp + 0x38], edx
shr si, cl
test bh, dl
inc si
shld esi, esp, cl
push dword [0x41aa0f]
jmp loc.0041fa47

Function at 0x41a95b
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x41c5f4
pushfd
xor ebx, eax
jmp 0x41a90e

Function at 0x41a99e
Capabilities:
Packed with generic packer

Disassembly:
pushal
cld
pushfd
pushfd
push 0xb3e5e2fe
rep movsb byte es:[edi], byte [esi]
rol si, 9
jmp loc.0041f205
mov esi, edx
movzx di, cl
mov dword [esp + 4], esp
jmp 0x41ad7d
mov word [esp], 0xda17
lea edi, [ecx + eax - 0x40]
cld
lea esp, [esp + 0x24]
jno 0x41b46c
pushal
pushfd
xchg dword [esp + 0x20], edi
push 0x54801c85
std
mov edi, eax
jmp 0x41a114
call fcn.0041b3fa
pushfd
pop dword [esp + 0x30]
pushfd
pushfd
lea esp, [esp + 0x38]
jno 0x41bd8c
pop dword [ebp]
push 0x3fca28e6
lea esp, [esp + 4]
jmp fcn.0041b394

Function at 0x41abb4
Capabilities:
Packed with generic packer

Disassembly:
pushfd
jmp loc.004233d8
cwde
jmp 0x41c111
sub ebp, 4
jmp 0x41a37d

Function at 0x41b14b
Capabilities:
Packed with generic packer

Disassembly:
cmp cl, dl
cmc
cbw
test dl, cl
jmp loc.0041ec3a

Function at 0x41b25a
Capabilities:
Packed with generic packer

Disassembly:
xchg dword [esp + 0x40], esi
cmp ah, cl
mov dword [esp + 0x3c], ecx
inc esi
mov dword [esp + 0x38], ebp
shld si, di, cl
adc si, sp
mov dword [esp + 0x34], edx
movsx si, dl
test ah, dl
mov dword [esp + 0x30], edx
neg si
push dword [0x41aa0f]
pop dword [esp + 0x2c]
xor si, 0x7bd5
sub esi, edi
dec si
neg si
mov dword [esp + 0x28], 0
jmp loc.00421e8b

Function at 0x41b3fa
Capabilities:
Packed with generic packer

Disassembly:
jmp loc.004218ac
xchg dword [esp], edi
not di
pushal
std
push ecx
mov edi, eax
push dword [esp + 8]
push 0x1d31f08c
cld
jmp 0x41a2f1

Function at 0x41b58a
Capabilities:
Packed with generic packer

Disassembly:
dec ax
pushfd
clc
rol ax, 5
test dl, 0x22
bt di, di
cmp dh, 0xa5
sub ax, 0xc8f0
stc
test dx, 0x6915
stc
xor bx, ax
mov word [esp + 4], di
clc
cmp bh, 0x3c
sub esi, 0xfffffffe
jmp loc.0042216b
Function at 0x41b9f9
Capabilities:
Packed with generic packer

Disassembly:
pushfd
cmp ebx, 0xfe0
mov byte [esp + 0x18], bh
mov byte [esp + 0xc], 0xc1
lea esp, [esp + 0x28]
jne 0x41ba1d
bswap bx
bswap bx
xor byte [ebp + 0xc], 0x20

Function at 0x41be0b
Capabilities:
Packed with generic packer

Disassembly:
mov al, byte [esi]
sbb ch, 0x8d
stc
sar ch, 5
and ch, dh
xor al, bl
btc ecx, 9
bt edx, 0x17
sal cx, 4
add al, 0x90
btc cx, di
rol cl, cl
ror al, 1
shrd cx, dx, 4
movzx cx, cl
not al
cmc
xor bl, al
pushal
jmp loc.00421fe2

Function at 0x41c43f
Capabilities:
Packed with generic packer

Disassembly:
push eax
inc cx
movzx eax, al
jmp loc.00420717

Function at 0x41c467
Capabilities:
Packed with generic packer

Disassembly:
push esp
mov dword [esp + 0x40], eax
mov byte [esp], cl
push dword [esp + 0xc]
pushfd
pop dword [esp + 0x40]
clc
mov byte [esp + 4], ch
pushfd
push dword [esp + 4]
mov dword [esp + 0x44], esi
ror si, cl
jmp loc.00421a9b

Function at 0x41c6cb
Capabilities:
Packed with generic packer

Disassembly:
jmp loc.00422d89
jmp 0x41c31d

Function at 0x41e07d
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push ebx
push edi
push 0x20
pop edi
xor ebx, ebx
push 0x8001
cmp ax, 6
add esp, 0xc
leave
popal
popfd
push 0xbcf81b4
jmp loc.0041bb0d

Function at 0x41e7d7
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4050c0
push 0x404740
push eax
push ebx
push edi
push 1
pop ecx
mov ecx, dword [0x4073a8]
mov ecx, dword [0x4073a4]
add esp, 0x18
leave
popal
popfd
push 0xa702ff44
jmp loc.0041baee

Function at 0x41e911
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push 0x60
push 0x4092d0
push eax
mov edi, 0x94
push edi
push 0
mov ebx, dword [0x40803c]
push eax
add esp, 0x18
leave
popal
popfd
add si, 0xf8f3
jmp fcn.0041bf5f

Function at 0x41ea66
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push ebx
push edi
push 0x20
push 0x8001
push 8
push 0x2b4
push eax
push 0x40861c
push 0x408604
push 0x4685a0
push eax
mov edi, 0x4c10a0
push edi
mov eax, edi
add esp, 0x30
leave
popal
popfd
inc si
mov esi, dword [esp + 0x44]
jmp fcn.0041c52b

Function at 0x41ed34
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
dec eax
salc
add dh, dl
salc
pop edi
push ebx
dec edi
pop edi
dec edi
dec ecx
and al, 0
add al, 0
popal
popfd
adc esp, dword [eax + 0xd4c40d9]
jmp fcn.0040da18

Function at 0x41ed55
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
dec eax
salc
add dh, dl
salc
pop edi
push ebx
dec edi
pop edi
dec edi
dec ecx
and al, 0
add al, 0
popal
popfd
xor eax, 0xd4dfc
jmp loc.004166da
Function at 0x41eff8
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4050a0
push 0x401cd0
push eax
push ebx
push edi
xor edx, edx
mov dl, ah
mov ecx, eax
and ecx, 0xff
shl ecx, 8
add ecx, edx
shr eax, 0x10
pop ecx
test eax, eax
add esp, 0x14
leave
popal
popfd
push dword [esp + 8]
push dword [esp + 0x30]
jmp loc.0041b718

Function at 0x41f431
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push ebx
push edi
push 0x20
push 0x8001
push 8
push 0x2b4
push eax
push 0x40861c
push 0x408604
push 0x4685a0
push eax
mov edi, 0x4c10a0
push edi
mov eax, edi
add esp, 0x30
leave
popal
popfd
or bh, 0x63
mov ebx, eax
jmp loc.0041a17a

Function at 0x41fd61
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
dec eax
pop edi
push ebx
dec edi
pop edi
dec edi
add ch, ch
aas
mov ah, 2
push ebx
dec ecx
nop
cmp al, 0
leave
popal
popfd
or eax, 0xf79bf0d4
jmp loc.0040eebd

Function at 0x41fe3c
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
xor eax, eax
mov ecx, 0x11
push edi
push ebx
mov edi, edx
mov al, 0x30
and eax, 0xfffffff0
add esp, 8
leave
popal
popfd
test dh, 0xcd
xor al, 0xfc
jmp loc.0041bbb5

Function at 0x41ffa5
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
jmp 0x41c922
mov word [ebp], ax
pushal
mov byte [esp], ah
mov byte [esp + 8], 0x10
mov word [esp + 4], 0x946
lea esp, [esp + 0x44]
jmp loc.0041af52
pushfd
pushal
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4050a0
push 0x401cd0
push eax
push ebx
push edi
xor edx, edx
mov dl, ah
mov ecx, eax
and ecx, 0xff
shl ecx, 8
add ecx, edx
shr eax, 0x10
pop ecx
test eax, eax
add esp, 0x14
leave
popal
popfd
jno 0x41abba
jmp fcn.0041afb7

Function at 0x42019a
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push ebx
push edi
push 0x20
pop edi
xor ebx, ebx
push 0x8001
cmp ax, 6
add esp, 0xc
leave
popal
popfd
push 0x2ce0f77
jmp loc.0041bbe4

Function at 0x420364
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
xor eax, eax
mov ecx, 0x11
push edi
push ebx
mov edi, edx
mov al, 0x30
and eax, 0xfffffff0
add esp, 8
leave
popal
popfd
bsr ax, bp
das
jmp loc.0041c2bd

Function at 0x420581
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4369a8
push 0x41f054
push eax
push ebx
push edi
xor edx, edx
mov dl, ah
mov ecx, eax
and ecx, 0xff
shl ecx, 8
add ecx, edx
shr eax, 0x10
push 1
pop ecx
test eax, eax
add esp, 0x18
leave
popal
popfd
pop dword [esp + 0x1c]
sub edi, ebx
jmp fcn.0041ae7b

Function at 0x4206ee
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
mov eax, dword [0x40e0e7]
shl eax, 2
push edi
push ecx
xor eax, eax
mov edi, 0x411b2c
mov ecx, 0x4124bc
cmp ecx, edi
add esp, 8
leave
popal
popfd
jmp fcn.0041c9a8
Function at 0x42092e
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
mov edi, edi
mov edx, 0x4017f4
mov ecx, 0x4017f0
mov edx, 0x4017ec
mov ecx, 0x4017e8
push eax
push ecx
push ecx
push 0
mov ecx, eax
mov edx, 0x4017fc
mov ecx, 0x4017f8
mov edx, 0x401804
mov ecx, 0x401800
add esp, 0x10
leave
popal
popfd
push 0x68a9f67e
jmp loc.0041b0c3

Function at 0x420f3c
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x402208
push 0x401516
push eax
push ebx
push edi
xor ebx, ebx
push 2
pop ecx
mov ecx, dword [0x403130]
mov ecx, dword [0x40312c]
add esp, 0x18
leave
popal
popfd
push dword [esp]
mov al, byte ss:[edx]
jmp loc.0041c65b

Function at 0x421563
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push ebx
push edi
push 0x20
pop edi
xor ebx, ebx
push 0x8001
and eax, 0xbfffffff
cmp ax, 6
add esp, 0xc
leave
popal
popfd
jmp loc.0041a94e

Function at 0x4217eb
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push ebx
push edi
push 0x20
push 0x8001
push 8
push 0x2b4
push eax
push 0x40a264
push 0x40a24c
push 0x476aa0
push eax
mov edi, 0x4cf0a0
push edi
mov eax, edi
add esp, 0x30
leave
popal
popfd
jmp loc.0041c189

Function at 0x422918
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push edi
push 0x8001
push ebx
push 8
push ebx
push 0x160
push eax
push ebx
push 0x420cb0
push 0x40a810
push 0x425b00
mov edi, 0x42c000
push eax
push edi
push ebx
mov eax, edi
add esp, 0x3c
leave
popal
popfd
jmp fcn.0041c401

Function at 0x4230be
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push ebx
push edi
push 0x20
pop edi
xor ebx, ebx
push 0x8001
cmp ax, 6
add esp, 0xc
leave
popal
popfd
mov word [eax], dx
push dword [esp]
jmp loc.0041ac0e
Function at 0x4011c6
Capabilities:
Access peb ldr_data
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
call fcn.0040114f
call section..text
movzx eax, al
cmp eax, 1
jne 0x4011e9
push 5
pop eax
jmp 0x4013b8
and dword [ebp - 0x40], 0
and dword [ebp - 0xc], 0
and dword [ebp - 0x30], 0
and dword [ebp - 0x14], 0
and dword [ebp - 0x24], 0
and dword [ebp - 0x44], 0
and dword [ebp - 8], 0
and dword [ebp - 0x18], 0
and dword [ebp - 0x1c], 0
and dword [ebp - 0x20], 0
mov dword [ebp - 0x2c], 0x330
pushal
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ebx, eax
add ebx, 0xc
mov eax, dword [eax + 0xc]
mov edi, dword [eax + 0x30]
mov ecx, 0x18
xor esi, esi
xor ebx, ebx
add bl, byte [edi + ecx - 1]
add esi, ebx
loop 0x401234
cmp esi, dword [ebp - 0x2c]
je 0x401249
mov eax, dword [eax]
cmp eax, ebx
jne 0x40122a
mov eax, dword [eax + 0x18]
mov dword [ebp - 8], eax
nop
popal
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
push 0x429338
push dword [0x429320]
push 0x429324
push dword [0x429338]
push 0x42933c
call fcn.0040102b
add esp, 0x14
push 0x42933c
push dword [ebp - 8]
call dword [ebp - 0xc]
mov dword [ebp - 0x30], eax
push 0x429358
push dword [0x429320]
push 0x429324
push dword [0x429358]
push 0x42935c
call fcn.0040102b
add esp, 0x14
push 0x42935c
push dword [ebp - 8]
call dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
push 0x429378
push dword [0x429320]
push 0x429324
push dword [0x429378]
push 0x42937c
call fcn.0040102b
add esp, 0x14
push 0x42937c
push dword [ebp - 8]
call dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [0x404038]
mov dword [ebp - 0x10], eax
push 4
push 0x1000
mov eax, dword [ebp - 0x10]
inc eax
push eax
push 0
call dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 0x404040
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x10]
push eax
push dword [section..data]
push 0x404004
push dword [ebp - 0x10]
push dword [ebp - 4]
call fcn.0040102b
add esp, 0x14
mov dword [ebp - 4], eax
and dword [ebp - 0x34], 0
lea eax, [ebp - 0x34]
push eax
push 0x20
push dword [0x404038]
push dword [ebp - 4]
call dword [ebp - 0x24]
push 0x404714
push dword [0x40403c]
push 0x4046e0
push dword [0x404714]
push 0x404718
call fcn.0040102b
add esp, 0x14
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
mov dword [0x4293cc], eax
and dword [ebp - 0x28], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + eax]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 1
push dword [ebp - 0x28]
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
call dword [0x4293cc]
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x64cf5d81
nop
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x5ceb64c5
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x4013a0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7ec
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x79c], 4
mov dword [ebp - 0x784], 0x80000000
mov dword [ebp - 0x798], 0x20019
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x72c], eax
push 0xb
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0xb
call dword [sym.imp.USER32.dll_GetSystemMetrics]
pushal
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x790], 0x64
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x790], 0x64
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x7ec], str.SOFTWAREClasses
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x790], 0x64
mov dword [ebp - 0x28], 3
call fcn.00401390
mov ecx, 0x43
mov edx, dword [ebp - 0x7ec]
mov word [edx + 0x12], cx
mov eax, 0x6c
mov ecx, dword [ebp - 0x7ec]
mov word [ecx + 0x14], ax
lea edx, [ebp - 0x34]
push edx
push 1
push 0
mov eax, dword [ebp - 0x7ec]
push eax
push 0x80000002
call dword [0x440d48]
test eax, eax
je 0x4014b1
xor eax, eax
jmp 0x401757
lea ecx, [ebp - 0x34]
push ecx
push 1
push 0
push str.clsid083863f1_70de_11d0_bd40_00a0c911ce86instance129d7e40_c10d_11d0_afb9_00aa00b67a42
push 0x80000000
call dword [0x440d48]
test eax, eax
je 0x4014d4
xor eax, eax
jmp 0x401757
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
jne 0x4014ec
xor eax, eax
jmp 0x401757
push 1
mov edx, dword [0x440d44]
push edx
jmp section..htext
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4018f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov dword [ebp - 0x114], str.777ll
push 0x104
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ecx, dword [ebp - 0x114]
push ecx
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0x80
push 3
push 0
push 3
push 1
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
je 0x40195f
cmp dword [ebp - 0x118], 0
je 0x40195f
jmp 0x4019c3
mov ecx, dword [ebp + 8]
cmp dword [ecx + 4], 0
je 0x4019c3
mov dword [ebp - 0x11c], 0x7dc35
mov edx, dword [ebp + 8]
add edx, 8
mov dword [0x440d34], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov dword [0x440d50], ecx
mov dword [ebp - 0x11c], 0x7dc35
mov dword [ebp - 0x11c], 0x7dc35
call fcn.004011b0
mov edx, dword [ebp + 8]
mov dword [0x440d4c], edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
call fcn.00401300
add esp, 0xc
mov dword [ebp + 8], eax
jmp 0x40195f
mov esp, ebp
pop ebp
ret
Function at 0x401a60
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [0x440d40], 0x24e1
mov eax, dword [0x440d40]
sub eax, 0x24e1
mov dword [0x440d40], eax
mov ecx, 1
test ecx, ecx
je 0x401b0b
mov edx, dword [0x440d40]
cmp edx, dword [ebp + 0xc]
jb 0x401a97
jmp 0x401b0b
cmp dword [0x440d40], 0
jne 0x401ab5
push 0x263
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x401ab5
xor eax, eax
jmp 0x401b0b
mov eax, dword [ebp + 8]
add eax, dword [0x440d40]
mov ecx, dword [eax]
add ecx, dword [0x440d40]
mov edx, dword [ebp + 8]
add edx, dword [0x440d40]
mov dword [edx], ecx
mov dword [ebp - 4], 0x15
mov eax, dword [0x440d40]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 2]
push edx
mov eax, dword [ebp + 8]
add eax, dword [0x440d40]
push eax
call fcn.004011c0
add esp, 8
mov ecx, dword [0x440d40]
add ecx, 4
mov dword [0x440d40], ecx
jmp 0x401a7d
mov esp, ebp
pop ebp
ret
Function at 0x42695b
Capabilities:
Encode data using xor

Disassembly:
mov word [esi - 0x54], gs
sub bh, dl
jnp 0x4268f1
out dx, eax
pop ds
pop edi
or byte [ecx - 0x12ef8343], ah
adc eax, 0x3c882f43
test al, 0xef
and ebp, ebp
sub byte [ebp + 0x8b469d8], bh
sal esp, 1
dec esi
pop ecx
jmp 0x16055740
xor edx, dword [ecx + 0x358f5af9]
mov eax, dword [0x814bd7d3]
add al, 0
dec esi
dec esi
cli
stosd dword es:[edi], eax
std
pop esi
xchg esp, eax
mov edi, 0xbd343d7a
push 0x4b
jl 0x4269a3
push 0x1d
loop 0x4268e9
sbb eax, 0x8dbfade2
mov cl, 0xa8
sub dword [ecx + ecx*2 + 0x57], 0x963eff2f
xchg esi, eax
mov edi, 0x81a8b18d
insb byte es:[edi], dx
dec ecx
push edi
das
invalid
jle 0x426967
push 0xffffffffffffff9b
mov dl, 0xb
inc dword cs:[ebp + edx*2 + 0x5b]
das
push ecx
push esi
dec ebp
test byte [edi], bl
test dword [eax + 0x77], edi
ja 0x4269a9
dec esp
push esi
int 0xa7
cmpsb byte [esi], byte es:[edi]
mov esp, 0xe1da583c
daa
cmp al, 0xba
pop edx
push es
pop ebx
or dword [edx], 0x9ce24426
dec ebp
and byte [ecx], bl
jp 0x426938
xchg edi, eax
or cl, byte [edx - 0x2d]
daa
dec edx
shl dword [edi], cl
insb byte es:[edi], dx
push edi
sub ebp, dword [esi + 0x22]
xchg edi, eax
cmp dl, dh
cmc
pop esi
stosd dword es:[edi], eax
scasb al, byte es:[edi]
jnp 0x42697a
invalid
sub eax, 0xb0adaf7f
push ds
mov dh, 0x92
dec eax
pushfd
sub esp, dword [ebp + 0x1e7bf30b]
das
stosd dword es:[edi], eax
fdiv qword [edx + ebp*2]
xor al, 0x6a
adc al, 0x60
jl 0x426967
mov esi, 0x89c95a15
ret
adc eax, 0xc389c95a
jb 0x426990
dec ecx
push edi
jno 0x4269e6
clc
in eax, dx
pop ebx
test eax, 0xea834c4c
rol byte [eax - 0x76], 0xf8
mov ch, ah
xchg byte [eax + eax*4], al
push ss
jns 0x4269c8
mov dword [edi], ebx
sub byte [edi + 0x57], bl
invalid
and byte [ebx - 0x3f13a3ae], bl
cmpsd dword [esi], dword es:[edi]
jo 0x426a5b
out 0xd9, al
xor byte [edx + 0x1b02d542], ch
pop ebp
sti
loop 0x4269a8
jno 0x4269c5
jns 0x426a2d
push 0xffffffffffffffe5
stosd dword es:[edi], eax
cdq
aam 0x69
jecxz 0x426a84
cmp al, 0x72
mov ah, 0xd8
invalid
invalid
and eax, 0xb35f7537
fimul dword [ecx]
test byte [edi + 0x14b5714b], cl
adc ch, byte fs:[eax - 0x1d9a578c]
adc al, 0x64
adc ch, byte [eax - 0x1d9a578c]
adc al, 0xa6
dec ebx
clc
jnp 0x426a51
mov al, byte [0xf2366066]
sti
loope 0x426a45
aaa
invalid
mov ebp, 0xf950c8fa
lea ebp, [ebp + 0x4a174098]
fimul dword [esi + ebp*2 + 0x4afe5873]
push cs
or al, 0x57
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x640bbe59], cl
cmp al, 0xb4
call 0x96c5d151
aas
dec edi
invalid