joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413728
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x41384d
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.00413538
mov esi, eax
mov eax, dword [0x45668c]
cmp byte [eax], 0
je 0x4137f5
mov eax, dword [0x456474]
call fcn.00404718
call fcn.00404350
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x413700]
call fcn.004084c4
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x413868
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x413831
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x456424]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x459c40]
call fcn.0040869c
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413854
lea eax, [ebp - 4]
mov edx, dword [0x413700]
call fcn.004085e4
ret

Function at 0x415800
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.004066f4
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
mov edi, eax
cmp edi, 0x104
jbe 0x4157aa
mov eax, edi
add eax, eax
call fcn.00404208
mov esi, eax
jmp 0x4157ac
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
push edi
push esi
call sub.user32.dll_CharUpperBuffW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x4157e5
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x4157cf
mov eax, esp
cmp esi, eax
je 0x4157f2
mov eax, esi
call fcn.00404224
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x41582c
cmp bl, 0
je 0x415828
cmp bl, 0x41
jl 0x415823
cmp bl, 0x5a
jg 0x415823
or bl, 0x20
xor al, bl
inc esi
jmp 0x415807
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x41576c
Function at 0x43a288
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43a31e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4567c0]
cmp dword [eax], 2
jne 0x43a2c8
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
push esi
push ebx
call sub.advapi32.dll_RegQueryValueExW_1
mov ebx, eax
jmp 0x43a300
lea eax, [ebp - 8]
mov edx, esi
call fcn.00406af0
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.004066b8
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
mov eax, dword [ebp - 4]
call fcn.00406844
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43a325
lea eax, [ebp - 8]
call fcn.0040698c
lea eax, [ebp - 4]
call fcn.004063c0
ret

Function at 0x43a750
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [ebp - 8], eax
push 0x20019
lea eax, [ebp - 8]
push eax
mov eax, edi
call fcn.00406e20
mov edx, eax
mov eax, ebx
call fcn.0043a0f4
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.0043a1d0
test eax, eax
sete al
mov ebx, eax
test bl, bl
je 0x43a7c2
push 0
push 0
push esi
push 0
mov eax, dword [ebp - 4]
call fcn.00406e20
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x43ad90
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x43ae46
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.00406e20
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jbe 0x43ae30
lea eax, [ebp - 4]
mov edx, edi
call fcn.004070ec
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebp - 0x10]
push eax
mov eax, esi
call fcn.00406e20
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x43ae30
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x43ae58
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x43ae30
cmp dword [ebp - 0xc], 0x34
jne 0x43ae30
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43ae4d
lea eax, [ebp - 4]
call fcn.00406d84
ret
Function at 0x43f350
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43f5aa
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
mov edx, 0x24
call fcn.0043ddfc
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov eax, dword [ebp - 0x14]
mov dword [0x4553a8], eax
mov eax, dword [ebp - 0xc]
mov dword [0x4553ac], eax
mov eax, dword [ebp - 0x24]
mov dword [0x4553b0], eax
mov eax, dword [0x4567c0]
cmp dword [eax], 2
sete byte [0x454b40]
push 0x43f5b8
call sub.kernel32.dll_GetModuleHandleW_2
lea edx, [ebp - 4]
call fcn.0043ab7c
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp byte [0x454b40], 0
jne 0x43f3df
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.0043ad90
test al, al
je 0x43f3df
mov eax, dword [ebp - 0x4c]
mov dword [0x4dc54c], eax
jmp 0x43f3e6
xor eax, eax
mov dword [0x4dc54c], eax
call fcn.0043e9f0
and eax, 0x7f
cmp eax, 0x1a
ja case.0x43f3f7.0
jmp dword [eax*4 + 0x43f3fe]
mov byte [0x454b2c], 1
jmp case.0x43f3f7.0
mov byte [0x454b30], 1
jmp case.0x43f3f7.0
mov byte [0x454b34], 1
jmp case.0x43f3f7.0
mov byte [0x454b38], 1
jmp case.0x43f3f7.0
mov byte [0x454b3c], 1
jmp case.0x43f3f7.0
mov byte [0x454b44], 1
mov byte [0x454b48], 1
jmp case.0x43f3f7.0
mov byte [0x454b44], 1
mov byte [0x454b4c], 1
jmp case.0x43f3f7.0
mov byte [0x454b44], 1
mov byte [0x454b4c], 1
mov byte [0x454b50], 1
jmp case.0x43f3f7.0
mov byte [0x454b54], 1
jmp case.0x43f3f7.0
mov byte [0x454b58], 1
jmp case.0x43f3f7.0
mov byte [0x454b5c], 1
jmp case.0x43f3f7.0
mov byte [0x454b60], 1
jmp case.0x43f3f7.0
mov byte [0x454b64], 1
jmp case.0x43f3f7.0
mov byte [0x454b68], 1
jmp case.0x43f3f7.0
mov byte [0x454b6c], 1
jmp case.0x43f3f7.0
mov byte [0x454b70], 1
jmp case.0x43f3f7.0
mov byte [0x454b74], 1
jmp case.0x43f3f7.0
mov byte [0x454b78], 1
jmp case.0x43f3f7.0
mov byte [0x454b7c], 1
jmp case.0x43f3f7.0
mov byte [0x454b80], 1
jmp case.0x43f3f7.0
mov byte [0x454b84], 1
jmp case.0x43f3f7.0
mov byte [0x454b88], 1
jmp case.0x43f3f7.0
mov byte [0x454b8c], 1
jmp case.0x43f3f7.0
mov byte [0x454b90], 1
jmp case.0x43f3f7.0
mov byte [0x454b94], 1
jmp case.0x43f3f7.0
mov byte [0x454b98], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f5b1
lea eax, [ebp - 4]
call fcn.00406d84
ret

Function at 0x442cbc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 0x14], edx
xor edx, edx
push ebp
push 0x442d20
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 0xe]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xe]
mov ecx, 7
call fcn.00406f7c
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetACP_1
mov edx, eax
pop eax
call fcn.0040f6c0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442d27
lea eax, [ebp - 0x14]
call fcn.00406d84
ret
Function at 0x4446a8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00406b74
push eax
call 0x40a894
cmp eax, 0xffffffff
je 0x4446c1
test al, 0x10
jne 0x4446c5
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x445a10
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 8]
dec ecx
test ecx, ecx
jl 0x445a85
inc ecx
inc byte [eax + 0x100]
movzx edx, byte [eax + 0x100]
movzx edx, byte [eax + edx]
add byte [eax + 0x101], dl
movzx esi, byte [eax + 0x100]
movzx edx, byte [eax + esi]
movzx ebx, byte [eax + 0x101]
movzx ebx, byte [eax + ebx]
push ebx
pop ebx
mov byte [eax + esi], bl
movzx ebx, byte [eax + 0x101]
mov byte [eax + ebx], dl
movzx edx, byte [eax + 0x100]
movzx edx, byte [eax + edx]
movzx ebx, byte [eax + 0x101]
add dl, byte [eax + ebx]
movzx edx, dl
movzx edx, byte [eax + edx]
mov ebx, dword [ebp - 4]
xor byte [ebx], dl
inc dword [ebp - 4]
dec ecx
jne 0x445a22
pop esi
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x448a34
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x448bc9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4dd68c]
or edx, 0xffffffff
call fcn.004054c0
xor edx, edx
push ebp
push 0x448ba4
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [ebp + 8]
mov eax, dword [0x4dd68c]
call fcn.004512d4
test al, al
je 0x448a94
mov edx, dword [ebp + 8]
mov eax, dword [0x4dd68c]
call fcn.00450b94
mov dword [ebp - 8], eax
jmp 0x448b8c
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 8]
call fcn.0040f428
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.00406fc0
mov eax, dword [ebp - 4]
test eax, eax
je 0x448ace
mov edx, eax
sub edx, 0xa
cmp word [edx], 1
je 0x448ace
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.004065a0
test eax, eax
je 0x448ad7
sub eax, 4
mov eax, dword [eax]
mov edi, eax
mov esi, edi
xor esi, 0x9747b28c
mov dword [ebp - 0xc], 1
cmp edi, 4
jb 0x448b25
lea eax, [ebp - 4]
call fcn.004068bc
mov edx, dword [ebp - 0xc]
lea eax, [eax + edx - 1]
mov ebx, dword [eax]
imul ebx, ebx, 0x5bd1e995
mov eax, ebx
shr eax, 0x18
xor ebx, eax
imul ebx, ebx, 0x5bd1e995
imul esi, esi, 0x5bd1e995
xor esi, ebx
add dword [ebp - 0xc], 4
sub edi, 4
cmp edi, 4
jae 0x448aed
cmp edi, 3
jne 0x448b3a
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
movzx eax, byte [eax + edx + 1]
shl eax, 0x10
xor esi, eax
cmp edi, 2
jb 0x448b4e
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
movzx eax, byte [eax + edx]
shl eax, 8
xor esi, eax
cmp edi, 1
jb 0x448b66
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
movzx eax, byte [eax + edx - 1]
xor esi, eax
imul esi, esi, 0x5bd1e995
mov eax, esi
shr eax, 0xd
xor esi, eax
imul esi, esi, 0x5bd1e995
mov eax, esi
shr eax, 0xf
xor esi, eax
mov ecx, esi
mov edx, dword [ebp + 8]
mov eax, dword [0x4dd68c]
call fcn.00451094
mov dword [ebp - 8], esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x448bab
mov eax, dword [0x4dd68c]
call fcn.004056c0
ret

Function at 0x448bdc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor esi, esi
inc esi
inc esi
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov dword [ebp - 8], esi
fild dword [ebp - 8]
add esp, 0xfffffffc
fstp dword [esp]
wait
push 0x41000000
call fcn.0040b16c
add esp, 0xfffffff4
fstp xword [esp]
wait
call fcn.0040b134
mov edi, eax
dec esi
mov ecx, dword [ebp - 4]
sub ecx, esi
test ecx, ecx
jl 0x448c39
inc ecx
xor esi, esi
mov eax, esi
cdq
idiv edi
movzx eax, byte [edx + 0x4dd58c]
xor byte [ebx], al
inc ebx
inc esi
dec ecx
jne 0x448c26
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x448ebc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov edi, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406d7c
xor eax, eax
push ebp
push 0x448f84
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, 0x448fa0
call fcn.00448c44
mov eax, dword [ebp - 0xc]
call fcn.00406e20
push eax
mov eax, dword [ebp - 4]
call fcn.00406e20
push eax
push 0
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call sub.kernel32.dll_FindResourceW
mov esi, eax
push esi
push 0
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call sub.kernel32.dll_LoadResource
mov ebx, eax
push esi
push 0
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call sub.kernel32.dll_SizeofResource
mov esi, eax
push ebx
call sub.kernel32.dll_LockResource
mov dword [ebp - 8], eax
push esi
mov eax, edi
mov ecx, 1
mov edx, dword [0x447414]
call fcn.004084c4
add esp, 4
mov eax, dword [edi]
mov edx, eax
mov eax, dword [ebp - 8]
mov ecx, esi
call fcn.004043a0
push ebx
call sub.kernel32.dll_FreeResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x448f8b
lea eax, [ebp - 0xc]
call fcn.00406d84
lea eax, [ebp - 4]
call fcn.00406d84
ret

Function at 0x44943c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec4
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00408648
xor eax, eax
push ebp
push 0x449503
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x40
call fcn.00404870
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 4]
mov ecx, 0x40
call fcn.004043a0
cmp word [ebp - 0x44], 0x5a4d
jne 0x4494e7
lea eax, [ebp - 0x13c]
xor ecx, ecx
mov edx, 0xf8
call fcn.00404870
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
add eax, edx
lea edx, [ebp - 0x13c]
mov ecx, 0xf8
call fcn.004043a0
cmp dword [ebp - 0x13c], 0x4550
jne 0x4494e7
movzx eax, word [ebp - 0x126]
and ax, 0x2000
cmp ax, 0x2000
jne 0x4494d3
xor ebx, ebx
jmp 0x4494e7
movzx eax, word [ebp - 0xe0]
and ax, 3
cmp ax, 3
jne 0x4494e7
or ebx, 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44950a
lea eax, [ebp - 4]
mov edx, dword [0x447414]
call fcn.004085e4
ret

Function at 0x449f24
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
ret
Function at 0x4528a8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, 0x44a54c
call fcn.0040a4d4
xor eax, eax
push ebp
push 0x452919
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x45641c]
mov byte [eax], 1
push 0
call sub.ole32.dll_CoInitialize
xor eax, eax
mov dword [0x4dd57c], eax
xor eax, eax
mov dword [0x4dd580], eax
push 0x4dd574
push 0
push 0
push 0x449250
push 0
push 0
call sub.kernel32.dll_CreateThread
mov eax, dword [0x4dd574]
call fcn.00449f54
push 0
call sub.kernel32.dll_ExitProcess_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452920
ret

Function at 0x401000
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
xor ecx, ecx
jmp 0x401010
movzx eax, word [esi]
cmp ax, 0x20
ja 0x401022
test ax, ax
je 0x401052
test ecx, ecx
je 0x401036
cmp ax, 0x22
jne 0x401031
xor eax, eax
test ecx, ecx
sete al
mov ecx, eax
add esi, 2
jmp 0x401010
movzx eax, word [esi]
test ax, ax
je 0x401052
mov edi, edi
cmp ax, 0x20
ja 0x401052
movzx eax, word [esi + 2]
add esi, 2
test ax, ax
jne 0x401040
push str.SogouExplorer.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0x40203c
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
call eax
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x40d336
Capabilities:
Encode data using xor

Disassembly:
xor esp, dword [edi - 0x76394a59]
mov dl, 5
ret
movsd dword es:[edi], dword [esi]
mov dword [0x9c4968b8], eax
jnp 0x40d31d
movsd dword es:[edi], dword [esi]
or dh, byte [eax + eax*8 + 0x3ba63a8d]
xchg esi, eax
aam 3
fmul dword [eax + 0x5a]
out dx, al
outsd dx, dword [esi]
sahf
je 0x40d377
mov ebp, esi
invalid

Function at 0x43b016
Capabilities:
Encode data using xor

Disassembly:
mov al, 0x2d
in al, 0x14
pop ebp
mov ebp, 0x613c448d
and esp, dword [eax]
add byte [ebp - 0x47], bl
mov eax, dword [0x6d260bfc]
xchg edi, eax
dec ebp
sub eax, 0xf37d5431
adc ebx, dword [ecx + edx*8]
mov al, byte [0x1670cc1b]
adc ebx, eax
in al, dx
inc edx
ror byte [ebx - 0x1d], 1
in eax, dx
push ecx
popfd
mov bh, 0x92
jbe 0x43b03c
mov cl, 0xd8
dec eax
add dword [ecx - 0x12075fe8], esi
adc dword [ecx - 0x42ae12cf], edx
xor ebp, ebp
push ecx
lodsd eax, dword [esi]
in eax, dx
push ecx
mov ebp, 0xad51ed31
xor dword [eax - 0x57891250], ebp
adc dword [eax + edi - 0x18], edx
add ebp, ebx
sub eax, 0xfc419de1
call 0xfc854de1
push ss
push 0x31
cmpsb byte [esi], byte es:[edi]
cmp dl, byte [edx]
jnp 0x43afe7
xor dword [esi + 0x7b123af3], esp
fisubr word [edx - 0xd]
push 0xfffffffffffffff3
neg dword [esi + eax*4]
invalid
loopne 0x43b002
jecxz 0x43b030
xchg ecx, eax
loop 0x43b03d
jp 0x43affb
mov dl, 0x8c
pop ecx
jne 0x43afa8
inc eax
jns 0x43b04a
insb byte es:[edi], dx
invalid
jmp 0x43b009
out dx, eax
dec ebp
mov byte [0x2f812375], al
sti
xlatb
lodsd eax, dword [si]
mov dword [0x18fa89de], eax
pop edi
xchg byte [edx], ch
push esi
lahf
cli
sbb byte [edi - 0x7a], bl
sub dl, byte [esi - 0x61]
xchg edi, eax
xor dh, byte [esi - 0x300a6826]
pop edx
out 0xe7, eax
test dword [edx], 0x3e69ff4a
jmp 0x874ce005

Function at 0x43b546
Capabilities:
Encode data using xor

Disassembly:
sub ah, byte [esi - 0x2864b475]
adc al, 0x82
ljmp 0x7b1f
or eax, 0xb68cf394
in eax, dx
or eax, 0xcb1cf554
jns 0x43b5c4
add al, 0xd3
insb byte es:[edi], dx
jge 0x43b50a
cmp cl, byte [ebx + 0xd468d23]
mov bh, 0x38
aad 0xa7
mov ecx, 0x29021fce
test al, 0xa
mov dl, 0x22
fld dword [edx]
cmp dh, ah
fadd qword [ebp - 0x2c]
adc al, 8
rcr byte [ebp + eax + 0x66c320d4], 0xde
mov edx, edi
mov dl, 0x14
mov bl, 0xad
inc ebp
aam 0x14
or al, al
pushfd
add eax, 0x66c320d4
fimul word [ebx - 0x4ceb4d29]
lodsd eax, dword [esi]
xor byte [eax - 0x43fa4100], dl
inc ebp
push eax
rcr byte [edi], 0x8a
xchg ebx, eax
out 0xd4, eax
arpl word [eax - 0x6c], dx
stosd dword es:[edi], eax
movsb byte es:[edi], byte [esi]
pop eax
dec esi
xchg ecx, eax
clc
cmp dword [0x5049130b], 0xffffff8c
jns 0x43b570
pop eax
bound ebp, qword [edx - 0x887de6d]
and ah, byte [edx]
cmpsb byte [esi], byte es:[edi]
xchg esi, eax
push ebp
dec eax
ljmp 0x1fc7
or al, 0xd9
inc edx
cwde
xchg ecx, eax
jo 0x43b5cc
or eax, 0x18cb997
mov al, byte [0x7a5d4b2]
xchg edi, eax
mov ecx, 0xb2a0018c
aam 0xa5
pop es
dec ecx
mov eax, 0x1c6decfa
adc dword [eax + 2], esi
in al, 0xb5
push edi
sbb dword [eax - 0x36], ecx
mov esp, 0xb3612cbd
mov dl, 0x10
bound eax, qword [edi + 0xc]
out 0xd8, eax
invalid
Function at 0x48a28d
Capabilities:
Encode data using xor

Disassembly:
dec ebx
cli
or eax, 0x66170738
imul edx, edx, 0xffffffed
salc
cmpsb byte [esi], byte es:[edi]
or eax, 0x38a094f6
mov ecx, 0x9edb36e4
hlt
fild qword [ecx]
mov edi, 0x12bce9fe
popal
fist dword [esi - 0x4f]
inc ebp
xchg esi, eax
jns 0x48a1e0
jp 0x48a288
sahf
xor eax, 0xde38a771
xchg edx, eax
scasd eax, dword es:[edi]
cmp eax, 0xcd84d952
inc esi
movsd dword es:[edi], dword [esi]
lodsd eax, dword [esi]
push ds
add eax, 0xc517b17b
je 0x48a23b
sbb eax, 0xf102457
and ebx, esi
in al, 0x8d
arpl word [edi], cx
fsub qword [ebp + 0xa6d356a]
pop es
daa
mov eax, 0x4441d792
in eax, 1
daa
mov esp, eax
cld
or dword [edi + 0x30], edi
and byte [edx - 0x1c70ac5b], cl
test ch, ch
jmp 0x945a8cc7
cli
add eax, dword [ebx]
cmp dword [ebp + 0xa7e773d], 0xffffffb1
cmp eax, 0xb10a7e77
cmp eax, 0xb10a7e77
mov esi, 0x390363d5
leave
fidiv dword [eax + 0x75bc9851]
aaa
cmp esp, dword [eax]
test eax, 0xaf0fa9ce
push esi
jle 0x48a22a
imul ebx, ebx, 0x5b
xchg ecx, eax
cmc
bound edi, qword [edi - 0x3ab62e05]
cld
inc ebx
add al, 0x89
in eax, dx
pop dword [eax]
stosd dword es:[edi], eax
sbb dword [ebp - 0x7322785d], 0x34001555
pop edi
fisttp qword [ebp + edx*2 + 0x5f340015]
or eax, 0x624fc90c
jl 0x48a2c0
dec ebp
dec ebp
retf 0x2976
Function at 0x5678ce
Capabilities:
Encode data using xor

Disassembly:
sar dword [edi - 0x22], cl
fdiv dword [edi - 0x48c9bafa]
cmpsb byte [esi], byte es:[edi]
mov bh, 0xa6
mov dh, 0x14
sub byte [ecx + 0x2a], dl
mov edx, 0x5287cf93
salc
lodsb al, byte [esi]
xor al, 0x50
jecxz 0x5678d6
xchg esi, eax
aaa
pop esi
or edx, ebp
wait
ljmp 0xbc34

Function at 0x627cf1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6303c8
cmp edx, dword [eax]
je 0x627d13
add eax, 8
inc ecx
cmp eax, 0x630458
jl 0x627d04
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6303c8]
jne 0x627e41
mov eax, dword [0x638d68]
cmp eax, 1
je 0x627e1b
test eax, eax
jne 0x627d44
cmp dword [0x6302f0], 1
je 0x627e1b
cmp edx, 0xfc
je 0x627e41
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x627d7b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.006286d0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00628b60
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x627dbe
lea eax, [ebp - 0x1a4]
push eax
call fcn.00628b60
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62ca54
push edi
call fcn.0062aa30
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.006286d0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.006286e0
lea eax, [ebp - 0xa0]
push 0x62ca34
push eax
call fcn.006286e0
push dword [esi + 0x6303cc]
lea eax, [ebp - 0xa0]
push eax
call fcn.006286e0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062a9a4
add esp, 0x2c
pop edi
jmp 0x627e41
lea eax, [ebp + 8]
lea esi, [esi + 0x6303cc]
push 0
push eax
push dword [esi]
call fcn.00628b60
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
popal
nop
nop
nop
jmp fcn.00401219