joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7fc6e2
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub bl, cl
stc
jmp 0x7fc74c
mov dx, bp
mov edx, 0x7a33e682
lea eax, [edx + ebp]
jmp 0x7fc77c
ja 0x7fc727
mov dx, bp
mov edx, 0x7a33e682
jmp 0x7fc792
mov dl, bl
mov eax, ecx
inc ah
jne 0x7fc797
je 0x7fc7a0
add edx, 0xcf7962aa
jmp 0x7fcc45
lea eax, [edx + ebp]
jmp 0x7fc77c
sub esp, 0x11
jmp 0x7fcf1b
sub esp, 0x11
pop word [esp + 0xa]
add esp, 8
lea esp, [esp + 3]
jmp 0x7fcd0a
mov ax, word [esp]
mov ax, word [esp]
neg dl
call fcn.007fc865
mov eax, ebp
jmp 0x7fc983
dec edi
pushfd
mov ax, word [esp + 2]
mov dx, ax
sub esp, 7
jmp 0x7fc9ad
adc edx, 0x9f4351d3
jmp 0x7fc926
out 0x15, al
rol byte [esi], cl
xchg esp, eax
or ch, byte [ebp - 0x64]
pop edx
nop
add dword [ecx + reloc.oleaut32.dll_SysFreeString], edx
lea edx, [ebx + 2]
jmp 0x7fc93c
setb ah
push word [esp]
xchg word [esp + 2], dx
add esp, 1
lea esp, [esp + 8]
neg bl
jmp 0x7fcbc5
sub cl, dl
and eax, 0x876331d
jp 0x7fc957
lea edx, [ebx + 2]
adc edx, 0x9f4351d3
jmp 0x7fc926
ja 0x7fc95c
setb ah
push word [esp]
call 0x7fc9bc
jge 0x7fc947
xor al, 0x24
stc
rdtsc
mov edx, dword [esp]
xchg dword [esp], esi
jmp 0x7fca07
mov dh, al
rdtsc
lea esi, [esi - 0x24]
call fcn.007fc9f1
push dword [esp]
ret 4
rol bl, 0
jmp 0x7fca73
neg dh
jne 0x7fcab9
lea edx, [esp - 0xc1]
mov ax, 0x4a68
mov edx, ecx
pushfd
pop ax
jmp 0x7fcae5
mov eax, ebx
lea eax, [ecx - 0x96]
btc dx, ax
je 0x7fca6a
jne 0x7fca6a
mov edx, ecx
pushfd
pop ax
jmp 0x7fcae5
lea edx, [esp - 0xc1]
mov ax, 0x4a68
jmp 0x7fcaa3
clc
add bl, 0x8a
bswap eax
lea eax, reloc.oleaut32.dll_SysFreeString
lea edx, [eax + edi]
jmp 0x7fca93
lea esp, [esp + 2]
sub bl, 0x71
mov dh, byte [esp]
xchg edx, eax
mov edx, 0x3a045a6a
jmp 0x7fcb43
xchg al, ah
rdtsc
mov edx, dword [esp]
jmp 0x7fcad4
xor bl, 0x14
call 0x7fcb16
les eax, [ecx - 0x2f]
mov al, 0x43
xacquire xchg byte [edx], al
nop
test dword [edx], reloc.oleaut32.dll_SysFreeString
not eax
lea edx, reloc.oleaut32.dll_SysFreeString
bsr dx, si
je 0x7fcb2c
jne 0x7fcb2c
lea esp, [esp + 1]
bts ax, ax
jmp 0x7fcb9a
xchg word [esp], ax
lea esp, [esp + 3]
jmp 0x7fcb84
lea edx, [edx + edi]
shr ah, cl
jmp 0x7fcb0d
mov edx, ebx
call fcn.007fcba6
sbb dword [edx + 0x56926700], edx
cdq
pop ss
xchg edx, esp
adc dword [eax + reloc.oleaut32.dll_SysFreeString], esp
lds esp, [esi - 0x79]
add al, 0x24
jo 0x7fcb61
xchg word [esp], ax
lea esp, [esp + 3]
jmp 0x7fcb84
bt eax, edx
jnp 0x7fcb7d
lea edx, [edx + edi]
shr ah, cl
xchg al, ah
rdtsc
mov edx, dword [esp]
jmp 0x7fcad4
bswap eax
mov eax, dword [esp]
jmp 0x7fccc5
cmc
jae 0x7fcc2f
jb 0x7fcc52
fisttp dword [ecx - 0x27]
mov eax, 0x8b68f74b
bswap eax
mov eax, dword [esp]
jmp 0x7fccc5
mov esp, ebp
lea eax, [eax + edx]
not ah
push edx
ret
lea esp, [esp + 4]
xor dl, 0x13
mov ax, 0x6140
lea eax, [esi + 0x71]
mov ax, word [esp]
jmp 0x7fc8da
pop word [esp + 0xa]
add esp, 8
lea esp, [esp + 3]
jmp 0x7fcd0a
Function at 0x7fc865
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, reloc.oleaut32.dll_SysFreeString
jmp 0x7fc7fe
bsf ax, bp
mov eax, dword [esp + 1]
mov eax, dword [esp]
jmp 0x7fc7c1
lea esp, [esp + 4]
neg dl
jmp 0x7fc80a
sub esp, 0x11
jb 0x7fc87f
rcr ax, 0xb
push dword [esp]
mov ah, cl
pop eax
mov al, byte [esp + 8]
jmp 0x7fc8aa
jmp 0x7fc7db
or al, 0x1d
jg 0x7fc829
bsf ax, bp
mov eax, dword [esp + 1]
mov eax, dword [esp]
lea eax, reloc.oleaut32.dll_SysFreeString
call fcn.007fc7e8
rcr ax, 0xb
push dword [esp]
jmp 0x7fc8c0
bswap eax
pop eax
lea esp, [esp + 1]
jmp 0x7fca55
mov ah, cl
pop eax
mov al, byte [esp + 8]
jmp 0x7fc8aa
lea esp, [esp + 1]
jmp 0x7fc9e2
push cx
mov word [esp], cx
add esp, 1
jmp 0x7fc8ff
push cx
mov word [esp], cx
add esp, 1
lea esp, [esp + 1]
inc dl
xchg ah, al
mov ax, bp
mov ax, si
jmp 0x7fc8e9
lea esp, [esp + 0xc]
xor dl, 0xf8
dec al
jae 0x7fc9d5
jb 0x7fc91b

Function at 0x7fdd79
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf07e8088
jmp 0x7fd9c4
lea esp, [esp + 8]
pushfd
jmp 0x7fc7b4
mov esi, dword [esp]
ror cx, cl
jmp 0x7fda1d
sub esp, 0xe
mov byte [esp + 9], bl
lea esp, [esp + 2]
jmp 0x7fda3e
mov dword [esp + 0xc], esi
push cx
mov byte [esp], bl
lea esp, [esp + 2]
mov dword [esp + 8], edi
jmp 0x7fd9ba
lea esp, [esp + 2]
jmp 0x7fda3e
lea ebp, [esp + 0xc]
not edi
push ax
inc dx
jo 0x7fda28
jno 0x7fda4b
retf 0xc24c
jp 0x7fd9d0
sub esp, 0xe
mov byte [esp + 9], bl
jmp 0x7fd9f9
lea eax, reloc.oleaut32.dll_SysFreeString
lea esp, [esp + 2]
jmp 0x7fda5b
mov esi, dword [esp + 0x38]
mov ebp, dword [esp]
cpuid
cpuid
jmp 0x7fd9ff
lea eax, reloc.oleaut32.dll_SysFreeString
lea esp, [esp + 2]
jmp 0x7fda5b
sub esp, 0xb4
jmp 0x7fdb52
mov word [esp + 5], cx
mov word [esp + 1], dx
lea esp, [esp + 2]
jmp 0x7fd9e6
bsr ecx, esp
jmp fcn.007fdb01
bsr ecx, esp
mov edi, esp
lea ecx, [esi*4]
neg edx
jo 0x7fdafe
jno 0x7fda9a
push dword [esp + 5]
jmp 0x7fda71
push word [esp + 2]
jl 0x7fdc03
push dword [esp + 5]
mov word [esp + 5], cx
mov word [esp + 1], dx
lea esp, [esp + 2]
mov dword [esp + 0xc], esi
jmp 0x7fd9ea
Function at 0x7fe68b
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [edx*4]
mov dx, 0x7540
jmp 0x7fe6e6
mov edx, 0xe0807de3
pushfd
pop edx
xchg dword [esp], ebx
mov dx, word [esp]
lea edx, reloc.oleaut32.dll_SysFreeString
jmp 0x7fe6d0

Function at 0x8001dc
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x24], eax
jmp 0x80006d
jmp 0x8000c5
call 0x7fe8b3
jmp 0x800186
popal
pushal
push si
lea esp, [esp + 2]
lea esp, [esp + 0x20]
jmp 0x80016e
pop ecx
jmp 0x80023b
cmp ebx, 0x69a1fbbb
je 0x8001a7
jne 0x7fe7e9
push 0
jmp 0x8001bc
pushal
jmp 0x7fe8ae
popfd
ret
call 0x800180
dec ebp
push ebx
push esi
inc ebx
push edx
push esp
insb byte es:[edi], dx
insb byte es:[edi], dx
add bl, ch
and ch, byte [ebx]
inc edx
std
int3
pop eax
sub eax, 0x2bcf63c3
jmp 0x800170
movsd dword es:[edi], dword [esi]
int 0x2b
jmp 0x8001c6
pushfd
cmp dword [esp + 4], 0
jne 0x8001ed
jmp 0x800158
call 0x8001dc
pop edi
js 0x800232
jo 0x800246
pop edi
push 0x6c646e61
jb 0x80020e
add bl, ch
mov al, 0x61
jmp [edi + 0xa]
inc dword [esp + 8]
jmp 0x800255
retf
dec edi
fistp qword [edx - 0x629d6db7]
in al, dx
inc dword [ecx + reloc.oleaut32.dll_SysFreeString]
adc byte [ecx + 0x1800481], cl
sub ecx, 0x10016802
mov dword [ecx + reloc.oleaut32.dll_SysFreeString], eax
movzx ebx, byte [eax]
adc byte [edi], cl
mov dh, 0x18
add ebx, 0x69a1faef
jmp 0x800143
popfd
ret 4

Function at 0x800446
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.007fea68
jmp 0x80046f
push eax
call fcn.007ebd58
jmp 0x7fea63

Function at 0x8f2e2d
Capabilities:
Execute anti-debugging instructions

Disassembly:
and bl, dh
bts ecx, edi
not edi
mov di, dx
cmc
jmp 0x8f2e3e
push word [esp + 0x13]
bsr di, di
pop word [esp + 1]
mov ch, byte [esp]
jmp 0x8f2e7a
sub esp, 0x1c
pop dword [esp + 0x28]
popal
mov byte [esp + 8], bl
pop dword [esp + 4]
jmp 0x8f2ebb
lea eax, [ecx + edx]
cmp cx, cx
rdtsc
lea esp, [esp + 9]
mov dx, bx
mov byte [esp + 0xa], al
jmp 0x8f2e64
pop bx
mov byte [esp], bl
mov dx, word [esp + 4]
rdtsc
xchg si, bp
rdtsc
jmp 0x8f2ea5
Function at 0x8f3006
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
bts si, ax
xchg dword [esp], ebx
xchg byte [esp], dh
lea edx, [ebp + ebp]
jmp 0x8f302d
jmp 0x8f2ff0
lea edx, [ecx + edi]
btr di, bp
pop eax
lea esi, [ecx*4]
pop dx
lea edx, [ebx*4]
jmp 0x8f3093
mov dl, bh
mov byte [esp], bh
sub esp, 2
lea edi, [eax + ecx]
mov ah, 0x1f
mov ebp, 0x9b511c89
jmp 0x8f3008
std
bswap esi
bt ebx, edi
mov eax, edx
mov edx, dword [esp]
mov ebx, dword [esp]
jmp 0x8f3069
xor ebp, edi
lea ebp, [esp + ebp]
bsf ebx, eax
not ebx
setno bh
setle cl
jmp 0x8f3041
btr bx, bp
lea ebp, reloc.oleaut32.dll_SysFreeString
setb ch
push ebx
mov al, 8
pop word [esp]
jmp 0x8f30d6
lea eax, [ebp*4]
mov edx, edi
lea esp, [esp]
mov bp, 0xc66
mov eax, 0xfc65f0ca
neg esi
jmp 0x8f3057
mov edi, dword [esp + 0x13]
rcr di, 5
mov word [esp + 0x13], cx
lea esp, [esp + 0x12]
rcr edx, 2
cpuid
jmp 0x8f310b
lea esp, [esp + 2]
rdtsc
pushal
inc eax
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x19]
jmp 0x8f30ac
push dword [esp + 2]
mov bl, 0xf5
setl ch
mov esi, edx
add esp, 0xb
setp bh
jmp 0x8f3139
push cx
mov edx, 0x596954ed
mov esi, 0x450c8846
mov byte [esp + 0xa], al
lea eax, [ebx + edi]
setne ch
jmp 0x8f30e8
lea ebx, [ebx*4]
cmc
xchg word [esp], dx
mov eax, dword [esp]
jmp 0x8f3162
lea esp, [esp + 1]
pop word [esp + 1]
mov di, ax
pop ebx
not ax
clc
jmp 0x8f3123
mov dl, 0xaa
sub edi, ebx
lea edx, reloc.oleaut32.dll_SysFreeString
mov byte [esp], dl
xchg ecx, esi
jmp 0x8f3174
mov bp, 0xbf0b
setb cl
pop bx
mov edi, ebx
setge al
xchg edi, ebx
jmp 0x8f314c
lea eax, reloc.oleaut32.dll_SysFreeString
lea ebp, [ecx*4]
inc bx
xchg byte [esp], al
sub esp, 7
mov edi, ebx
jmp 0x8f330e
mov bl, 0x6a
inc ax
push dword [esp + 0xa]
rcr bl, 6
pop dword [esp + 0x12]
bsr ebp, edx
jmp 0x8f31b2
add esp, 0
mov word [esp], di
lea ecx, reloc.oleaut32.dll_SysFreeString
sub esp, 0x16
mov dword [esp + 9], esi
std
jmp 0x8f31c8
mov bx, word [esp + 4]
inc bl
pop edi
mov esi, dword [esp]
xchg edi, ecx
neg bl
jmp 0x8f3218
neg cl
xchg dl, dh
mov bx, word [esp + 4]
mov al, byte [esp + 5]
pop dx
cpuid
jmp 0x8f326a
Function at 0x8f3486
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg esi, ebx
bsf ebx, ebp
pop dword [esp]
push dword [esp + 1]
mov ax, si
jmp 0x8f3470
mov dh, 0x5c
btc edx, ebp
add esp, 1
lea ebx, [esi + ebp]
push dword [esp + 3]
mov dword [esp + 2], edi
jmp 0x8f3445
mov byte [esp + 2], ch
xchg dh, bl
pop word [esp + 1]
jmp 0x8f35e0
mov ecx, dword [esp + 2]
cpuid
jmp 0x8f345b
pop cx
pushfd
pop bx
sub esp, 3
sub esp, 0x11
xchg ebp, edx
jmp 0x8f34c5
bt eax, esp
add esp, 1
lea esi, [edx + esi]
setae ah
bswap ecx
lea ecx, [ebx + ebp]
jmp 0x8f348e
pop ebp
mov dh, al
pushfd
mov ah, byte [esp + 2]
cpuid
lea ecx, [eax*4]
jmp 0x8f351b
push dword [esp + 0x15]
lea esp, [esp + 0x1a]
lea ebp, [ebx*4]
jmp 0x8f3505
xchg bp, bx
push dword [esp]
mov bh, 0xc9
bts edi, ecx
bswap edx
mov ebx, 0x77d93cc1
jmp 0x8f34b2
mov cx, 0x429f
mov dh, byte [esp + 2]
mov dx, 0xb991
mov dword [esp], ebp
jmp 0x8f356f
pop dword [esp + 0xc]
mov edx, dword [esp + 0x14]
setge bl
mov ecx, dword [esp + 7]
pushfd
bsr bp, cx
jmp 0x8f34d8
mov bl, byte [esp + 5]
mov dword [esp + 2], edi
lea esi, [ebp*4]
not edx
rdtsc
xchg dx, cx
jmp 0x8f34f1
pop dword [esp]
sub edi, esp
lea esi, [ecx*4]
mov dx, di
jmp 0x8f35a5
mov si, 0x5b83
lea eax, [ecx + esi]
dec cx
mov cl, dl
xchg bp, bx
cpuid
jmp 0x8f3559
xchg dword [esp + 5], edi
pushal
shl si, 0xb
bswap ebp
xchg bx, ax
pop ax
jmp 0x8f35b8
xchg bx, cx
mov byte [esp + 5], bl
push esi
add esp, 0
bt edx, ebx
push dword [esp]
jmp 0x8f3581
xchg di, dx
rdtsc
setbe ah
xchg word [esp + 0x16], bx
mov word [esp + 0x1a], si
not ecx
jmp 0x8f3625
lea ecx, [ebx*4]
push dword [esp]
mov byte [esp + 5], bl
rol bp, cl
rdtsc
mov byte [esp + 3], dl
jmp 0x8f3541
xchg cl, dh
bt cx, bx
lea ebp, [ebp + ebp]
lea ebx, [ecx + esi]
xchg byte [esp + 1], al
rol dl, 0
jmp 0x8f3663
lea edi, [eax*4]
xchg byte [esp + 0x1c], ch
bsr ebx, ebp
mov edx, 0x10a00944
bsr bp, di
xchg byte [esp + 4], bl
jmp 0x8f35fc
pushal
mov ch, cl
add esp, 6
clc
xchg word [esp + 9], dx
xchg word [esp + 0xc], di
jmp 0x8f3679
lea ecx, [edx*4]
cpuid
mov ch, byte [esp + 8]
lea esp, [esp + 0x2a]
cpuid
std
jmp 0x8f3642
cpuid
xchg word [esp + 0x17], cx
call fcn.008f36a4
inc edi
je 0x8f36dd
imul esp, dword [ebx + 0x6b], reloc.oleaut32.dll_SysFreeString
je 0x8f3692
int 0x5c
scasd eax, dword es:[edi]
mov dh, 0x8b
sbb al, 0x24
adc eax, 0x8dfffffd
cmp al, 0x11
not ax
bswap ecx
xchg word [esp + 0x1d], bp
mov dh, byte [esp + 0x20]
mov ch, bh
jmp 0x8f3806
lea esp, [esp + 0xb]
xchg word [esp], di
pop ebp
call fcn.008f3737
mov dx, word [esp + 0xa]
stc
xchg word [esp + 0x1a], bp
rcr edx, cl
stc
popal
call fcn.008f37b1
xor al, 0x27
rdtsc
sub esp, 0x13
xchg esi, edx
mov dword [esp + 0xd], edi
xchg byte [esp + 0x1c], ah
cpuid
jmp 0x8f376d
inc ah
xchg edx, ebp
cmc
bsf ebx, edx
mov ebx, 0x22f76c0d
lea eax, [ebp - 0xe5]
jmp 0x8f375f
xchg byte [esp + 0x16], bh
btr eax, ebx
bsf edx, ecx
pop dword [esp + 0xc]
rcr esi, cl
pop dword [esp + 4]
jmp 0x8f37d4

Function at 0x8f8c7f
Capabilities:
Parse pe header

Disassembly:
push dword [esp + 5]
jmp 0x8f8c89
mov dword [esp + 0x68], esi
call 0x8f8cdf
Function at 0x8f8c92
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call fcn.008f7a1a
lea esp, [esp + 3]
lea esp, [esp + 3]
mov dword [esp + 0x64], edi
jmp 0x8f8cb7
lea esp, [esp + 0x64]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x8f8d01
mov eax, dword [eax + 8]
push eax
jmp 0x8f7a15
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x8f8cc6
Function at 0x405871
Capabilities:
Parse pe header

Disassembly:
push 8
push 0x42a660
call fcn.00412bf0
mov esi, ecx
and dword [ebp - 4], 0
lea edi, [esi + 0x28]
push dword [ebp + 0xc]
push 0x40
push 0
push edi
call dword [ebp + 8]
add esp, 0x10
test al, al
je 0x405961
or dword [ebp - 4], 0xffffffff
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x405950
cmp dword [esi + 0x64], 0
je 0x405950
mov dword [ebp - 4], 1
lea edi, [esi + 0x68]
push dword [ebp + 0xc]
push pe_nt_image_headers32
push dword [esi + 0x64]
push edi
call dword [ebp + 8]
add esp, 0x10
test al, al
je 0x405961
or dword [ebp - 4], 0xffffffff
cmp dword [edi], 0x4550
jne 0x405950
mov eax, 0x10b
cmp word [esi + 0x80], ax
jne 0x405950
movzx eax, word [esi + 0x6e]
test ax, ax
je 0x405950
mov edi, eax
imul edi, edi, 0x28
movzx ecx, word [esi + 0x7c]
mov ebx, dword [esi + 0x64]
add ecx, 0x18
add ebx, ecx
push edi
call fcn.00414fbd
pop ecx
mov dword [esi + 0x160], eax
test eax, eax
jne 0x405925
push 8
jmp 0x405967
mov dword [ebp - 4], 2
push dword [ebp + 0xc]
push edi
push ebx
push eax
call dword [ebp + 8]
add esp, 0x10
test al, al
je 0x405961
or dword [ebp - 4], 0xffffffff
lea eax, [ebx + edi]
mov dword [esi + 0x10], eax
xor eax, eax
jmp 0x405968
push 0xb
jmp 0x405967
or dword [ebp - 4], 0xffffffff
push 0x1e
pop eax
call fcn.00412c2b
ret 8
Function at 0x406030
Capabilities:
Get common file path

Disassembly:
sub esp, 0x434
call fcn.004062de
cmp eax, 3
jae 0x406059
push 0
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x406059
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebp
mov ebp, dword [esp + 0x44c]
push esi
mov esi, dword [esp + 0x44c]
or eax, 0xffffffff
mov edx, ebp
lea ebx, [esi + 0x10]
and edx, 1
push edi
mov edi, ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
je 0x4060ca
mov eax, dword [esp + 0x458]
mov eax, dword [eax + 0xc]
test eax, 0xffff0000
je 0x4060ca
push 0x42fc50
push 1
mov ecx, 0x42faf0
call fcn.00404c3d
lea ecx, [esp + 0x10]
push ecx
movzx ecx, word [esi + 0xe]
push 4
shl ecx, 3
push ecx
push edi
call dword [eax]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
test eax, eax
push 0xffffffffffffffff
pop eax
cmove ecx, eax
mov dword [esp + 0x10], ecx
and dword [esp + 0x1c], 0
xor eax, eax
cmp ax, word [esi + 0xe]
jae 0x406174
mov ebx, dword [esp + 0x458]
mov eax, ebp
and eax, 0x80
mov dword [esp + 0x20], eax
mov eax, ebp
and eax, 2
mov dword [esp + 0x2c], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 0xc]
and eax, 0xffff
shr ecx, 0x10
cmp dword [esp + 0x20], 0
mov dword [esp + 0x18], eax
je 0x406119
mov eax, ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x18], eax
cmp dword [esp + 0x2c], 0
jne 0x40612c
test edx, edx
je 0x406222
cmp dword [edi], ecx
jne 0x40615d
push ebx
mov eax, ebp
or eax, 2
push eax
push edi
push dword [esp + 0x458]
push dword [esp + 0x458]
call fcn.00405ed9
or eax, 0xffffffff
add esp, 0x14
cmp dword [esp + 0x10], eax
je 0x406159
mov eax, dword [esp + 0x18]
mov dword [edi], eax
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
movzx eax, word [esi + 0xe]
add edi, 8
inc ecx
mov dword [esp + 0x1c], ecx
cmp ecx, eax
jb 0x4060f6
lea ebx, [esi + 0x10]
or eax, 0xffffffff
cmp dword [esp + 0x10], eax
je 0x406217
call fcn.004062de
cmp eax, 3
jae 0x4061a1
push str.332332
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x4061a1
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
movzx eax, word [esi + 0xe]
mov byte [esp + 0x24], 0
push dword [esp + 0x24]
lea eax, [ebx + eax*8]
push eax
push ebx
call fcn.00404cd3
add esp, 0xc
call fcn.004062de
cmp eax, 3
jae 0x4061d5
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call fcn.004062de
cmp eax, 3
jae 0x4061f2
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push 0x42fc50
push 1
mov ecx, 0x42faf0
call fcn.00404c3d
lea ecx, [esp + 0x10]
push ecx
movzx ecx, word [esi + 0xe]
push dword [esp + 0x14]
shl ecx, 3
push ecx
push ebx
call dword [eax]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x434
ret
push ebx
push ebp
push edi
push dword [esp + 0x458]
push dword [esp + 0x458]
call fcn.00405ed9
add esp, 0x14
jmp 0x406159
Function at 0x4063a7
Capabilities:
Get common file path

Disassembly:
sub esp, 0x414
push ebx
push esi
mov esi, dword [esp + 0x424]
push edi
mov edi, dword [esp + 0x43c]
shr esi, 2
mov ebx, 0x42e8e0
test edi, edi
jne 0x4063d5
push edi
push edi
call fcn.004066a7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40649e
mov ecx, dword [esp + 0x424]
push ebp
mov ebp, ecx
sub ebp, edi
cmp edi, 0xffffffff
je 0x406406
jmp 0x4063f7
cmp eax, ebp
jae 0x4063fe
add ebx, 4
mov eax, dword [ebx]
cmp eax, 0xffffffff
jne 0x4063f0
cmp dword [ebx], ebp
je 0x406489
mov eax, dword [esp + 0x438]
xor dword [esp + 0x430], eax
call fcn.004062de
cmp eax, 3
jae 0x40643b
push str.777777
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x406434
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [esp + 0x428]
call fcn.004062de
cmp eax, 3
jae 0x40645c
lea eax, [esp + 0x10]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ecx, dword [esp + 0x428]
mov edx, dword [esp + 0x430]
mov eax, edx
imul eax, dword [esp + 0x434]
add edx, eax
mov dword [esp + 0x434], eax
mov eax, edx
imul eax, dword [esp + 0x43c]
add dword [ecx], eax
mov dword [esp + 0x430], edx
add ecx, 4
add ebp, 4
mov dword [esp + 0x428], ecx
dec esi
jne 0x4063e9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x414
ret
Function at 0x4064a8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x420096
call fcn.00412bcc
sub esp, 0x40
push esi
mov esi, dword [esp + 0x58]
test esi, esi
jne 0x4064c5
xor eax, eax
jmp 0x4065a0
push edi
mov edi, dword [esi + 0x3c]
add edi, esi
cmp dword [edi + 0x7c], 0
jne 0x4064d8
xor eax, eax
jmp 0x40659f
push ebx
mov ebx, dword [esp + 0x64]
push ebp
mov ebp, dword [edi + 0x78]
add ebp, esi
mov dword [esp + 0x14], ebp
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x20]
add eax, esi
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x24]
add eax, esi
add ecx, esi
cmp byte [ebx], 0xff
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], ecx
je 0x40655b
push 7
push ebx
push str._:hash:
call fcn.00414e38
add esp, 0xc
test eax, eax
je 0x406548
push 7
push ebx
push str._:text:
call fcn.00414e38
add esp, 0xc
test eax, eax
je 0x406548
push 0
push ebx
call fcn.00412340
pop ecx
push eax
push ebx
call fcn.0040787c
mov ecx, dword [esp + 0x1c]
add esp, 0xc
jmp 0x40655e
push 0
push ebx
call fcn.00412340
pop ecx
sub eax, 7
push eax
lea eax, [ebx + 7]
push eax
jmp 0x40653a
mov eax, dword [ebx + 1]
xor ebx, ebx
mov dword [esp + 0x64], eax
cmp dword [ebp + 0x18], ebx
jbe 0x40659b
mov eax, ebp
mov ebp, dword [ecx + ebx*4]
test ebp, ebp
je 0x406595
add ebp, esi
push 0
push ebp
call fcn.00412340
pop ecx
push eax
push ebp
call fcn.0040787c
add esp, 0xc
cmp dword [esp + 0x64], eax
je 0x4065ae
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
inc ebx
cmp ebx, dword [eax + 0x18]
jb 0x40656b
xor eax, eax
pop ebp
pop ebx
pop edi
mov ecx, dword [esp + 0x44]
pop esi
mov dword fs:[0], ecx
leave
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
movzx eax, word [eax + ebx*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, dword [edi + 0x78]
jb 0x40669f
mov eax, dword [edi + 0x7c]
add eax, dword [edi + 0x78]
cmp ecx, eax
jae 0x40669f
lea eax, [ecx + esi]
push eax
lea ecx, [esp + 0x24]
call fcn.004013ed
xor ebx, ebx
mov dword [esp + 0x58], ebx
push 1
push ebx
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x70], 0x2e
call fcn.0040525b
mov esi, eax
or ebp, 0xffffffff
cmp esi, ebp
je 0x40668d
push esi
push ebx
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x2c]
call fcn.004062fc
mov byte [esp + 0x58], 1
cmp dword [eax + 0x14], 0x10
jb 0x406627
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
mov byte [esp + 0x58], bl
lea ecx, [esp + 0x38]
call fcn.004015ab
test edi, edi
je 0x40668d
push ebp
lea ecx, [esi + 1]
push ecx
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x2c]
call fcn.004062fc
mov byte [esp + 0x58], 2
cmp dword [eax + 0x14], 0x10
jb 0x406661
mov eax, dword [eax]
push eax
push edi
call fcn.004064a8
pop ecx
pop ecx
mov esi, eax
mov byte [esp + 0x58], bl
lea ecx, [esp + 0x38]
call fcn.004015ab
mov dword [esp + 0x58], ebp
lea ecx, [esp + 0x20]
call fcn.004015ab
mov eax, esi
jmp 0x40659d
mov dword [esp + 0x58], ebp
lea ecx, [esp + 0x20]
call fcn.004015ab
jmp 0x40659b
lea eax, [ecx + esi]
jmp 0x40659d
Function at 0x40787c
Capabilities:
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
not ecx
jmp 0x4078b6
movzx eax, byte [edi]
movzx edx, cl
xor edx, eax
push 8
dec esi
inc edi
pop eax
test dl, 1
je 0x4078aa
shr edx, 1
xor edx, 0xedb88320
jmp 0x4078ac
shr edx, 1
dec eax
test eax, eax
jg 0x40789b
shr ecx, 8
xor ecx, edx
test esi, esi
jne 0x40788e
not ecx
pop edi
mov eax, ecx
pop esi
ret

Function at 0x4078c1
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x430770]
or eax, dword [0x430774]
push esi
push edi
jne 0x40793c
push ebx
push ebp
xor ebx, ebx
mov eax, ebx
cdq
push 8
mov edi, eax
mov esi, edx
pop ebp
call fcn.0040741d
cmp eax, 3
jae 0x407904
push str.Local1022
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x407904
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, edi
shrd edi, esi, 1
and eax, 1
shr esi, 1
or eax, 0
je 0x407920
xor edi, 0xd7870f42
xor esi, 0xc96c5795
dec ebp
jne 0x4078de
mov dword [ebx*8 + 0x42ff78], edi
mov dword [ebx*8 + 0x42ff7c], esi
inc ebx
cmp ebx, 0x100
jl 0x4078d4
pop ebp
pop ebx
mov edi, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
not ecx
not edx
test edi, edi
je 0x40797b
mov esi, dword [esp + 0x10]
test esi, esi
je 0x40797b
movzx eax, byte [edi]
xor eax, ecx
shrd ecx, edx, 8
and eax, 0xff
shr edx, 8
xor ecx, dword [eax*8 + 0x42ff78]
xor edx, dword [eax*8 + 0x42ff7c]
inc edi
dec esi
jne 0x407958
not ecx
pop edi
not edx
mov eax, ecx
pop esi
ret
Function at 0x40978c
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
call fcn.00409cba
cmp eax, 3
jae 0x4097b7
push str.Local1709
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x4097b7
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
shr ecx, 2
push esi
shr edx, 2
push edi
lea esi, [eax + ecx*4]
mov eax, dword [ebp + 0x14]
mov edi, 0xc0c0c0c0
test ecx, ecx
je 0x4097e1
add eax, 0xb16b00b0
xor eax, edi
dec ecx
jne 0x4097d7
test edx, edx
je 0x4097f4
xor dword [esi], eax
add eax, 0xb16b00b0
xor eax, edi
lea esi, [esi + 4]
dec edx
jne 0x4097e5
pop edi
pop esi
pop ebp
ret