joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409b78
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409c2c
jmp 0x409c21
cmp dword [esi + 0x10], 0x1000
jne 0x409c0d
test byte [esi + 0x15], 1
jne 0x409c0d
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409bcc
cmp eax, 2
je 0x409bcc
cmp eax, 0x10
je 0x409bcc
cmp eax, 0x20
jne 0x409be1
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409be1
mov bl, 1
xor ebp, ebp
jmp 0x409bf2
mov eax, dword [esi]
add eax, ebp
call fcn.00409b70
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409be5
test bl, bl
je 0x409c0d
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409c2c
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409ba4
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..reloc
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x105a1ee6
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x32130d61
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x4018b0
Capabilities:
Accept command line arguments
Create directory
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xd8
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [esp + 0xc4], 0x292a
mov dword [esp + 0xc0], 0x657
mov dword [esp + 0xb8], eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0xbc], edx
mov eax, dword [esp + 0xc8]
mov ecx, dword [esp + 0xcc]
xor eax, 0x5c63
mov dword [esp + 0xcc], ecx
mov dword [esp + 0xc8], eax
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], edi
mov eax, dword [esp + 0x2c]
add eax, 4
mov dword [0x409920], eax
mov eax, dword [esp + 0x30]
mov dword [0x40991c], eax
mov eax, dword [esp + 0xbc]
mov dword [0x409910], eax
mov eax, dword [esp + 0x20]
mov dword [0x409914], eax
mov eax, dword [esp + 0xb8]
mov dword [0x409918], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCommandLineA]
call eax
mov bl, byte [esp + 0xd1]
mov bh, bl
add bh, 0xf0
mov byte [esp + 0xd1], bh
mov ecx, esp
mov dword [ecx], 0
mov ecx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [esp + 0x1c], eax
mov byte [esp + 0x1b], bl
call ecx
sub esp, 4
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], esp
mov dword [esp + 0xb4], eax
mov eax, dword [esp + 0x24]
shr eax, 2
mov dword [esp + 0x24], eax
jmp 0x4019cc
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
mov eax, dword [esp + 0xc4]
add eax, 0xffffd6d6
mov ecx, esp
mov dword [ecx], eax
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax
sub esp, 4
mov eax, dword [esp + 0x24]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0xc4]
add eax, 0xffffec60
cmp dword [esp + 0xc0], eax
jb 0x401a50
lea eax, [0x40106c]
lea ecx, [esp + 0x34]
mov edx, dword [esp + 0x24]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call sub.msvcrt.dll_sprintf
mov ecx, 0x292a
mov edx, dword [esp + 0xc4]
mov esi, dword [esp + 0x24]
add esi, 0xffffffff
sub ecx, edx
mov dword [esp + 0x24], esi
mov edx, esp
mov dword [edx + 4], 0
mov dword [edx], 0x4010a6
mov edx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
call edx
sub esp, 8
mov ecx, dword [esp + 0xc]
cmp eax, ecx
jne 0x4019b2
jmp 0x401a67
mov eax, dword [esp + 0xc4]
add eax, 0xffffd6d6
cmp dword [esp + 0x28], eax
ja 0x4019e9
jmp 0x4019a6
mov al, byte [esp + 0x1b]
xor al, 0x5a
mov byte [esp + 0xd1], al
jmp 0x4019cc
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x4e4d66c0
nop
nop
nop
nop
nop
test eax, eax
je 0x43104e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x42f3f8
mov ecx, 0x663127f9
nop
nop
nop
test eax, eax
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..rdata
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x305c50eb
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x6599435b
nop
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x468b3c
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004689b3

Function at 0x402dc0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x40d029], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push str.Marmimo
push str.Mimoclass
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x402e08
xor eax, eax
jmp 0x402e23
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4053d3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004042c5
and dword [ebp - 4], 0
cmp dword [0x40ea48], 0
mov ebx, eax
jne 0x405484
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x405535
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x405535
push eax
call fcn.00404253
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40ea48], eax
call esi
push eax
call fcn.00404253
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40ea4c], eax
call esi
push eax
call fcn.00404253
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40ea50], eax
call esi
push eax
call fcn.00404253
pop ecx
mov dword [0x40ea58], eax
test eax, eax
je 0x405484
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404253
pop ecx
mov dword [0x40ea54], eax
mov eax, dword [0x40ea54]
cmp eax, ebx
je 0x4054dc
cmp dword [0x40ea58], ebx
je 0x4054dc
push eax
call fcn.004042ce
push dword [0x40ea58]
mov esi, eax
call fcn.004042ce
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4054dc
test edi, edi
je 0x4054dc
call esi
test eax, eax
je 0x4054d3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4054d3
test byte [ebp - 0xc], 1
jne 0x4054dc
or dword [ebp + 0x10], 0x200000
jmp 0x405515
mov eax, dword [0x40ea4c]
cmp eax, ebx
je 0x405515
push eax
call fcn.004042ce
pop ecx
test eax, eax
je 0x405515
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405515
mov eax, dword [0x40ea50]
cmp eax, ebx
je 0x405515
push eax
call fcn.004042ce
pop ecx
test eax, eax
je 0x405515
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40ea48]
call fcn.004042ce
pop ecx
test eax, eax
je 0x405535
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x405537
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40723e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40dac8]
jne 0x407248
repz ret
jmp fcn.00408965
Function at 0x539d61
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0xab18539f
cmc
lcall 0x64d8, 0x1529e7b
jge 0x539d00
cmpsd dword [esi], dword es:[edi]
add edx, dword [si + 0x75ed]
cld
and dl, byte [edi + 0x37]
out 0xd2, al
ret
jbe 0x539cb8
jbe 0x539cb8
sti
ret 0xbe96
xchg esi, eax
mov esi, 0x2610960f
salc
inc eax
int1
test eax, 0xc21ed8ce
shl bl, cl
or bh, dh
outsb dx, byte [esi]
sahf
into
into
mov cl, 0xb0
mov ebp, dword [edx]
sal dword [ebp - 0x457da9d9], 1
das
pop ss
pop dword [edi]
jne 0x539d4e
pop edi
sbb byte [ecx - 0x29f2a908], al
sbb byte [eax + 0x2d], al
mov edi, 0x32eccf55
push cs
in eax, 0x88
adc byte [ebp + 0x18d70853], al
fdiv dword [edx - 0x7421c82d]
ja 0x539dbc
aaa
fimul word [ebx + 0x716f77f3]
jno 0x539db2
arpl dx, bp
fsubr st(5)
aad 0xec
mov ch, 0x38
jo 0x539cff
ljmp 0x38b5:0xecd5edd8
jbe 0x539d04
xchg ebp, eax
jmp 0xd8206878
stc
test byte [edi], 0xc0
sub dword [ecx], esp
jl 0x539d47
aas
fcmovbe st(0), st(5)
aad 0x38
mov dl, 0x61
xchg ebx, eax
mov eax, 0x30febfc4
pop ds
and eax, 0xabfe5523
invalid
jl 0x539d6c
dec ebx
sbb al, 0xf6
int3
insd dword es:[edi], dx
jl 0x539dfa
inc ebp
call 0x479e352c
cli
inc edx
adc al, byte [esi]
pop ebx
das
mov cl, 0x48
popfd
loope 0x539e40
out 0xcb, eax
daa
pop ecx
sub dword [ebx - 0x23], esi
fucompi st(5)
mov ebx, dword [edx + 0x7f8e5656]
inc esp
out 0x42, eax
call dword [ebx + 0x7e611099]
xor dword [eax - 0xc], esi
and ch, al
sub ebp, dword [eax + 0x105882f1]
and byte [ebp - 0x76f57a15], al
xchg ecx, eax
mov bh, 0x97
cmpsd dword [si], dword es:[di]
invalid
aad 0x94
dec esp
inc esi
xor dword [edi + 0xd], 0x425537f6
dec esp
jb 0x539de3
mov dword [0x92ccd911], eax
adc eax, 0xfbe9f35a
or byte [ebx + 0x74a21731], dh
lodsb al, byte [esi]
imul edx, dword [edx], 0xffffffa1
mov ebp, esp
dec ecx
jne 0x539ec2
aad 0x4c
mov dword [0x4712b36e], eax
in al, 7
adc eax, 0x81fd1bee
sti
pop esp
push edi
mov ecx, dword [eax + 0x5dff4230]
invalid
xor esp, dword [ebp - 0x57607225]
mov eax, 0xae8b71ac
push ds
lds ecx, [eax]
ret
Function at 0x5ca8d1
Capabilities:
Encode data using xor

Disassembly:
sti
retf 0x8a67
mov ebp, 0xdd42bc7a
push eax
fiadd dword [edx - 0x7600de1f]
in eax, dx
into
pop esi
scasb al, byte es:[edi]
pop edx
mov bh, 0x2f
fild qword [esi + eax*4]
scasb al, byte es:[edi]
popfd
cmpsd dword [esi], dword es:[edi]
cdq
sub ecx, dword [ebp + 0x7b]
push ds
call 0x5fdd1990
push esp
idiv byte [esi + 0x729e759a]
into
mov esi, 0x47fc5f06
and eax, 0x2a2271a0
loopne 0x5ca885
bnd jo 0x5ca932
xor byte [edx], cl
dec esp
jno 0x5ca84f
and dword [esi + 0x30], ebx
mov ecx, 0x34538976
adc al, 0x81
dec edi
push ebx
mov eax, dword [0x6235de14]
adc al, 0xde
xor eax, 0x6b71062
sub al, 0xcb
sal dword [ecx], cl
mov esi, 0x822fe815
adc al, 0xde
xor eax, 0x6b71062
sub al, 0xcb
sal dword [ecx], cl
mov esi, 0x822fe815
mov edi, 0x3ee6dbf6
aas
xchg dword [edi - 0x28], esi
pop ecx
push esp
fbld tbyte [ecx + 0xa]
inc esi
enter 0xffffffffffffa381, 5
insd dword es:[edi], dx
jge 0x5ca8ea
cdq
ficomp word [edi]
jle 0x5ca94e
jecxz 0x5ca8ba
out dx, al
mov byte [0x4e45ab43], al
cli
into
mov dword [0x7bfaee05], eax
int 0x74
xchg byte [ebp - 0x2d872e7a], bh
dec edi
xor bh, byte [esi]
jnp 0x5ca942
in eax, 0x77
add bh, dh
push ebx
dec edi
hlt
adc bh, byte [eax]
xchg edi, eax
movsd dword es:[edi], dword [esi]
mov dh, 0xbb
push edi
retf
adc esi, ecx
jae 0x5ca914
jp 0x5ca978
inc edx
push ebp
inc ebx
ljmp 0x1a80
mov al, 0xdc
sbb byte [edx], 0xb3
add al, 0x61
invalid
inc ebx
pop esi
and dword [ebp + 0x343fd03f], ecx
cld
pop ds
adc dh, byte [esi + 0x26d51e88]
inc edx
push ss
int3

Function at 0x5cb381
Capabilities:
Encode data using xor

Disassembly:
sbb eax, ebp
cld
dec esp
inc eax
pop ds
add ebx, dword [ebp + 0x430f860b]
aas
loop 0x5cb3da
xchg edx, eax
push ebp
adc ebp, dword [esi - 0x4848d2bf]
fistp qword [ebx - 0xe386124]
lcall 0x92f0, 0x3c3c537d
mov eax, dword [0x6969bf7d]
jo 0x5cb371
call dword ss:[ebx + 0x3f]
jb 0x5cb333
invalid
xchg ebp, eax
push esi
stosd dword es:[edi], eax
mov al, byte [0x4ebc0a9]
aas
invalid
Function at 0x78bed0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1bc000]
push edi
or ebp, 0xffffffff
jmp 0x78bef2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x78bef9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x78bee8
mov eax, 1
add ebx, ebx
jne 0x78bf0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x78bf1c
jne 0x78bf2c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x78bf2c
dec eax
add ebx, ebx
jne 0x78bf28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x78bf00
xor ecx, ecx
sub eax, 3
jb 0x78bf44
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x78bfb6
sar eax, 1
mov ebp, eax
jmp 0x78bf4f
add ebx, ebx
jne 0x78bf4f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x78bf5c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x78bf80
inc ecx
add ebx, ebx
jne 0x78bf6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x78bf61
jne 0x78bf7d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x78bf61
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x78bfa0
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x78bf91
jmp 0x78beee
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x78bfa0
add edi, ecx
jmp 0x78beee
pop esi
mov edi, esi
mov ecx, 0x989b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x78bfbe
cmp byte [edi], 0x23
jne 0x78bfbe
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x78bfc3
lea edi, [esi + 0x387000]
mov eax, dword [edi]
or eax, eax
je 0x78c03b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x38d830]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x38d970]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x78bff0
mov ecx, edi
jns 0x78c01f
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x38d974]
or eax, eax
je 0x78c035
mov dword [ebx], eax
add ebx, 4
jmp 0x78c00d
call dword [esi + 0x38d978]
popal
jmp 0x4018c4

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0xf7132c
Capabilities:
Encode data using xor

Disassembly:
jmp 0xf71336
pushal
call 0xf7133c
pop ebp
sub ebp, 0x10
sub ebp, 0xb7132c
jmp 0xf71352
mov eax, 0xb7132c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5dd
add byte [ecx + 0x5dd], bh
mov edx, 0x86e10cdc
xor byte [eax], dl
inc eax
dec ecx
jne 0xf71369
jmp 0xf7137c
push edi
adc dword [edi + 0x55], edx
loopne 0xf7135e
invalid
Function at 0x6fd910
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x18f000]
mov dword [edi + 0x1eabf4], 0x58008ded
push edi
jmp 0x6fd93a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6fd941
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6fd930
mov eax, 1
add ebx, ebx
jne 0x6fd953
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x6fd964
jne 0x6fd983
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6fd983
dec eax
add ebx, ebx
jne 0x6fd970
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x6fd948
add ebx, ebx
jne 0x6fd97f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x6fd9d5
xor ecx, ecx
sub eax, 3
jb 0x6fd99b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x6fda0a
sar eax, 1
mov ebp, eax
jmp 0x6fd9a6
add ebx, ebx
jne 0x6fd9a6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6fd974
inc ecx
add ebx, ebx
jne 0x6fd9b4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6fd974
add ebx, ebx
jne 0x6fd9c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x6fd9b6
jne 0x6fd9d2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x6fd9b6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x6fd9f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x6fd9e6
jmp 0x6fd936
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x6fd9f4
add edi, ecx
jmp 0x6fd936
pop esi
mov edi, esi
mov ecx, 0x8d32
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x6fda12
cmp byte [edi], 0x19
jne 0x6fda12
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x6fda17
lea edi, [esi + 0x2f0000]
mov eax, dword [edi]
or eax, eax
je 0x6fda8f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3246e4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3248ac]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6fda44
mov ecx, edi
jns 0x6fda73
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3248b4]
or eax, eax
je 0x6fda89
mov dword [ebx], eax
add ebx, 4
jmp 0x6fda61
call dword [esi + 0x3248b0]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x6fdac0
cmp al, 0xef
ja 0x6fdab3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x6fda95
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x6fdaa2
mov ebp, dword [esi + 0x3248b8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x267]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x6fdaf4
sub esp, 0xffffff80
jmp 0x479927