joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401645
Capabilities:
Delete file
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x12c
mov eax, dword [ebp + 8]
mov dword [esp + 4], 0x40404b
mov dword [esp], eax
call sub.msvcrt.dll_fopen
test eax, eax
jne 0x401674
mov dword [esp], str.Error_opening_file
jmp 0x401759
mov dword [esp + 8], 2
mov edi, eax
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_fseek
mov dword [esp], edi
call sub.msvcrt.dll_ftell
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov esi, eax
mov dword [esp], edi
call sub.msvcrt.dll_fseek
mov dword [esp], esi
call sub.msvcrt.dll_malloc
mov ebx, eax
test eax, eax
jne 0x4016d2
mov dword [esp], edi
call sub.msvcrt.dll_fclose
mov dword [esp], str.Memory_allocation_error
jmp 0x401759
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov dword [esp], edi
call sub.msvcrt.dll_fclose
xor ecx, ecx
cmp ecx, esi
jge 0x40170b
mov eax, ecx
xor edx, edx
div dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov al, byte [eax + edx]
xor byte [ebx + ecx], al
inc ecx
jmp 0x4016f4
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x118]
mov dword [esp + 8], str._s.enc
mov dword [esp], edx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x100
call fcn.004015c0
lea edx, [ebp - 0x118]
mov dword [esp + 4], 0x404079
mov dword [esp], edx
call sub.msvcrt.dll_fopen
test eax, eax
jne 0x401760
mov dword [esp], ebx
call sub.msvcrt.dll_free
mov dword [esp], str.Error_creating_file
call sub.msvcrt.dll_perror
jmp 0x40179f
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov dword [esp], ebx
mov dword [ebp - 0x11c], eax
call sub.msvcrt.dll_fwrite
mov edx, dword [ebp - 0x11c]
mov dword [esp], edx
call sub.msvcrt.dll_fclose
mov dword [esp], ebx
call sub.msvcrt.dll_free
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_remove
add esp, 0x12c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401c40
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x4063a0]
test esi, esi
jle 0x401d50
mov edi, dword [0x4063a4]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x401c74
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x401cf5
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x401c60
mov dword [esp], eax
mov ebx, eax
call fcn.00402530
test eax, eax
mov edi, eax
je 0x401d77
mov eax, dword [0x4063a4]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00402630
add eax, dword [edi + 0xc]
mov edx, dword [0x4063a4]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401d57
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401cee
sub eax, 4
and eax, 0xfffffffb
jne 0x401d00
add dword [0x4063a0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
add ebx, dword [0x4063a4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401cee
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00402ea0
lea esi, [esi]
xor esi, esi
jmp 0x401c7e
mov eax, dword [0x4063a4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00402ea0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00402ea0
mov esi, esi
lea edi, [edi]

Function at 0x4021b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4063b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4063b0]
sub esp, 4
test ebx, ebx
je 0x402205
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4021fe
test esi, esi
je 0x4021fe
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4021e0
mov dword [esp], 0x4063b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4027c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x13c
mov ebx, dword [esp + 0x150]
call sub.msvcrt.dll__errno
mov dword [eax], 0
test ebx, ebx
je 0x402950
cmp byte [ebx], 0
je 0x402910
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
cmp eax, 0xffffffff
je 0x402940
test al, 0x10
je 0x402910
lea edi, [esp + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0x104
mov dword [esp], edi
mov ebx, edi
call sub.msvcrt.dll__fullpath
mov edx, dword [ebx]
add ebx, 4
lea eax, [edx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x402824
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea edx, [ebx + 2]
mov ecx, eax
cmove ebx, edx
add cl, al
sbb ebx, 3
sub ebx, edi
lea eax, [ebx + 0x233]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
test eax, eax
mov esi, eax
je 0x402930
lea edx, [ebx + 1]
lea ebp, [eax + 0x22c]
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [esp], ebp
mov dword [esp + 0x1c], edx
call sub.msvcrt.dll_memcpy
cmp byte [esi + 0x22c], 0
mov edx, dword [esp + 0x1c]
jne 0x4028f0
add ebx, ebp
lea edx, [esi + 0x120]
mov eax, 0x2a
mov ecx, 0x41
mov word [ebx], ax
xor eax, eax
mov dword [esi + 0x224], 0xffffffff
mov edi, edx
mov dword [esi + 0x228], 0
mov dword [esi + 0x118], 0
mov dword [esi + 0x11c], 0
rep stosd dword es:[edi], eax
add esp, 0x13c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
movzx eax, byte [esi + ebx + 0x22b]
add ebx, ebp
cmp al, 0x5c
je 0x40289a
cmp al, 0x2f
je 0x40289a
mov ecx, 0x5c
mov word [ebx], cx
lea ebx, [ebp + edx]
jmp 0x40289a
call sub.msvcrt.dll__errno
xor esi, esi
mov dword [eax], 0x14
add esp, 0x13c
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
mov dword [eax], 0xc
jmp 0x4028db
call sub.msvcrt.dll__errno
xor esi, esi
mov dword [eax], 2
jmp 0x4028db
call sub.msvcrt.dll__errno
xor esi, esi
mov dword [eax], 0xe
jmp 0x4028db

Function at 0x402ea0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00402d90
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00402d90
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
jmp fcn.004014e0
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
mov ecx, 0x6c1e699f
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e3d0
nop
mov ecx, 0x7b72038d
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4022b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [0x409040]
imul eax, dword [0x409040]
sub eax, 3
mov dword [0x40903c], eax
mov eax, dword [ebp - 0x14]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x4022f7
push 0
call fcn.005e1e18
ret
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x10], ecx
mov eax, dword [0x40903c]
mov ecx, dword [0x409040]
lea eax, [ecx + eax - 9]
mov dword [0x40903c], eax
push 0
push ebx
call fcn.004a744e
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0x4550
je 0x40234c
push 0
push 0
push 0
call fcn.004035ec
add esp, 0xc
mov eax, dword [0x409040]
shl eax, 3
mov dword [0x409040], eax
xor eax, eax
jmp 0x40280d
mov eax, dword [0x409040]
xor edx, edx
push 0xc
pop ecx
div ecx
mov dword [0x409040], eax
push 0x410770
push edi
call fcn.0064a903
push 4
push 0x2000
mov eax, dword [ebp - 0x10]
push dword [eax + 0x50]
mov eax, dword [ebp - 0x10]
push dword [eax + 0x34]
push ebp
call fcn.004e89a5
mov dword [ebp - 0x20], eax
mov eax, dword [0x40903c]
imul eax, eax, 0x63
mov dword [0x40903c], eax
push 0
push 0
push 0
call fcn.0040362a
add esp, 0xc
cmp dword [ebp - 0x20], 0
jne 0x4023dc
push 4
push 0x2000
mov eax, dword [ebp - 0x10]
push dword [eax + 0x50]
push 0
push ecx
call fcn.006ef591
mov dword [ebp - 0x20], eax
mov eax, dword [0x409040]
xor edx, edx
push 0xc
pop ecx
div ecx
mov dword [0x409040], eax
push 0
push 0
push 0
call fcn.0040362a
add esp, 0xc
cmp dword [ebp - 0x20], 0
jne 0x402412
mov eax, dword [0x409040]
add eax, 7
mov dword [0x40903c], eax
mov eax, dword [0x40903c]
imul eax, dword [0x409040]
mov ecx, dword [0x409040]
imul ecx, ecx, 5
sub eax, ecx
mov dword [0x40903c], eax
xor eax, eax
jmp 0x40280d
mov eax, dword [0x409040]
imul eax, dword [0x409040]
sub eax, 3
mov dword [0x40903c], eax
push 0
push 0
push 0
call fcn.004035ec
add esp, 0xc
push 0x14
push 0
call fcn.005adee7
leave
ret
Function at 0x427bf0
Capabilities:
Contain obfuscated stackstrings
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x48
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 0x10]
cmp ebx, esi
je 0x427d52
cmp edi, esi
je 0x427d52
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
add eax, edi
mov dword [ebp - 0x48], 0x44434241
mov dword [ebp - 0x44], 0x48474645
mov dword [ebp - 0x40], 0x4c4b4a49
mov dword [ebp - 0x3c], 0x504f4e4d
mov dword [ebp - 0x38], 0x54535251
mov dword [ebp - 0x34], 0x58575655
mov dword [ebp - 0x30], 0x62615a59
mov dword [ebp - 0x2c], 0x66656463
mov dword [ebp - 0x28], 0x6a696867
mov dword [ebp - 0x24], 0x6e6d6c6b
mov dword [ebp - 0x20], 0x7271706f
mov dword [ebp - 0x1c], 0x76757473
mov dword [ebp - 0x18], 0x7a797877
mov dword [ebp - 0x14], 0x33323130
mov dword [ebp - 0x10], 0x37363534
mov dword [ebp - 0xc], 0x2f2b3938
mov dword [ebp - 4], esi
mov ecx, edi
mov dword [ebp - 8], eax
cmp edx, esi
jbe 0x427d42
add edi, 4
jmp 0x427ca3
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x427cb8
mov dword [ebp - 4], 2
jmp 0x427cd9
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x427ccf
mov dword [ebp - 4], 1
jmp 0x427cd9
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x427d52
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x48]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x48]
mov byte [ecx + 1], bl
mov ebx, dword [ebp - 4]
cmp ebx, 1
jbe 0x427d10
mov byte [ecx + 2], 0x3d
jmp 0x427d1d
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x48]
mov byte [ecx + 2], al
add ecx, 3
add edi, 3
test ebx, ebx
je 0x427d2c
mov byte [ecx], 0x3d
jmp 0x427d32
mov dl, byte [ebp + edx - 0x48]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x427ca0
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
sub ecx, edi
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x474c9d
Capabilities:
Encode data using xor

Disassembly:
mov word [esp + 0x38], 0x4e49
setl bl
sub ebx, ebx
lea ebx, [ebp + 0x66f420bc]
mov edx, ebx
mov edx, dword [esp + 0x48]
not dword [esp + 0x38]
test word [esp + 0x18], bx
mov dword [esp + 0x14], 0xa413db0
mov ebx, dword [esp + 0x20]
jl 0x5f875a
mov word [edx - 0x7effe7c6], cs
je 0x474cf7
xor dword [esp + 0x38], 0x1e9b101f
xor dword [esp + 0x14], ebp
sub word [esp + 0x30], 0x191
call fcn.0065d0bd
cmp byte [edi], bl
adc byte [ebx + 0x246c311e], bl
adc al, 0x66
sub dword [esp + 0x30], 0xd5e80191
sbb dword [esi], 0
popal
push edi
mov ebx, 0x71d204ff
lodsb al, byte [esi]
lodsd eax, dword [esi]
cmp dword [ecx - 0x43], 0x69ad1f2f
xor ah, dl
push ds
sub ebx, dword [edx - 0x7b]
sub edi, ecx
adc eax, 0x74a361b5
lahf
or ebx, ebp
test al, 0xe
xchg dword [edx - 0x25], esp
cld
les ecx, [ecx - 0x8222fdd]
in al, 8
or eax, 0x2d900ddd
pop edx
push esp
mov ch, 0x4f
sbb byte [ecx - 0x63dd02c3], 0x2e
or eax, 0xae5a843a
jp 0x474ccb
imul esi, dword [edx], 0x2b1e64e2
pop edx
test dword [ecx], ebp
iretd
push ebp
salc
cmp byte [ebx - 0x28], 0x98
inc ebp
stc
int 0x34
inc ebp
nop
into
push es
pop ebx
popal
scasb al, byte es:[edi]
cdq
invalid
bswap eax
cmc
rol eax, 3
not eax
rol eax, 1
cmc
xor ebx, eax
add ebp, eax
jmp 0x4ba5cb
push ebp
ret
not edx
call fcn.004925fe
mov edx, dword [edi]
rol ecx, 0x82
adc eax, 0x4525755c
mov ecx, dword [edi + 4]
lea edi, [edi + 8]
bts eax, ebx
mov dword [edx], ecx
mov eax, dword [esi]
cmp eax, ebp
lea esi, [esi + 4]
test esi, 0x2da063a2
clc
cmp sp, 0x2ec9
xor eax, ebx
jmp 0x48c6b8

Function at 0x58696d
Capabilities:
Encode data using xor

Disassembly:
mov ebp, 0x3b410016
out 0xf5, eax
call fcn.004e84a6
call fcn.006bdff3
rol dword [eax], cl
lds ebp, [ebx - 0x7d6ee4e5]
xor al, 0x38
push esp
jg 0x58696f
sbb esi, esi
invalid
sar esp, 0xe9
jno 0x5869cd
sub dword [esp + esi*4 - 0x7d], 0xffffff8c
jae 0x586911
add eax, 0xf1c5ccf9
and byte [eax + 0x61], ch
test al, 0x50
mov eax, 0x28db9aa8
ljmp 0xd3dc
clc
insd dword es:[edi], dx
invalid
or ah, byte [edi - 0x7c]
pop es
mov eax, dword [0x1f48a608]
std
push ds
rcr byte [edx + 0x76176fad], cl
and al, 0x2e
lcall 0x76ee, 0x4fe9233
sbb esi, dword [edi + 0x900333a]
mov dword [0x3bb68159], eax
xor dword [esi + 0x4451783b], 0xe5317b12
or bl, byte [ebx]
js 0x586a0b
js 0x586a45
inc esp
adc bh, byte [ebx + 0x31]
in eax, 0xa
sbb edi, dword [eax + 0xe]
js 0x5869b1
pop ebx
jg 0x5869f2
xor dword [edi - 0x6ae9ef8], 0x22
rol ebx, cl
test eax, 0xa56835da
stosd dword es:[edi], eax
ficomp dword [edi]
in al, dx
sbb ch, byte [ebp + edi*2 - 0x14]
add dword [edx], edi
in al, dx
shr dword [eax - 0x5166261], cl
mov ch, 0xad
lodsb al, byte [esi]
or al, 0xe5
and al, byte [eax]
scasd eax, dword es:[edi]
int1
loope 0x5869ef
ret
xchg esi, eax
xchg ebx, eax
push ss
int1
ret 0x1a1b
mov ebp, 0xf4444cb0
invalid
Function at 0x5a85f5
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x39064d34
call fcn.006af334
jmp fcn.005b18c9
inc ecx
dec edi
inc ecx
ror edi, 1
clc
stc
inc ecx
bswap edi
cmc
push ebx
shr bl, 7
xor bx, 0x6483
inc esp
xor dword [esp], edi
shl bx, 0xc
xchg bl, bh
pop ebx
dec ebp
arpl di, di
inc ecx
cmp bh, 0x10
dec ebp
add edx, edi
jmp 0x4b7be9
jmp fcn.004d0dba
call fcn.004c9eac
push esi
ret
dec ecx
sub ebx, 2
inc ecx
shld edi, esi, cl
jmp 0x5638f4
inc ebp
mov dword [ebx + 8], edi
pushfd
inc ecx
pop dword [ebx]
dec eax
sub edi, 4
inc bp
xchg edi, edi
dec ebp
btc edi, esi
inc ecx
bts edi, edi
inc esp
mov edi, dword [edi]
inc esp
xor edi, ebx
stc
inc ecx
add edi, 0x253454bf
inc ecx
ror edi, 1
inc cx
cmp esp, eax
cmc
inc ecx
sub edi, 0x7134d8e
jmp 0x643794
jns 0x6f903f
and byte [esp + 0x1c], 0x31
call fcn.004d94fd
inc ebp
mov edi, dword [ebx]
inc ecx
mov esi, dword [ebx + 4]
inc ecx
mov cl, byte [ebx + 8]
cmc
clc
jmp 0x529406
inc ecx
ror edi, 1
jmp 0x4a8d8a
ror eax, 1
xor ebx, eax
add esi, eax
jmp esi
not word [esp + 0x18]
mov ebp, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp]
xchg dword [esp + ebp - 0x7bc48921], ecx
mov dword [esp], ebp
not ebp
mov byte [esp], 0x28
push edx
push 0x42ec1550
pop edx
mov ebp, dword [esp + 0x14]
jb 0x4fd79d
jb 0x463d7b
call fcn.0055ba87
je 0x6f90c3
push esi
xadd si, si
bts si, sp
movzx esi, byte [edx]
cmc
xor esi, ecx
cmp si, bx
test al, ch
and esi, 0xff
clc
mov esi, dword [esi*4 + 0x5daca4]
cmp bl, 0xf3
clc
shr ecx, 8
stc
xor ecx, esi
inc edx
xor ecx, 0x4cb4445a
dec eax
jne 0x6f908d
pop esi
cmc
bsr eax, edi
not ecx
mov dword [edi], ecx
cmp bx, sp
cmovae ax, cx
rcr ah, 0x74
sub ebp, 4
lahf
mov eax, dword [ebp]
cmc
test esi, esi
xor eax, ebx
rol eax, 1
not eax
bswap eax
jmp 0x6a3064
Function at 0x61667e
Capabilities:
Encode data using xor

Disassembly:
mov ebx, dword [esp + 0x30]
call fcn.006bc814
and dword gs:[ebp - 0x60], edx
and al, 0x1a
sbb eax, 0x5d5ced53
call 0xe1c97fe0
inc edi
mov ecx, 0x15686f05
popal
sub al, 0x83
jnp 0x6166d5
pop esi
jp 0x6166df
in eax, dx
sti
dec ecx
mov dl, 0xae
dec edx
pushal
cwde
cmp dword [edi + 0x67], 0xca17c75c
add dword [eax - 0x1a], eax
aaa
adc dl, bl
xchg dword [eax - 0x43723f73], esi
retf 0xf131
outsd dx, dword [esi]
mov byte [edx], bh
jbe 0x6166f8
and byte [eax + 0x7ec495f9], bl
jbe 0x61668d
xchg ebp, eax
les edi, [esi + 0x76]
jle 0x616757
stosd dword es:[edi], eax
sub byte [eax - 0x30], al
retf
add dword [esi], ebx
pop ebp
test dword [edi + 0x436af7b6], ecx
daa
loopne 0x6166a9
jae 0x61677a
lahf
invalid
out dx, eax
jl 0x6166dd
mov al, byte [0xf2222b56]
dec ebp
xor byte [edi], dh
pminub mm2, qword [ebp + 0x5473f0e2]
xchg ebp, eax
loop 0x616741
invalid
jae 0x6167a7
inc edi
mov esp, 0xb53f0bcb
and byte [esi + ecx*8], ah
aas
mov ch, 0x20
and al, 0xce
daa
fidiv word [edi + 0x60c918a6]
mov bh, 0xa6
nop
jnp 0x616750
push ss
inc edi
cld
cli
push 0x5db7a9e4
add dword [edi + ebp*2 - 0x6d], ebp
mov es, esi
and dword [esi + edi*8 + 0x2d479d6a], 0xffffffd5
and eax, 0x5c3d734a
or eax, 0x6574bcba
push 0xffffffffffffff9d
inc edi
sub eax, 0x734a25d5
cmp eax, 0xbcba0d5c
je 0x6167ee
mov byte [ecx + 0x22c9db8c], bh
push esi
inc ebx
fcmovne st(0), st(1)
and dl, byte [esi + 0x43]
jae 0x61674e
jno 0x6167e4
jae 0x61678c
mov byte [0x9bbca20b], al
dec esi
arpl word [ebx + 0x1d3c278c], bp
pop esi
inc ebx
sub al, 0x73
retf 0x7379
std
outsb dx, byte [esi]
push ebp
scasd eax, dword es:[edi]
inc esp
invalid
sub edi, edi
pop esp
sub eax, 0xe403b32
inc edx
wait
add eax, 0x54ad086b
popal
mov word [edx - 3], fs
pop esp
push 0x5b32859f
in al, 0xa0
push ebx
wait
xchg edi, eax
jno 0x6167e9
jmp dword [ecx]

Function at 0x62bdef
Capabilities:
Encode data using xor

Disassembly:
lea esi, [esi + 0x5afd49a8]
jno 0x58f226
stc
ror ecx, 2
clc
stc
xor ebx, ecx
cmp ecx, ebx
add esi, ecx
jmp 0x6bc0a8
jmp esi

Function at 0x685948
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 8], ebp
lea eax, [eax + 0x70e015a9]
call fcn.004bac11

Function at 0x70c21f
Capabilities:
Encode data using xor

Disassembly:
jmp esi
add esi, eax
jmp 0x4b7bee
sub esi, 0x27f06bfb
setl byte [esp + 0x14]
lea edx, [edx + esi - 0x772c366c]
neg byte [esp + 0x14]
test dword [esp + 0x14], 0x79e3709d
jno 0x6f925a
inc eax
xor ebx, eax
jmp 0x52d54b
mov edx, dword [esp + 0xc]
mov edx, dword [edx + esi]
jo 0x5c0fe3
jae 0x5541af
daa
add al, 0x17
pop ds
mov eax, dword [0x1bb3ff69]
aam 0xcf
invalid
Function at 0x401d9f
Capabilities:
Get common file path

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push 0x400
call fcn.004045b0
mov dword [esp], eax
mov eax, dword [0x40b3a8]
push eax
push eax
call fcn.004066d2
lea ecx, [esp + 8]
pop edx
call fcn.00403100
push dword [esp]
push 0
push 0x40a00d
push dword [esp + 0x10]
call sub.KERNEL32.DLL_GetTempFileNameA
mov eax, dword [0x40b3a8]
push eax
push eax
push dword [esp + 8]
call fcn.004045d0
lea ecx, [0x40b108]
pop edx
call fcn.00403100
push dword [esp]
call fcn.00404620
push dword [0x40b108]
call fcn.00406640
push dword [0x40b108]
call fcn.00406733
mov eax, dword [0x40b3a8]
push eax
push eax
call fcn.00406575
lea ecx, [0x40b104]
pop edx
call fcn.00403100
mov eax, dword [esp + 0x14]
call fcn.00404640
push eax
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x401e68
mov edx, dword [0x40b108]
push dword [0x40b3a8]
call fcn.00407df0
lea ecx, [0x40b104]
pop edx
call fcn.00403100
mov dword [esp + 0xc], 2
jmp 0x401e7a
mov ebx, 1
cmp ebx, dword [esp]
jne 0x401e7a
mov dword [esp + 0xc], 1
pop eax
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 8]
mov eax, ebx
call fcn.00404640
mov dword [0x40b0fc], eax
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 8]
inc ebx
mov eax, ebx
call fcn.00404640
mov dword [0x40b100], eax
mov eax, 1
jmp 0x401ead
push dword [esp + 4]
call fcn.00407e50
add esp, 0xc
pop ebx
ret 4
Function at 0x402218
Capabilities:
Extract resource via kernel32 functions

Disassembly:
xor eax, eax
push eax
push eax
mov edx, dword [esp + 0x10]
lea ecx, [esp]
call fcn.004030f0
push 0xa
push dword [esp + 4]
push dword [esp + 0x14]
call sub.KERNEL32.DLL_FindResourceA
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x402269
push dword [esp + 4]
push dword [esp + 0x10]
call sub.KERNEL32.DLL_LoadResource
mov dword [0x40b14c], eax
push dword [esp + 4]
push dword [esp + 0x10]
call sub.KERNEL32.DLL_SizeofResource
mov dword [0x40b148], eax
mov eax, dword [esp + 4]
jmp 0x402271
push dword [esp]
call fcn.00407e50
add esp, 8
ret 8
Function at 0x403aea
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
je 0x403b02
push dword [esp + 4]
push 0x403a83
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x403b3f
push esi
mov esi, dword [0x40b1b8]
test esi, esi
je 0x403b3e
push ebx
push edi
mov ebx, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
cmp dword [edi], eax
jne 0x403b36
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
push edi
push 0x40b1b8
call fcn.0040711d
pop ecx
pop ecx
test ebx, ebx
mov esi, ebx
jne 0x403b0f
pop edi
pop ebx
pop esi
ret 4
Function at 0x404477
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x130
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetVersionExA]
push edi
push 0x64
pop edi
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x94
call esi
test eax, eax
je 0x40451b
mov eax, dword [ebp - 0xc]
dec eax
je 0x4044fe
dec eax
jne 0x40451b
mov eax, dword [ebp - 0x18]
sub eax, 3
je 0x4044fa
dec eax
je 0x4044f6
dec eax
je 0x4044dc
dec eax
jne 0x40451b
push 0x46
pop edi
lea eax, [ebp - 0xb8]
push eax
mov dword [ebp - 0xb8], 0x9c
call esi
test eax, eax
je 0x40451b
cmp byte [ebp - 0x1e], 1
je 0x40451b
push 0x4b
jmp 0x40451a
mov eax, dword [ebp - 0x14]
sub eax, 0
je 0x4044f2
dec eax
je 0x4044ee
dec eax
jne 0x40451b
push 0x41
jmp 0x40451a
push 0x3c
jmp 0x40451a
push 0x32
jmp 0x40451a
push 0x14
jmp 0x40451a
push 5
jmp 0x40451a
cmp dword [ebp - 0x14], 0
je 0x404518
cmp dword [ebp - 0x14], 0xa
je 0x404514
cmp dword [ebp - 0x14], 0x5a
jne 0x40451b
push 0x28
jmp 0x40451a
push 0x1e
jmp 0x40451a
push 0xa
pop edi
mov eax, edi
pop edi
pop esi
add ebp, 0x78
leave
ret

Function at 0x404d9c
Capabilities:
Get graphical window text

Disassembly:
push edi
push dword [esp + 8]
push dword [0x40b41c]
call fcn.00406f90
mov edi, eax
test edi, edi
je 0x404dfe
mov eax, dword [edi + 4]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x404dc5
push dword [esp + 0xc]
push edi
call eax
jmp 0x404dfe
push ebx
push esi
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push dword [esp + 0x14]
mov esi, eax
push esi
call fcn.00408000
mov ebx, eax
lea eax, [esi + 1]
push eax
push ebx
mov byte [ebx], 0
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push ebx
call sub.MSVCRT.dll_strlen
pop ecx
sub esi, eax
push esi
call fcn.00408130
pop esi
pop ebx
pop edi
ret 8